Organisations have made data breaches their top priority. But cybercriminals hacking the system is not the only thing you should be concerned about; your systems and information can be compromised through a number of ways.
Let’s have a look at some of the most common ways data can be breached and examples of how it can happen. Trident Assurance Services and other organisations that protect your interests are useful, but you should also be taking precautions so that you don’t need their services.
1. Employee Error
The weakest link when it comes to data breach defence is an employee. You should always keep in mind that your data and system is just a click away from getting hijacked.
Some incidents arise as a result of an employee not following the procedures which then results in a leak. An example is when emails are sent out in bulk, then the recipients being added in the Cc field instead of Bcc field.
When this happens, the recipients of the email are going to see other email addresses that got the message. This is bad because it ends up exposing the address of someone who signed up for the newsletter. It can be even worse when it reveals personal information such as political affiliation or medical status.
2. Cyberattack
Cybercriminals have many ways of targeting organisations, but they can be categorised into three different categories. The first is exploiting the system to access information. This will include the above example and using methods such as brute-force password hacks, this is where the hacker goes to the log-in page then uses a tool generating millions of different password so it can then look for the right one.
The tools can be able to break into the account in a couple of seconds if the owner of the account doesn’t have a strong password.
The second one involves using malware to get sensitive information or disrupt the business. There is a wide range of malware, with each of them designed to fulfil a given purpose. Some have been designed to work on the background so they can collect information on the browsing habits of the user or even use the CPU of the computer to carry out tasks for the hacker. Some malware is a little more explicit, e.g. virus, ransomware, and adware that can end up deleting the files and corrupting the system.
The third is social engineering. This is a little different from the others, and that is why it deserves discussion.
3. Social Engineering
This is an attack where the hacker masquerades as a legitimate organisation or person. Depending on their method of attack, they will try tricking the user to;
- Give them sensitive data
- Download an attachment
- Give them access to restricted spaces (either the physical access to the premises of the organisation or log in details)
Phishing is the most popular form of social engineering. These are emails sent out by the criminals that have an urgent request, and they are commonly about login details or service delivery of the organisation.
Phishing attacks are commonly used by email, but they have been used in text messages and social media.
4. Malicious Insider
As we had stated earlier, employees are a security vulnerability to an organisation. This is not only because they can make mistakes that make it easier for criminals to access the information, but they might be the ones stealing.
There are different reasons why a malicious insider does such a thing. This includes:
Revenge: When an employee is feeling unappreciated or he/she has been laid off by the organisation, they can decide to hit back at the organisation.
Financial gain: some employees are tempted to steal information then sell them on the dark web.
5. Physical Theft
Not all breaches will involve information. Organisations need to think about physical theft – these are devices providing access to information and paper records.
Paper records can end up in the wrong hands if they are not disposed of properly. A crook will have an easier time when he/she realises you throw the documents in the bin without shredding them.
Any person can get the documents if they are just sitting on the bin. Organisations should be careful when it comes to disposal of devices such as USB sticks and computer. Fraudsters can access sensitive data if it is not completely wiped off.
Leave a Reply