{"id":2220,"date":"2017-07-25T10:09:32","date_gmt":"2017-07-25T08:09:32","guid":{"rendered":"https:\/\/www.organisator.ch\/?p=2220"},"modified":"2017-07-25T10:09:32","modified_gmt":"2017-07-25T08:09:32","slug":"etliche-cybersicherheitsvorfaelle-verursachen-mitarbeitende","status":"publish","type":"post","link":"https:\/\/www.organisator.ch\/en\/management\/it\/2017-07-25\/etliche-cybersicherheitsvorfaelle-verursachen-mitarbeitende\/","title":{"rendered":"Several cybersecurity incidents are caused by employees themselves"},"content":{"rendered":"
\"\"
In two out of five companies, incidents are covered up on the job. 46 percent of all incidents are caused by employees, according to the Kaspersky study. (Image: Kaspersky)<\/figcaption><\/figure>\n

Employees themselves are a risk to organizations. A global study by Kaspersky Lab shows that 46 percent of all cybersecurity incidents are caused by employees. What's more, 40 percent of self-inflicted cybersecurity incidents are kept secret.<\/p>\n

Many circulating attacks target employees, who often exhibit a lack of care or attention to their documents. Employees are the \"easiest gateway for highly technical and specialized attacks on companies,\" highlights a recent Kaspersky study.<\/p>\n

Targeted methods<\/strong><\/p>\n

According to Kaspersky Lab, 28 percent of all targeted attacks last year were carried out via phishing or social engineering. An example: an email contains a malicious file disguised as a supplier's invoice; if this is opened by a careless accountant, the corporate network may already be infected.<\/p>\n

\"Employees often open the doors to a company's infrastructure for cybercriminals,\" explains David Jacoby, security researcher at Kaspersky Lab. \"The spectrum of attacks ranges from phishing emails to passwords that are too weak to supposed calls from IT support. Another scam involves seemingly lost and compromised memory cards that are deliberately placed in the company parking lot or secretary's office and then found and read by well-meaning colleagues.\"<\/p>\n

Corporate management required<\/strong><\/p>\n

Employees are reluctant to report cybersecurity incidents for fear of possible consequences - according to the Kaspersky study, 40 percent of companies do so. The consequences are serious, because security experts need to identify cybersecurity incidents as quickly as possible in order to combat them adequately.<\/p>\n

Instead of threatening with strict rules and consequences, companies should therefore promote awareness and a willingness to cooperate. \"Cybersecurity is not just a question of technology, but also a question of corporate culture. Top management and HR departments should also be aware of this,\" says Slava Borilin, Security Education Program Manager at Kaspersky Lab.<\/p>\n

\"When employees cover up incidents, there are good reasons: guidelines that are too strict and unclear, too much pressure, or the search for culprits. All of these lead employees to cover up the truth out of fear. Far better results come from a positive cybersecurity culture that emphasizes awareness building and information flow, and is exemplified by senior management.\"<\/p>\n

Information, good working atmosphere and technology<\/strong><\/p>\n

The silver bullet for preventing human cybersecurity failures lies in the combination of technical and personnel measures, which form two main layers:<\/p>\n