[{"innerBlocks":[],"name":"core\/freeform","postId":125867,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"It seems that every day we are waking up to news about another data breach. This year alone brought major data breaches to organizations as disparate as Capital One, Quest Diagnostics, DoorDash, Fortnite and the City of Baltimore.With National Cybersecurity Awareness Month<\/a> in full swing, it\u2019s a reminder that while we are all getting better at recognizing the risks of being connected, we still need to work on changing our behavior to mitigate those risks.Some contend that no amount of behavioral change can outsmart the hackers, and perhaps there is a sliver of truth to that\u2014after all, technology is constantly evolving, and so are hackers\u2019 methods. But human error\u2014or a lack of behavioral change in light of what we know about cyberattacks\u2014is sometimes still a major cause of data breaches.

When you consider the Capital One breach, for example, it wasn\u2019t a matter of bad actors outsmarting the system. The hack\u2014which affected 100 million customers\u2014was done by a former software engineer at a third-party provider, which the bank used for its cloud services. While the hacker did not have any inside access due to her former role, she allegedly exploited a vulnerability in the cloud service\u2014one that had been known for some time.A recent survey by Verizon<\/a> found that 27 percent of company data breaches were a result of vulnerability exploitation, such as a broken patch on an operating system. The vast majority of these weaknesses are already known. In fact, Gartner<\/a> reports that \u201c99 percent of the vulnerabilities exploited by the end of 2020 will continue to be ones known by security and IT professionals at the time of the incident.\u201dEvery network has vulnerabilities\u2014sometimes many\u2014and patching them all is a challenge and can take months or years to address. Good vulnerability management software can be instrumental in helping organizations tend to these problems, but IT professionals must also assess which vulnerabilities pose the biggest risk and which are less problematic and can afford a delay in fixing. While software can help, it is up to humans to weigh the risks and take appropriate action.The breach at DoorDash illustrated yet again, a common problem that also affected Capital One and many other organizations: the risk of third-party service providers. The breach, which affected 4.9 million customers, was a result of an unnamed third party that, through its own vulnerability, enabled the hacker to gain access to its network and then move into DoorDash\u2019s.This breach and others like it highlight the importance of establishing a strong cybersecurity policy and thoroughly vetting third-party vendors to ensure that they have done their own due diligence with cybersecurity. Periodically monitoring any third-party service providers, understanding what data they are collecting and how it will be stored, is essential.Most important, all businesses should follow the National Institute of Standards and Technology (NIST) cybersecurity framework<\/a>, which urges businesses to:

Identify and understand which business assets (\u201cdigital crown jewels\u201d) bad actors want.<\/li>

Learn how to protect those assets.<\/li>

Detect when something has gone wrong.<\/li>

Respond quickly to minimize impact and implement an action plan.<\/li>

Learn what resources are needed to recover after a breach.<\/li><\/ul>A data breach can wreak havoc on an organization, damaging it not just financially, but reputationally.I am not arguing that there is always an easy fix for the kind of breaches suffered by both Capital One and DoorDash, but it is up to us to be vigilant. Cybersecurity isn\u2019t just an issue affecting IT professionals\u2014it\u2019s one that affects the organization, its employees and its customers.","saveContent":"It seems that every day we are waking up to news about another data breach. This year alone brought major data breaches to organizations as disparate as Capital One, Quest Diagnostics, DoorDash, Fortnite and the City of Baltimore.With National Cybersecurity Awareness Month<\/a> in full swing, it\u2019s a reminder that while we are all getting better at recognizing the risks of being connected, we still need to work on changing our behavior to mitigate those risks.Some contend that no amount of behavioral change can outsmart the hackers, and perhaps there is a sliver of truth to that\u2014after all, technology is constantly evolving, and so are hackers\u2019 methods. But human error\u2014or a lack of behavioral change in light of what we know about cyberattacks\u2014is sometimes still a major cause of data breaches.When you consider the Capital One breach, for example, it wasn\u2019t a matter of bad actors outsmarting the system. The hack\u2014which affected 100 million customers\u2014was done by a former software engineer at a third-party provider, which the bank used for its cloud services. While the hacker did not have any inside access due to her former role, she allegedly exploited a vulnerability in the cloud service\u2014one that had been known for some time.A recent survey by Verizon<\/a> found that 27 percent of company data breaches were a result of vulnerability exploitation, such as a broken patch on an operating system. The vast majority of these weaknesses are already known. In fact, Gartner<\/a> reports that \u201c99 percent of the vulnerabilities exploited by the end of 2020 will continue to be ones known by security and IT professionals at the time of the incident.\u201dEvery network has vulnerabilities\u2014sometimes many\u2014and patching them all is a challenge and can take months or years to address. Good vulnerability management software can be instrumental in helping organizations tend to these problems, but IT professionals must also assess which vulnerabilities pose the biggest risk and which are less problematic and can afford a delay in fixing. While software can help, it is up to humans to weigh the risks and take appropriate action.The breach at DoorDash illustrated yet again, a common problem that also affected Capital One and many other organizations: the risk of third-party service providers. The breach, which affected 4.9 million customers, was a result of an unnamed third party that, through its own vulnerability, enabled the hacker to gain access to its network and then move into DoorDash\u2019s.This breach and others like it highlight the importance of establishing a strong cybersecurity policy and thoroughly vetting third-party vendors to ensure that they have done their own due diligence with cybersecurity. Periodically monitoring any third-party service providers, understanding what data they are collecting and how it will be stored, is essential.Most important, all businesses should follow the National Institute of Standards and Technology (NIST)
cybersecurity framework<\/a>, which urges businesses to:
- Identify and understand which business assets (\u201cdigital crown jewels\u201d) bad actors want.<\/li>
- Learn how to protect those assets.<\/li>
- Detect when something has gone wrong.<\/li>
- Respond quickly to minimize impact and implement an action plan.<\/li>
- Learn what resources are needed to recover after a breach.<\/li><\/ul>A data breach can wreak havoc on an organization, damaging it not just financially, but reputationally.I am not arguing that there is always an easy fix for the kind of breaches suffered by both Capital One and DoorDash, but it is up to us to be vigilant. Cybersecurity isn\u2019t just an issue affecting IT professionals\u2014it\u2019s one that affects the organization, its employees and its customers.","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Better understanding the role of human error in data breaches

More for you