True cybersecurity means centering policies on employee behavior, report says

A study from cybersecurity company Proofpoint found that 2020 was a big year for cybercriminals, who shifted their strategies to better target vulnerable remote workers. Those trends, Proofpoint concludes, are here to stay, which means the human factor in cybersecurity is more important to focus on than ever before.

SEE: Security incident response policy (TechRepublic Premium)

Proofpoint analyzed billions of emails and combed through records from 2020 to find some startling statistics about the state of cyberattacks that target workers. Credential phishing accounted for two-thirds of malicious emails, and attacks that tricked users into opening attachments were the most successful, enticing one in five people into opening them. Business email compromise attacks have become more complicated, CAPTCHA screens are now being used to aid in the realism of malicious web pages, and steganography (hiding malicious code in a file like an image or audio) had the highest rate of success, with one in three falling victim. 

“Attackers don’t hack in, they log in, and people continue to be the most critical factor in today’s cyber attacks. The threat ecosystem has evolved over the past year, and this report explores how a people-centric approach to cybersecurity can reduce today’s risks,” said Proofpoint’s EVP of cybersecurity strategy, Ryan Kalember.

The 31-page report is divided into three areas: Vulnerabilities, which looks at how attackers are fooling users; attacks, which looks at how cybercriminals exploit vulnerabilities and the types, techniques, and tools they use; and privilege, which examines insider threats and how high-privileged users can become a risk, even unknowingly. 

Looking over the report is a good way to learn what sort of risks an organization can expect, but Proofpoint also spells out how organizations and their IT leaders can implement a people-centric cybersecurity policy, which it again divides into three sections.

First, it’s essential to mitigate vulnerabilities, by which is meant eliminating potential weak points among employees. This can be done by:

• Training users to spot malicious messages by mimicking real-world attacks
• Isolate potentially malicious websites and URLs through firewall rules, browser filters and email rules. 
• Threats continue to evolve, so know that a user will make a mistake eventually, which leads to the second section.

Attacks are inevitable, Proofpoint said, so treat them as ever-present threats and prepare accordingly: 

• Build a robust email fraud defense system that can quarantine and block messages. Analyze both ingoing and outgoing email traffic to find abnormalities.
• Ransomware requires an initial infection; fight to prevent those infections of trojans, loaders and other malware.
• Protect cloud accounts from takeover by using tools like two-factor authentication, biometric logins and other methods that supplement traditional password-based security.

SEE: How to manage passwords: Best practices and security tips (free PDF) (TechRepublic)

Privilege is the last area Proofpoint covers. It explains privilege as a risk that arises from privileged accounts that are either used as an initial attack vector or are compromised after an attacker has already broken in. Either way, Proofpoint recommends the following:

• Deploy an insider threat management system that can determine if an account is compromised and lock it down.
• Respond quickly to privilege abuses, both intentional and accidental.
• Enforce security policies and refresh them through regular training, real-time reminders, and account restrictions when needed.

Cybersecurity Insider Newsletter

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.
Delivered Tuesdays and Thursdays

Sign up today

Also see