Fostering a culture of cybersecurity: tools to help minimize the risk of human error

Human error is a significant and common factor in cybersecurity incidents.

Despite advances in technology and security measures, humans remain a weak link in the overall cybersecurity chain. Cybersecurity incidents are often multifaceted and involve a combination of technical vulnerabilities, malicious activities as well as human factors.

Human error in the cyber realm comes in many forms. We often think of it as clicking a link we shouldn’t have or opening an attachment from someone we don’t know. However, human error can also mean lack of action, such as using weak passwords or not educating employees.

The bottom line is everyone makes mistakes. No one intends to subject themselves or their business to a cyber attack. But it happens. Fortunately, there are simple steps you can take to help prevent human error from exposing your organization.

Perform an assessment and implement recommendations

The first step is of course, to have a free cybersecurity assessment performed as part of the Project Boundary Fence program.

All of Heartland Energy’s customers have access to this service, provided at no cost either by the South Dakota Attorney General’s Office or by Heartland Energy.

However, the assessment is only useful if their recommendations are implemented. Most of the time, they are simple things like ensuring not all employees have administrator rights, strengthening passwords or ensuring your Wi-Fi isn’t publicly accessible.

A common recommendation we see is to enable multi-factor authentication (MFA).

MFA enhances security by requiring users to identify themselves by more than just a username and password.

MFAs work by requiring additional verification information, such as a one-time password. These are typically codes you receive via email, SMS or some type of mobile app. A new code is generated each time an authentication request is submitted.

MFAs can also include answering personal security questions, fingerprints, facial recognition or other options.

Common human errors

Human error can impact cybersecurity in a variety of ways. Here are just a few examples.

Phishing Attacks: Phishing is a method where attackers use deceptive emails, messages or websites to trick individuals into revealing sensitive information such as login credentials or financial details. Individuals may fall victim to phishing attacks due to lack of awareness, failure to scrutinize emails or being deceived by seemingly legitimate requests.

Weak Passwords: Weak or easily guessable passwords are a common vulnerability that can be exploited by attackers to gain unauthorized access to systems. Users often choose weak passwords or reuse passwords across multiple accounts, making it easier for attackers to compromise their accounts.

A password manager offers several advantages in terms of security. Password managers generate and store strong, unique passwords for each of your accounts. They use encryption to secure your password vault. Users only need to remember one master password to access all their stored passwords. Password managers often include features to analyze the strength of existing passwords and prompt users to update weak or reused passwords.

Unintentional Data Exposure: Employees may accidentally expose sensitive information through actions like misconfigured security settings, sending sensitive data to the wrong recipient, or unintentionally making data publicly accessible. Lack of awareness, distraction or simple oversight can lead to unintentional data exposure incidents.

Lack of Training and Awareness: A lack of cybersecurity training and awareness programs can leave individuals uninformed about potential threats and best practices. Without proper training, employees may not recognize security threats, making them more susceptible to falling victim to attacks.

Education is key

Education is paramount in cybersecurity and plays a crucial role in creating a defense against cyber threats.

Education raises awareness about the latest cyber threats and vulnerabilities. Informed individuals are more likely to recognize and respond appropriately to potential security risks.

Education equips individuals with the knowledge to identify and mitigate risks. It also provides individuals with the skills needed to implement and manage security measures.

In the event of a cyber attack, education prepares individuals to respond quickly and effectively.

Perhaps most importantly, education fosters a culture of cybersecurity. When employees understand the importance of security and the impact improper controls can have, they are more likely to adopt security measures as part of their routine behavior.

We all think we will never be impacted by a cybersecurity event. The truth is, we are all vulnerable whether it be at work or on our personal devices if we don’t take the proper steps to protect ourselves.

Heartland Energy will continue to provide resources as well as training at customer events to help customers improve their cybersecurity posture. But it is up to you to implement the lessons learned to benefit your employees, your customers and your organization.