Agent Smith could have been stopped if staff had been more diligent about their conversations and about trying to access prohibited sites. As Mark mentioned, policies should be quite explicit about what people are allowed to do or not allowed to do.

According to AAG, around 236 million ransomware attacks occurred globally in the first half of 2022 alone, while 39% of UK businesses reported that they suffered a cyber attack in 2022.

Cyber criminals are now targeting vulnerabilities through the supply chain, with up to 40% of cyber threats occurring in some way through the supply chain. What’s more, research has shown that cyber security leaders are struggling with the constant vigilance required from our increased digital connections.

Cyber criminals are using this fatigue to their advantage. A study has revealed that just 23% of security leaders monitor their partners and vendors in real-time for cyber security risks.

The online threat

Basic diagram showing elements of the online threat affecting the user: Phishing, Pretext and Malware which the user risks when using phone, laptop or tablet.

Figure 1: Online threat

Let’s look at the inherent threat posed by an individual’s online presence. Most people are online at home and at work. Not only does that mean their personal and sensitive information is at risk, but it also means that confidential organisation information could be at risk if they don’t remain vigilant and follow the correct procedures. 

Social engineering describes how hackers use deception to manipulate individuals into divulging confidential or personal information which they’ll use for fraudulent purposes. They might adopt what’s known as a pretext, which is pretending to be somebody they’re not to convince the end-user to give them vital clues which enable them to gain access to the system they’re targeting.

Personal information and hackers

As the sheer amount of personal information and personally identifiable information (PII) you post online gets larger, so the potential for hacking and social engineering attacks increases.

Let’s look at the ways hackers could try to attack you and your organisation:

Target: Hackers may search for specific information about your organisation.
Identity: Hackers search other sites for the same name, photo, and personal data.
Family and friends: Having located you on another site, hackers search for the details of family and friends, including their images and other information.
Associates: Hackers make contact with your connections in order to gain trust or to gather further information.
Location: If you have location services turned on, hackers might find any social media posts or images that are geotagged.
Timing: Based on your posts and geolocation data, hackers can guess where you are likely to be at certain locations.
Social engineering: Hackers might attempt to trick you into revealing sensitive information by befriending you online or using another ‘baiting’ technique.

How do you combat this threat?

In order to counter this threat, the information security officer needs to publicise corporate policies that encourage a culture of security, and senior management support is essential to reinforce this. Not only this, but a ‘security mindset’ needs to be engendered in every individual who works in and for the organisation, with regular procedural updates and fresher items shared. ‘If you see something, then say something’ should be a company motto.

A security culture protects

SELF PACED PLATFORM

TRAINING CONTENT

JOB ROLE PATHS

CERTIFICATIONS