‘People aren’t perfect, and everyone knows it’: Security experts still see humans as the biggest threat to their business Christian Cawley | usagoldmines.com

• Human error remains one of the biggest challenge to online security, according to industry leaders
• 68% of security professionals cite human error, compared with just 55% for email-based scams
• A worrying 80% of contributing factors in recent security incidents can be traced back to poor user practices or lack of training

New research into the challenges facing cybersecurity professionals has revealed the naked truth: that humans are considered the main challenge to security.

A new Kaseya survey of over 1,100 MSPs and IT professionals around the world uncovered a startling trend: that the risks posed by humans to their cybersecurity are considerable. Some 68% of respondents cited human error (including social engineering and distraction) as the most concerning attack vector over the next 12 months.

With the overwhelming majority of cybersecurity incidents attributable to human error, security suites and the teams that use them are increasingly focusing on ways to mitigate the challenges posed by people.

Human error

We know that humans need security as much as the data they’re working with. But the results of this survey illustrate a sad truth: that cybersecurity professionals are more concerned about user error and the vulnerabilities of “soft” targets than the threats from automated attacks against network hardware and servers.

Hackers know that humans make mistakes. Organizations need to be on the same page.

From the results of the report, we can see that after the prospect of risks caused by human error, social engineering, and distraction, 55% of those surveyed are concerned about attacks via email. Gullibility is also considered a risk (41%) as is a lack of cybersecurity training for users (40%).

Auditing isn’t always the answer, either. Of those surveyed, 65% said they would pass a compliance audit today, but 49% noted that incomplete documentation and procedures could create problems.

True cyber resilience

Worryingly, only 20% of IT departments have a budget that is growing in line with the risks they face, with 77% describing themselves as under-resourced.

“People aren’t perfect, and everyone knows it,” noted David Baggett, SVP and GM of Security Suite at Kaseya. “Yet much of cybersecurity still depends on people making the right decision every time.”

Unfortunately, it seems as though human error is here to stay. So what is the solution? Bagget says its about factoring in the poor practices and errors.

“The path to true cyber resilience isn’t about eliminating mistakes. It’s about building an organisation that can withstand them. Expect mistakes, account for constraints and engineer around them.”

As far as Kaseya is concerned, that means building security systems and practices that withstand those mistakes.