Beyond phishing: The top employee security risks you're probably not measuring

While we all know email is a big target for attackers, it’s important to remember that email is not the only risk vector. As companies use more tools and features, the risks grow too. Email is just one piece of the puzzle, which is why it is crucial to consider a wide range of employee security behaviors to get a holistic view of your risks. By doing so, you can focus resources more efficiently.

Human Risk Management (HRM) is a vital part of cyber security. Even if you have technological safeguards in place, HRM plays a substantial role in your overall security stance. Here I highlight some of the employee cyber risks that often get overlooked and how we can better keep an eye on them in real time.

Password reuse across SaaS apps

Out of the millions of logins to shadow Software as a Service (SaaS) applications analyzed by the CultureAI Platform over the last two months, it found that 38 percent of employees were logging in using a password they already use on other apps. Amazon, Google, and Microsoft were among the most impacted apps, all of which store highly sensitive data.

When an employee uses the same password across multiple places, it means that if one of those sites experiences a security breach, there is a significant risk of unauthorized access to other applications -- an attack known as 'credential stuffing'. The more the password is reused, the more opportunities there are for that password to be compromised or stolen.

You can address the risk of password reuse with continuous, targeted coaching that helps improve employee password habits. People are human though and will make mistakes or take shortcuts. So new technologies like automated interventions can act as a safety net.

By utilizing real-time data from browser extensions, you can get visibility into the SaaS platforms used by your workforce. This enables you to identify risky behaviors in real time, such as re-using credentials or not using multifactor authentication (MFA) or single sign-on (SSO).

Shadow SaaS and unapproved software

Keeping your data safe and secure can be a challenge at times, and one of the reasons for that is the presence of shadow SaaS and unapproved software. These unauthorized applications can pose a significant risk to your organization, leading to data breaches, compliance issues, and increasing vulnerability to cyberattacks. However, effectively identifying and managing such unauthorized usage can be a daunting task.

By monitoring app usage, you can gain visibility and insight into what apps and software are being used, helping to identify instances of unapproved software and understand where action needs to be taken.

Instead of just focusing on restricting shadow IT, I’d suggest a more proactive and understanding approach. If an employee is using a certain app, it’s probably because it serves a specific business need. Instead of reprimanding them, you can guide and coach them towards an authorized software solution when unauthorized usage is detected.

This not only enhances security but also encourages employees to make informed choices and actively contribute to a secure work environment. Such an approach promotes a security-conscious culture and empowers employees to play an active role in creating a safer workplace.

Multi-Factor Authentication (MFA) vulnerabilities

MFAis an essential layer of security that's commonplace in enterprise deployments. Even if someone’s password is compromised, the extra authentication makes it much harder for unauthorized individuals to gain access. While it's not a silver bullet, it often acts as the final defense in many cases, so its significance should not be underestimated.

That said, MFA can sometimes lead to security complacency among employees. They may develop a false sense of invincibility, assuming that with MFA enabled, they are completely protected. Attackers are sometimes taking advantage of this using MFA fatigue attacks.

By continuously mimicking legitimate MFA prompts, attackers can trick employees into providing login credentials or approving unsolicited authentication requests. Prominent cases of potential MFA fatigue attacks have involved companies like Uber, Microsoft, and Cisco.

In a recent MFA phishing simulation attack run using CultureAI, it was found that 31 percent of employees accepted an unsolicited MFA request. One of the main reasons for this is a lack of employee awareness. That’s why it’s crucial to provide targeted coaching and run MFA attack simulations. These simulations help you to proactively identify vulnerabilities and offer specific coaching to improve employee preparedness. This way, the risk of falling victim to real MFA attacks is minimized.

What’s Next

Phishing is a major security threat to employees as it exploits their vulnerabilities, using social engineering to deceive individuals into sharing sensitive information or installing malicious software. While it's important to address phishing, it shouldn't be at the expense of other risks. Focusing only on one risk can leave your organization exposed, which is why a strong cyber security strategy requires the implementation effective HRM.

By opting for a HRM platform that seamlessly integrates with your tech stack and tracks employee security behaviors across email, instant messaging, SaaS apps, and file collaboration tools, you can get a complete picture of your most prominent human cyber risks. An effective HRM platform will also enable you to improve these behaviors and mitigate risks through targeted coaching, interventions, and nudges that actively promote and reinforce good security practices.

Image credit: videoflow/depositphotos.com

Frederick Coulton is Head of Product at CultureAI.