{"id":784,"date":"2024-10-30T10:08:36","date_gmt":"2024-10-30T10:08:36","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=784"},"modified":"2024-10-30T10:08:36","modified_gmt":"2024-10-30T10:08:36","slug":"leading-reason-for-data-loss-social-engineering-insider-threats","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=784","title":{"rendered":"Leading Reason for Data Loss: Social Engineering &amp; Insider Threats"},"content":{"rendered":"<div class=\"elementor elementor-34009\">\n<div class=\"elementor-element elementor-element-2a0a4cf e-flex e-con-boxed e-con e-parent\">\n<div class=\"e-con-inner\">\n<div class=\"elementor-element elementor-element-c6d57ed elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>When it comes to data loss, the biggest yet common dangers these days come from within the organization, and social engineering and insider threats are one of the main reasons. This shows that human mistakes are just as risky as external attacks.\u00a0<\/span><span>\u00a0<\/span><\/p>\n<p><span>In this piece, you\u2019ll see how social engineering and insider threats result in data loss. In addition to that, you\u2019ll look at real examples to understand the seriousness of such threats and talk about steps companies can take to protect themselves.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-164757f elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h2 class=\"elementor-heading-title elementor-size-default\">Social Engineering: A Manipulative Tactic to Trigger Data Loss<\/h2>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-2102e9e elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>Instead of hacking into networks, criminals use social engineering to exploit human psychology. They trick them to unwrap their personal information or to click malicious links, share passwords and allow unauthorized access to data.<\/span><span>\u00a0<\/span><\/p>\n<p><span>Unlike traditional attacks that try to bypass firewalls or exploit software vulnerabilities, social engineering targets human behavior, which is often the most vulnerable part of any security system.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-60e96ca elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">How Social Engineering Works<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-a2a541c elementor-widget elementor-widget-image\">\n<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-1652fea elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"TextRun SCXW83990034 BCX8\"><span class=\"NormalTextRun SCXW83990034 BCX8\">Cybercriminals use psychological methods to trick people into making critical security errors by preying on feelings like trust, fear, curiosity, or urgency. By making people think they are dealing with a reliable source, traditional cybersecurity defenses can be bypassed.<\/span><\/span><span class=\"EOP SCXW83990034 BCX8\">\u00a0<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-36ae734 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Common Types of Social Engineering<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-14b0b26 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Phishing<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-db04e7f elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>The most common type of social engineering attacks is phishing. This basically entails sending spoofed emails or messages, which a person believes are coming from a trusted source. Usually, these messages contain malicious attachments or links. The attacker may gain access to sensitive data or your system\u2019s login credentials if you click on them.<\/span><\/p>\n<p><span>One of the main causes of data breaches is phishing. The <\/span><a href=\"https:\/\/www.ic3.gov\/Media\/PDF\/AnnualReport\/2023_IC3Report.pdf\" target=\"_blank\" rel=\"noopener\"><span>FBI\u2019s 2023 Internet Crime Report<\/span><\/a><span> states that there were 323,972 reports of phishing, resulting in losses over $3.31 billion.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-55bdab3 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Spear Phishing<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-4d23f38 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>Spear phishing is a type of phishing that targets specific companies or people. Attackers research the target person\u2019s roles and interests. This makes it more likely that the victim will fall for it because it makes it much easier for attackers to create messages that look genuine and personal.<\/span><span>\u00a0<\/span><\/p>\n<p><span>Because these attacks are so meticulously thought out, high-level employees or administrators who possess sensitive data are particularly at risk.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-1a89b00 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Baiting<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-1fe8d69 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"TextRun SCXW42142279 BCX8\"><span class=\"NormalTextRun SCXW42142279 BCX8\">In this type of attack, hackers give away something appealing, like a free USB drive, that has malicious software. When the person uses the USB drive, malware gets installed, allowing the hacker to access confidential information.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-147b2c2 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Pretexting<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-dc6473a elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>When a person comes up with a story to obtain valuable information, it is called pretexting. They pretend to be someone who\u2019ll be trusted by the employees, like an IT support, HR person, or a business partner. They ask for passwords, account access, or other useful info under the guise of a legitimate request. This usually works because people trust certain authority figures.<\/span><span>\u00a0<\/span><\/p>\n<p><span>And as per <\/span><span>Verizon\u2019s 2024 Data Breach Investigations Report<\/span><span>, pretexting is responsible for 20% of the 40% of Social Engineering breaches.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-eb935c4 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Quid Pro Quo<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-479cbee elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"NormalTextRun SCXW229803546 BCX8\">Like baiting, quid pro quo involves attackers offering something in return for information or actions. For instance, the attacker could pretend to be an IT expert and offer a \u201csystem upgrade\u201d in exchange for login details. This tactic usually works because people are willing to <\/span><span class=\"NormalTextRun SCXW229803546 BCX8\">comply with<\/span><span class=\"NormalTextRun SCXW229803546 BCX8\"> company processes or are tempted by the offer of a reward.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-b922e22 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h2 class=\"elementor-heading-title elementor-size-default\">The Evolving Tactics of Social Engineering<\/h2>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-52114d5 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>As companies are improving their security, cybercriminals are working on their skills and getting better at their social engineering approaches. They don\u2019t just use simple phishing methods anymore. Now, they use very personalized tactics, like:<\/span><span>\u00a0<\/span><\/p>\n<p><span><strong>Whaling:<\/strong> It\u2019s a practice of tricking senior executives into revealing sensitive data by sending them tailored phishing emails.<\/span><span>\u00a0<\/span><span><strong>Deepfakes:<\/strong> Creating realistic audio or video of someone trusted to dupe employees into revealing information or transferring money.\u00a0<\/span><span>\u00a0<\/span><span><strong>Business Email Compromise (BEC):<\/strong> Acting as a CEO or financial manager or any high authority figure to influence employees to make large wire transfers or provide financial data.<\/span>\t\t\t\t\t\t<\/p><\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-7262cd1 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Real-World Examples of Social Engineering Leading to Data Loss<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-fcecc18 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">The 2015 Ubiquiti Networks Phishing Incident<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-5fad3fa elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"TextRun SCXW91173599 BCX8\"><span class=\"NormalTextRun SCXW91173599 BCX8\">A social engineering attempt on Ubiquiti Networks <\/span><span class=\"NormalTextRun SCXW91173599 BCX8\">costed<\/span><span class=\"NormalTextRun SCXW91173599 BCX8\"> the company <\/span><\/span><a class=\"Hyperlink SCXW91173599 BCX8\" href=\"https:\/\/www.forbes.com\/sites\/nathanvardi\/2016\/02\/08\/how-a-tech-billionaires-company-misplaced-46-7-million-and-didnt-know-it\/\" target=\"_blank\" rel=\"noopener\"><span class=\"TextRun Underlined SCXW91173599 BCX8\"><span class=\"NormalTextRun SCXW91173599 BCX8\">$46.7 million<\/span><\/span><\/a><span class=\"TextRun SCXW91173599 BCX8\"><span class=\"NormalTextRun SCXW91173599 BCX8\">. The attackers fooled staff members into sending money to phony bank accounts by posing as company leaders.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-c8f0e2d elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Google and Facebook Wire Fraud Incident<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-71f6c9c elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"TextRun SCXW22463469 BCX8\"><span class=\"NormalTextRun SCXW22463469 BCX8\">Hackers tricked workers at <\/span><\/span><a class=\"Hyperlink SCXW22463469 BCX8\" href=\"https:\/\/www.cnbc.com\/2019\/03\/27\/phishing-email-scam-stole-100-million-from-facebook-and-google.html\" target=\"_blank\" rel=\"noopener\"><span class=\"TextRun Underlined SCXW22463469 BCX8\"><span class=\"NormalTextRun SCXW22463469 BCX8\">Google and Facebook into transferring over $100 million<\/span><\/span><\/a><span class=\"TextRun SCXW22463469 BCX8\"><span class=\"NormalTextRun SCXW22463469 BCX8\"> between 2013 and 2015. To fool the companies, the criminals used fake bills and paperwork and posed to be a reliable supplier.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-7f5bdd8 elementor-widget elementor-widget-Table\">\n<div class=\"elementor-widget-container\">\n<p>\t\t\t\t\tSocial Engineering TypeDescriptionPrevalence (%)\t\t\t\t<\/p>\n<p>\t\t\t\t\tPhishingTricking users into revealing sensitive information via fraudulent emails or messages.90% of data breachesSpear PhishingHighly targeted phishing attacks at key personnel, often based on research about the individual.78% of organizations saw a rise in attacksBaitingLuring individuals to download malware or interact with malicious content by offering something tempting.20% of employees engage with unknown USBsPretextingCreating fabricated scenarios to deceive individuals into revealing sensitive information.Increasingly used, especially in business-related scamsQuid Pro QuoOffering a service or benefit in exchange for information or access.Growing, especially with tech-related lures\t\t\t\t<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-96354cf e-flex e-con-boxed e-con e-parent\">\n<div class=\"e-con-inner\">\n<div class=\"elementor-element elementor-element-05c9566 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h2 class=\"elementor-heading-title elementor-size-default\">Insider Threats: The Hidden Danger Within <\/h2>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-a7597c6 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>Insider threats are one of the elusive and most harmful ways that data can be lost. Unlike attacks from outside, internal risks come from people who already have permission to access a company\u2019s systems and important information.\u00a0<\/span><span>\u00a0<\/span><\/p>\n<p><span>These people can be employees, contractors, or partners, all of whom are trusted by the company. The big problem with insider threats is that it\u2019s hard to identify them because the person involved already has the right permissions.\u00a0 Insider threats can cause data to be leaked, stolen, or accidentally shared, often without being stopped by traditional security tools like firewalls or <a href=\"https:\/\/fidelissecurity.com\/threatgeek\/network-security\/what-is-network-intrusion-detection\/\">intrusion detection systems<\/a>.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-6e31a39 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Types of Insider Threats<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-5df76f2 elementor-widget elementor-widget-image\">\n<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-45b28c6 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Malicious Insiders<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-142b714 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"TextRun SCXW51721547 BCX8\"><span class=\"NormalTextRun SCXW51721547 BCX8\">Malicious insiders are people who intentionally steal, share, or damage data. They might do this for money or to get back at someone. These insiders usually use their access to get <\/span><span class=\"NormalTextRun SCXW51721547 BCX8\">important information<\/span><span class=\"NormalTextRun SCXW51721547 BCX8\"> or cause disruptions. <\/span><span class=\"NormalTextRun SCXW51721547 BCX8\">Cost of a Data Breach Report 2024<\/span><span class=\"NormalTextRun SCXW51721547 BCX8\"> from IBM <\/span><span class=\"NormalTextRun SCXW51721547 BCX8\">says insider<\/span><span class=\"NormalTextRun SCXW51721547 BCX8\"> threats <\/span><span class=\"NormalTextRun SCXW51721547 BCX8\">that <\/span><span class=\"NormalTextRun SCXW51721547 BCX8\">come<\/span><span class=\"NormalTextRun SCXW51721547 BCX8\"> from malicious <\/span><span class=\"NormalTextRun SCXW51721547 BCX8\">actors<\/span> <span class=\"NormalTextRun SCXW51721547 BCX8\">cost<\/span><span class=\"NormalTextRun SCXW51721547 BCX8\"> companies about $4.<\/span><span class=\"NormalTextRun SCXW51721547 BCX8\">99<\/span><span class=\"NormalTextRun SCXW51721547 BCX8\"> million.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-b5fbe1c elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Negligent Insiders<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-5b4e65f elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>Careless employees accidentally cause data loss due to their mistakes or lack of knowledge. They could be tricked by phishing emails, sharing important information in insecure ways, or misconfigure systems.\u00a0<\/span><span>\u00a0<\/span><\/p>\n<p><span>Although they do not intend to, these employees are responsible for the majority of data loss cases. According to a study by the Ponemon Institute in 2023, negligence was the source of 55% of insider threats, and these incidents accounted for most of data breaches reported.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-fb6cf22 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Third-Party Partners<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-1c006dd elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>Contractors, suppliers, and business partners often have access to a company\u2019s systems and data. If their own security measures are weak or compromised, they can inadvertently cause data loss.\u00a0<\/span><span>\u00a0<\/span><\/p>\n<p><span>These third-party insiders might accidentally introduce malware, reveal sensitive information, or permit unauthorized access. Global Third-Party Cybersecurity Breach Report showed that at least 29% of breaches were attributable to a third-party attack vector, highlighting the increasing risk posed by outsourced service providers.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-4d9e3ff elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Real-World Examples of Insider Threats Leading to Data Loss<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-5e43921 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Tesla Insider Data Leak (2022)<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-3db5ae5 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"NormalTextRun SCXW50106964 BCX8\">In <\/span><span class=\"NormalTextRun SCXW50106964 BCX8\">a well<\/span><span class=\"NormalTextRun SCXW50106964 BCX8\">-publicized insider threat incident, a Tesla worker deliberately shared confidential company details, such as proprietary manufacturing information. The worker <\/span><span class=\"NormalTextRun SCXW50106964 BCX8\">leaked 100GBs of data<\/span><span class=\"NormalTextRun SCXW50106964 BCX8\">. This situation shows the <\/span><span class=\"NormalTextRun SCXW50106964 BCX8\">big<\/span><span class=\"NormalTextRun SCXW50106964 BCX8\"> danger of having trusted employees who can access important systems.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-e91d771 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Capital One Data Breach (2019)<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-a7e564e elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>On July 19, 2019, Capital One discovered that an unauthorized person got access and took some personal information about Capital One credit card customers.<\/span><span>\u00a0<\/span><\/p>\n<p><span>After looking into it, they found that about 100 million people in the United States and about 6 million in Canada were affected by this event.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-37a61cf elementor-widget elementor-widget-Table\">\n<div class=\"elementor-widget-container\">\n<p>\t\t\t\t\tType of Insider ThreatDescriptionPercentage of Data Breaches\t\t\t\t<\/p>\n<p>\t\t\t\t\tMalicious InsiderEmployees who intentionally steal, leak, or damage sensitive data for personal gain or revenge.30% of all insider incidentsNegligent InsiderUnintentional data loss caused by employee error, lack of awareness, or failure to follow security protocols.56% of insider incidentsCompromised InsiderInsider credentials are stolen by external actors to gain unauthorized access to sensitive data or systems.19% of breaches involved third-party or compromised insidersThird-Party PartnerContractors, vendors, or partners with access to company data, introducing risk through weak security practices or accidental mishandling.19% of breaches\t\t\t\t<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-6fdf35d e-flex e-con-boxed e-con e-parent\">\n<div class=\"e-con-inner\">\n<div class=\"elementor-element elementor-element-6b15704 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h2 class=\"elementor-heading-title elementor-size-default\">The Human Factor: Why Social Engineering and Insider Threats Are So Prevalent<\/h2>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-e582adc elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"NormalTextRun SCXW113860663 BCX8\">Both <\/span><span class=\"NormalTextRun SCXW113860663 BCX8\">s<\/span><span class=\"NormalTextRun SCXW113860663 BCX8\">ocial engineering and insider threats are common <\/span><span class=\"NormalTextRun SCXW113860663 BCX8\">yet dangerous as <\/span><span class=\"NormalTextRun SCXW113860663 BCX8\">they take advantage of the biggest weakness in cybersecurity \u2013 human error. <\/span><span class=\"NormalTextRun SCXW113860663 BCX8\">Be it<\/span><span class=\"NormalTextRun SCXW113860663 BCX8\"> an employee getting tricked <\/span><span class=\"NormalTextRun SCXW113860663 BCX8\">with <\/span><span class=\"NormalTextRun SCXW113860663 BCX8\">phishing email or a dissatisfied employee intentionally sharing company secrets, the human element is <\/span><span class=\"NormalTextRun SCXW113860663 BCX8\">extremely<\/span> <span class=\"NormalTextRun SCXW113860663 BCX8\">hard to manage. Training and strict security rules can help, but psychological tricks can still get past even the best security measures.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-b4a5f30 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Why Social Engineering Works?<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-ddd9b65 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Exploits Human Trust<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-07738ad elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"TextRun SCXW87068259 BCX8\"><span class=\"NormalTextRun SCXW87068259 BCX8\">People usually trust authority figures, coworkers, or familiar sources, and attackers use this by pretending to be those trusted people. By acting like someone who is real and trustworthy, attackers can trick people into lowering their defenses.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-8917b4a elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Bypasses Traditional Security<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-29834b4 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"NormalTextRun SCXW23183236 BCX8\">Most cybersecurity systems are designed to block malware, viruses, and outside hacking attempts. Social engineering attacks get around these defenses because they focus on tricking people. For instance, firewalls and encryption <\/span><span class=\"NormalTextRun SCXW23183236 BCX8\">won\u2019t<\/span><span class=\"NormalTextRun SCXW23183236 BCX8\"> help if an employee willingly shares their login details.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-aaee780 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h2 class=\"elementor-heading-title elementor-size-default\">Targets Emotional Responses<\/h2>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-1d975e9 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"TextRun SCXW257206632 BCX8\"><span class=\"NormalTextRun SCXW257206632 BCX8\">Attackers often use tactics that make people feel rushed or scared, causing them to act quickly without thinking things through. Statements such as \u201cyour account will be suspended unless you act now\u201d or \u201curgent payroll issue\u201d trigger a psychological reaction, pushing people to respond without first checking if the message is legit.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-cb7554f elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Why Insider Threats Persist?<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-0f307db elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h4 class=\"elementor-heading-title elementor-size-default\">Authorized Access<\/h4>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-53f82b2 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"TextRun SCXW172261725 BCX8\"><span class=\"NormalTextRun SCXW172261725 BCX8\">Since insiders already have legitimate access to important data and systems, their actions usually look normal to traditional monitoring tools. To detect data loss caused by insiders, we need advanced monitoring systems that can spot unusual behavior, like accessing files not related to their usual work or logging in at strange times. Tools like <\/span><\/span><a class=\"Hyperlink SCXW172261725 BCX8\" href=\"https:\/\/fidelissecurity.com\/solutions\/network-dlp\/\" target=\"_blank\" rel=\"noopener\"><span class=\"TextRun Underlined SCXW172261725 BCX8\"><span class=\"NormalTextRun SCXW172261725 BCX8\">Fidelis Network\u00ae Data Loss Prevention Solution<\/span><\/span><\/a><span class=\"TextRun SCXW172261725 BCX8\"><span class=\"NormalTextRun SCXW172261725 BCX8\"> can help find these unusual patterns and alert security teams about <\/span><span class=\"NormalTextRun SCXW172261725 BCX8\">possible insider<\/span><span class=\"NormalTextRun SCXW172261725 BCX8\"> threats.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-1e84d8a3 e-con-full post-cta-section e-flex e-con e-child\">\n<div class=\"elementor-element elementor-element-5c079160 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n\t\t\t<span class=\"elementor-heading-title elementor-size-default\">Uncover How Fidelis Network\u00ae DLP Defends Against Insider Threats!<\/span>\t\t<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-79b2ac06 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><em><span class=\"NormalTextRun SCXW186563716 BCX8\">In this in-depth guide, <\/span><span class=\"NormalTextRun SCXW186563716 BCX8\">you\u2019ll<\/span><span class=\"NormalTextRun SCXW186563716 BCX8\"> learn about:<\/span><\/em><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-77f5016d elementor-icon-list--layout-inline elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\">\n<div class=\"elementor-widget-container\">\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Data loss prevention<\/span><\/p>\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Inspection<\/span><\/p>\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Analysis<\/span><\/p><\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-447a2703 elementor-widget elementor-widget-button\">\n<div class=\"elementor-widget-container\">\n<div class=\"elementor-button-wrapper\">\n\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/fidelissecurity.com\/resource\/how-to\/network-dlp-buyers-guide\/\"><br \/>\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\"><br \/>\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Download the Buyer\u2019s Guide<\/span><br \/>\n\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t<\/a>\n\t\t<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-6c98a00 e-flex e-con-boxed e-con e-parent\">\n<div class=\"e-con-inner\">\n<div class=\"elementor-element elementor-element-d0d0738 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Trusted Individuals<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-84146a7 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"NormalTextRun SCXW155700042 BCX8\">Companies usually trust their employees and partners, sometimes not considering that insiders might pose a threat. This trust can blind companies to <\/span><span class=\"NormalTextRun SCXW155700042 BCX8\">possible risks<\/span><span class=\"NormalTextRun SCXW155700042 BCX8\"> and delay the detection of insider-caused data loss incidents.<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-65aa866 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Slow Detection and Response<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-7e396b3 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"NormalTextRun SCXW268159538 BCX8\">Many insider threat incidents are not noticed for a long time because the actions are subtle and <\/span><span class=\"NormalTextRun SCXW268159538 BCX8\">don\u2019t<\/span><span class=\"NormalTextRun SCXW268159538 BCX8\"> set off immediate alarms. <\/span><span class=\"NormalTextRun SCXW268159538 BCX8\">I<\/span><span class=\"NormalTextRun SCXW268159538 BCX8\">t usually takes <\/span><span class=\"NormalTextRun CommentStart CommentHighlightPipeRest CommentHighlightRest SCXW268159538 BCX8\">85 days<\/span><span class=\"NormalTextRun CommentHighlightRest SCXW268159538 BCX8\"> to find an insider threat incident<\/span><span class=\"NormalTextRun CommentHighlightPipeRest SCXW268159538 BCX8\">, giving malicious actors a lot of time to steal or harm important data.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-82e46d3 e-flex e-con-boxed e-con e-parent\">\n<div class=\"e-con-inner\">\n<div class=\"elementor-element elementor-element-5bbe9f4 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h2 class=\"elementor-heading-title elementor-size-default\">Preventing Data Loss from Social Engineering and Insider Threats<\/h2>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-e540167 elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span class=\"TextRun SCXW95968880 BCX8\"><span class=\"NormalTextRun SCXW95968880 BCX8\">Due to the complexity of these threats, organizations need to use a security strategy that protects against both human and technological vulnerabilities.<\/span><\/span><span class=\"EOP SCXW95968880 BCX8\">\u00a0<\/span><\/p>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-d283370 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Best Practices for Preventing Social Engineering Attacks<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-3d5523c elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\">\n<div class=\"elementor-widget-container\">\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Employee Training: Teach employees to identify phishing and social engineering tricks.<\/span><\/p>\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Simulated Phishing Attacks: Run phishing simulations to test employees and see how aware they are and how they respond to such scams.<\/span><\/p>\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Multi-Factor Authentication: Require a second verification step beyond passwords.<\/span><\/p>\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Email Filters: Set up tools that block and flag suspicious emails.<\/span><\/p>\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Zero Trust Security Models: Trust no one by default, verify everyone\u2019s access.<\/span><\/p><\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-d3639bb elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h3 class=\"elementor-heading-title elementor-size-default\">Best Practices for Mitigating Insider Threats<\/h3>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-004ed62 elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\">\n<div class=\"elementor-widget-container\">\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Behavioral Monitoring: Set up systems to monitor users&#8217; actions.<\/span><\/p>\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Role-Based Access Control (RBAC): Limit data access based on employees\u2019 roles.<\/span><\/p>\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Background Checks: Perform thorough background checks on staff and contractors<\/span><\/p>\n<p>\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Data Loss Prevention (DLP) Tools: Use <a href=\"https:\/\/fidelissecurity.com\/threatgeek\/data-protection\/data-loss-prevention-dlp\/\">DLP<\/a> tools to flag and block unauthorized attempts to share sensitive data.<\/span><\/p><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-eece5de e-flex e-con-boxed e-con e-parent\">\n<div class=\"e-con-inner\">\n<div class=\"elementor-element elementor-element-c096452 elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h2 class=\"elementor-heading-title elementor-size-default\">Conclusion: The Urgent Need for Comprehensive Data Loss Prevention<\/h2>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-9a9746f elementor-widget elementor-widget-text-editor\">\n<div class=\"elementor-widget-container\">\n<p><span>The most subtle and complex risk to <a href=\"https:\/\/fidelissecurity.com\/threatgeek\/data-protection\/data-security\/\">data security<\/a> today would be social engineering and insider threats. Because these types of attacks exploit human errors, they evade the traditional defenses system and, thus, go undetected. As organizations face advanced attacks, prevention, detection, and response strategies become a key necessity to address both technical vulnerabilities and human behavior.<\/span><span>\u00a0<\/span><\/p>\n<p><span>In today\u2019s time, not acting against these threats could result in catastrophic consequences, like losing a lot of money or hurting a company\u2019s reputation. Companies that prioritize proactive measures against social engineering and insider threats will greatly reduce the chance of losing important data, making sure their valuable assets are better protected.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-7484488d e-flex e-con-boxed e-con e-parent\">\n<div class=\"e-con-inner\">\n<div class=\"elementor-element elementor-element-314e361b elementor-widget elementor-widget-heading\">\n<div class=\"elementor-widget-container\">\n<h2 class=\"elementor-heading-title elementor-size-default\">Frequently Ask Questions<\/h2>\n<\/div>\n<\/div>\n<div class=\"elementor-element elementor-element-a80d3fb elementor-widget elementor-widget-eael-adv-accordion\">\n<div class=\"elementor-widget-container\">\n<div class=\"eael-adv-accordion\">\n<div class=\"eael-accordion-list\">\n<div class=\"elementor-tab-title eael-accordion-header\">\n<h3 class=\"eael-accordion-tab-title\">How do social engineering attacks cause data loss?<\/h3>\n<\/div>\n<div class=\"eael-accordion-content clearfix\">\n<p><span class=\"NormalTextRun SCXW185501490 BCX8\">Social engineering attacks take advantage of people\u2019s trust, making them share <\/span><span class=\"NormalTextRun SCXW185501490 BCX8\">important information<\/span><span class=\"NormalTextRun SCXW185501490 BCX8\"> or give access to systems without permission. After getting access, the attackers can <\/span><span class=\"NormalTextRun SCXW185501490 BCX8\">steal <\/span><span class=\"NormalTextRun SCXW185501490 BCX8\">or damage important data, causing a data loss <\/span><span class=\"NormalTextRun SCXW185501490 BCX8\">incident<\/span><span class=\"NormalTextRun SCXW185501490 BCX8\">.<\/span><\/p>\n<\/div><\/div>\n<div class=\"eael-accordion-list\">\n<div class=\"elementor-tab-title eael-accordion-header active-default\">\n<h3 class=\"eael-accordion-tab-title\">How do Data Loss Prevention (DLP) tools help protect against social engineering and insider threats?<\/h3>\n<\/div>\n<div class=\"eael-accordion-content clearfix active-default\">\n<p><span>DLP tools monitor, detect, and prevent unauthorized access to sensitive data. They can identify and block unusual actions caused by insiders or social engineering tricks.\u00a0<\/span><span>\u00a0<\/span><\/p>\n<p><span>By using DLP solutions, companies can lower the chance of important data being shared or accessed by the wrong people.<\/span><\/p>\n<\/div><\/div>\n<div class=\"eael-accordion-list\">\n<div class=\"elementor-tab-title eael-accordion-header active-default\">\n<h3 class=\"eael-accordion-tab-title\">How can you tell if someone might be an insider threat?<\/h3>\n<\/div>\n<div class=\"eael-accordion-content clearfix active-default\">\n<p><span class=\"NormalTextRun SCXW236140162 BCX8\">Some <\/span><span class=\"NormalTextRun SCXW236140162 BCX8\">warning signs<\/span><span class=\"NormalTextRun SCXW236140162 BCX8\"> are odd login times, <\/span><span class=\"NormalTextRun SCXW236140162 BCX8\">excessive<\/span><span class=\"NormalTextRun SCXW236140162 BCX8\"> file access, copying lots of data, and employees showing <\/span><span class=\"NormalTextRun SCXW236140162 BCX8\">dissatisfaction <\/span><span class=\"NormalTextRun SCXW236140162 BCX8\">with the company. Using tools to <\/span><span class=\"NormalTextRun SCXW236140162 BCX8\">monitor<\/span> <span class=\"NormalTextRun SCXW236140162 BCX8\">behavior can help catch these issues early.<\/span><\/p>\n<\/div><\/div>\n<\/div><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>The post <a href=\"https:\/\/fidelissecurity.com\/threatgeek\/data-protection\/leading-reason-for-data-loss-social-engineering-insider-threats\/\">Leading Reason for Data Loss: Social Engineering &amp; Insider Threats<\/a> appeared first on <a href=\"https:\/\/fidelissecurity.com\/\">Fidelis Security<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>When it comes to data loss, the biggest yet common dangers these days come from within the organization, and social engineering and insider threats are one of the main reasons. This shows that human mistakes are just as risky as external attacks.\u00a0\u00a0 In this piece, you\u2019ll see how social engineering and insider threats result in [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-784","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/784"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=784"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/784\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/785"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}