If there\u2019s any lesson to be learned from two recent Canadian data breaches it\u2019s that IT security depends on a lot more than just deploying the right technology. It\u2019s long been known that people are one of the weakest links in IT security. And yet I find it shocking how many businesses still learn this the hard way. It doesn\u2019t matter whether you\u2019re a small business or multinational enterprise, cyber security awareness training is no longer optional.<\/p>\n
The financial and reputational damage done by cybersecurity breaches can paralyze businesses and government agencies alike. Last year, 23 Municipalities in the state of Texas were hit simultaneously<\/a> with the Sodinokibi ransomware. The attack occurred through a software used by the municipalities. All it took to paralyze the local governments was a single employee opening a seemingly benign attachment.<\/p>\n And in more recent events, with the COVID-19 crisis, there has been a surge in fake email campaigns to gain malicious access to various systems. One great example of this is a message from the U.S. Department of Labour<\/a> tricking people into opening a .DOC file with macros in it. Once the user accepts the macros, a file is automatically downloaded to the computer. Other such attacks include fake emails from Microsoft<\/a> to gain user credentials by sending you to a fake Teams landing page.<\/p>\n These breaches can be avoided.<\/p>\n Both of these cases demonstrate how data breaches can be avoided with better cyber security awareness training. That City of Calgary employee didn\u2019t mean to do any harm. But they also were definitely not aware of how much could go wrong moving around large sets of personnel files. That lack of awareness made them careless.<\/p>\n That Desjardin\u2019s employee was a malicious actor however. It was their coworkers who didn\u2019t recognize the risks of bypassing privacy rules. Their assumptions about a coworker\u2019s intentions made them careless.<\/p>\n Neither breach was the result of a technological failure. They resulted from employees not knowing what they needed to pay attention to to ensure data security.<\/p>\n And in my 20 year IT security career I\u2019ve seen this same failure over and over. Here we are at the start of 2020 and social engineering remains one of the easiest way attackers gain access to data.<\/p>\nBetter training can prevent breaches<\/span><\/h2>\n