Introduction
The human factor in cybersecurity refers to the risks associated with human behavior and its interaction with cybersecurity. These risks can range from simple mistakes to being social manipulation by attackers, which differs from stereotypical attack vectors and hacking methods that most people may imagine. The human factor can also have an influence on the attacker side in how they may justify their actions or the attack methodologies that are used. Humans continue to play a large role in how technology is used and maintained; as a result, human influence is intrinsic to security in technological systems.
The Influence of Human Behavior on Cybersecurity Vulnerabilities
The primary components of behavior that contribute to cybersecurity vulnerabilities are psychological manipulation and negligence. Psychological manipulation involves attackers exploiting a person’s emotions in order to gain unauthorized access to assets. One example is fear by blackmailing an individual or sending an urgent message. Another example involves exploiting trust by acting as a trusted acquaintance and attempting to manipulate the individual through familiarity. These attacks all rely on provoking certain emotions in order to manipulate individuals into voluntarily providing access to their assets.
Negligence is another vulnerability that can result from a lack of awareness or human error. An example of a lack of awareness is an individual using a very weak password to protect crucial information. Another example is an individual misconfiguring an organization’s systems, leaving potential security weaknesses. Without knowledge of basic cybersecurity principles people and organizations can fall victim to cyber threats.
Examples of Human Actions Related to Cybersecurity Risks
Two examples of data breaches that occurred due to human error are the 2014 Sony Pictures breach and 2019 Capital One breach. In the Sony Pictures data breach, attackers utilized spearphishing emails posing as Apple verification emails in order to steal login credentials that were then used to access Sony’s systems (Steinberg et al., 2021). Spearphishing is a social engineering strategy that differs from traditional phishing because emails are targeted to specific individuals and are designed to appear more trustworthy (Badman, n.d.).
The 2019 Capital One data breach resulted from a misconfigured system. According to AWS, the attacker exploited a misconfigured Modsecurity firewall. Reverse proxies have been a known attack vector since 2016. This then enabled the attacker to obtain temporary credentials with high-level privileges, allowing access to and decryption of the data (Khan et al., 2022). This attack involved several configuration errors in AWS systems that contributed to the data breach.
How Organizations Can Reduce Human-Related Risks
Organizations can reduce human-related risks through cybersecurity education requirements and accountability across their services and systems. Basic cybersecurity knowledge can help prevent many social engineering-based attacks by giving people methods to identify potential threats. Phishing attempts have many warning signs such as suspicious or unofficial links. Additionally, using the same password across many services creates a significant security risk if those credentials are leaked.
In the Capital One data breach, Khan et al. (2022) highlight the need for a shared responsibility model. This security framework holds each service involved with vital data to be accountable for its own security. This event involved multiple security failures, ranging from the misconfiguration of the firewall to the temporary credentials that provided high level access to assets. With proper security audits, improperly configured services could have been identified before they were exploited. Another approach for multi-service systems is a zero-trust model in which security controls are applied throughout the system to limit the potential impact of a compromised component.
Conclusion
Overall, the human factor plays a significant role in many cyberattacks and data breaches. One prominent social engineering attack vector is phishing, which can be used to obtain credentials. Human error plays a role in social engineering attacks but can also result in misconfigured systems that leave vulnerabilities for attackers to exploit. As demonstrated by the Capital One and Sony Pictures, diligence by both individuals and organizations is necessary to reduce the risk of cyberattacks.
Citations
Badman, A. (n.d.). Spear phishing vs. phishing: What’s the difference? IBM. https://www.ibm.com/think/topics/spear-phishing-vs-standard-phishing#732739697
Khan, S., Kabanov, I., Hua, Y., & Madnick, S. (2022). A systematic analysis of the Capital One data breach: Critical lessons learned. ACM Transactions on Privacy and Security, 26(1), 1–29. https://dl.acm.org/doi/full/10.1145/3546068
Steinberg, S., Stepan, A., & Neary, K. (2021). The hacking of Sony Pictures: A Columbia University case study. Columbia University School of International and Public Affairs. https://www.sipa.columbia.edu/sites/default/files/2022-11/Sony%20-%20Written%20Case.pdf