User errors still at fault for most digital security breaches

When companies as big and as technologically proficient as Sony get hacked, like it was last year, many people wonder just how exactly that could happen. Surely it knows how to protect itself? Well of course certain parts of it do, but firms like Sony are enormous, with many thousands of employees, and as new Symantec and Verizon studies show, it only takes one of them making a mistake for a digital attack to commence.

This isn't the usual narrative sold by companies and governments when a big security breach takes place. Normally when that happens companies make out as if the attack was highly sophisticated, requiring teams of people to combat. As Reuters points out, this not only makes the originally hacked firm look less vulnerable to secondary attacks, but allows security companies to sell their products and gives politicians a chance to look tough by promising tighter legislative responses.

Wolfenstein clones can be dangerous too

But more often than not, attacks are simple, using age old tactics like phishing emails linking to or attached with malicious content that when clicked on can run amok on a system and the network it's connected to, which at some big companies, can be everything. According to the Verizon report, over two thirds of company hacks begin with a phishing attack and in-fact, most hackers need only contact 10 employees to almost guarantee that they'll be admitted through nefarious means to the firm's systems.

Once access has been granted, it's only a matter of using login credentials then learned to enter other parts of the network, which in turn gives access to more information and data, and up the chain they go.

This isn't to say that some hackers don't use other means to infiltrate a system. Zero day vulnerabilities like those exposed when security updates for an operating system end are common, though in-fact more often, security problems that were patched out years ago are exploited, due to poor updating procedures at companies.

The other branch of attack is the state-sponsored one and that tends to be far more competent than usual attacks. While they may use phishing and other tactics to gain entry to a system – partly so they don't raise suspicion – once inside, they often write custom software for investigating the system and copying away its valuable data. In the case of ransomware, that data can then be encrypted too.

Discuss on our Facebook page, HERE.

KitGuru Says: Always be wary of phishing emails people. It may seem obvious, but it's so easy to click a link in an email without thinking.

Image source: Columbia Pictures

Become a Patron!