Preventing Cyber Crime & Fraud: The Human Firewall

This advice has been collated by East Midlands Special Operations Unit (EMSOU) to raise awareness among businesses and the public.

If you require any further information, assistance or guidance please contact the EMSOU Protect Team EMSOU Protect Team or your local Force protect team.

Today’s cyber topic is The Human Firewall

It is quite common to read news about cyber-attacks causing huge data breaches, businesses suffering irreparable harm, and countries targeting each other in cyberspace. Such articles encourage us to imagine sophisticated hackers, employing state of the art technologies. We also start to feel apathy set in – there’s nothing much we can do, right? Not so fast. If you study credible public reports and expert analysis on cybersecurity incidents, you’ll discover this startling fact: approximately seven out of ten security incidents occur due to human error and behaviour, not complicated technical attacks.

Again, let that number sink in, seven out of ten! Even those attacks that are described as “sophisticated” end up having human mistakes, such as falling for phishing attacks, at their core. Cyber security, then, is fundamentally a human issue, not a technology issue. It requires a process of communication that is focused on connecting and resonating with humans.

Why is this the case?

As technology has evolved rapidly, cyber security tools such as firewalls, anti-malware software, email protection solutions, and a host of other things have also improved significantly. This means that it has become much harder for hackers to bypass protective security technologies.

To counter this, hackers figured out that it was a lot easier, cheaper, and worthwhile to target humans instead. They understood that instead of trying to spend time and money to hack people’s passwords, it was much easier to trick users into revealing them. Simple.

So, how can we address this issue?

Given the marked rise in phishing attacks over the past few years, a phishing email writing competition is another great way to create awareness. Essentially, competitors should write a good phishing email designed to trick the victim into disclosing some sensitive information. To safeguard against unintended consequences, I would make sure that users understand what they can or can’t do – an obvious no-no being to phish anyone for real.

To ensure a controlled outcome, I would also ask competitors to submit their entry on a Word document with no embedded links or macros. The intent is to get them thinking creatively as hackers and social engineers and not allow the technically skilled to have an unfair advantage. This will help level the playing field and encouraged creativity from all different groups. As an incentive, a modest but meaningful prize could be offered to the winner – feel free to email the best (and most humours) entries for us to share!

Reporting

Please report all Fraud and Cybercrime to Action Fraud by calling 0300 123 2040 or online.
Forward suspicious emails to report@phishing.gov.uk.
Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).