Have you noticed lately that almost every topic of conversation revolves around IT security, in one way or another? Whether it’s discussing clandestine sleeper agent topics that sound more like Mission Impossible movie plots, or the fear and uncertainty of backups and how they relate to major disasters—like the Walking Dead is somehow a training video and not a TV show.

But all that aside, a far more poignant topic exists that many seem to miss—something less nefarious, yet still dangerous, to all organizations—and that is, end-point security. As news stations revel in the stories of Russian hackers, election interference, DDoS attacks, and more, the plain truth of the matter is that for the most part companies with good security infrastructure can avoid most incidents with little to no issue, due diligence being the key to avoidance.

Key Takeaways

• Despite heavy media attention on sophisticated nation-state hacking and DDoS attacks, most companies with solid security infrastructure can avoid these headline-grabbing threats through basic due diligence and standard protections.
• The far more common and dangerous vulnerability isn’t external attackers but simple human curiosity and error, illustrated by the classic USB drop test where employees plugged in an unknown device out of pure curiosity, unknowingly compromising their entire network.
• Even organizations with genuinely strong external, outside-in security defenses can remain highly vulnerable to inside-out risks, since firewalls and perimeter security do nothing to prevent an employee from introducing malware through a personal device.
• The most effective response to human-error-driven security gaps combines dedicated endpoint security infrastructure with genuine employee education about the real risks associated with unknown devices and unauthorized downloads.
• The most devastating security incidents are often the simplest ones to prevent, meaning organizations that focus exclusively on sophisticated external threats while ignoring basic endpoint and behavioral risks are protecting against the wrong thing.

But all the firewalls in the world won’t protect you from the people who come and go every single day from your office. To be fair, I’m not alluding to some sinister plot of rogue spies trying to infiltrate your business from the inside. It’s more just the issue of people, dumb luck, and human error, all of which can cause havoc for IT teams.

For instance, the other day I was reminded of a story I was once told by our friends at Trend Micro—a tale of cyber security that was so simple, yet so ingenious, anyone would have fallen for it. The story begins with a major financial institution—one that bragged that its security was so robust that no one could ever penetrate its system. But, as we all know, cockiness can sometimes come back and bite one in the ass.

So, to prove this financial institution wrong, a security expert was hired to try and find holes in their IT security, all the while being told that no one could ever penetrate its layers of protection. And, as the test went on, they weren’t wrong—getting in from the outside was particularly difficult. But this is where human error begins to play a role in this ingenious scheme.

The expert realized that it wasn’t the outside-in scenario that was weak, it was the inside-out scenario that was the weak link in its armor. To prove his point, he loaded some malicious code onto a USB key and simply placed it on a bench outside in the smoking area. Now, the game became one of waiting.

As the minutes went by, it took no longer than a half hour before someone found the USB key and let curiosity get the better of them. They walked into their office, inserted the USB key into their computer to see what was on the drive, and voilà—instant access to all internal files.

Now, luckily this wasn’t a real issue—it was one manufactured by a security consultant who was hired to prove vulnerability. But the lesson was crystal clear, human curiosity paired with human error can be devastating if not addressed.

The outcome was simple. The company immediately engaged a security partner with end-point security expertise, implemented an end-point security infrastructure, and educated its entire staff on the dangers of IT devices and the possible consequences.

So, with all the IT security horror stories out there, remember that it’s usually the simplest of things that result in the most devastating consequences. After all, it’s probably never going to be Anonymous who brings about an IT security emergency within your organization. Most likely, it’ll be an employee who plugged in their MP3 player into their office desktop computer, accidentally introducing malware from a torrent where they got the latest Beyoncé album.

FAQs