In today’s fast-paced organizations, end-users will sometimes try to take a shortcut. We’ve all been there — rushing to meet a deadline, juggling multiple tasks, or just trying to be helpful. But the reality is that letting even well-intentioned actions can come back to bite you.
Picture this: an employee innocently lets a family member use their work laptop at home, thinking, “What’s the harm?” But unbeknownst to them, their loved one accidentally downloads malware that spreads through your company’s network, wreaking havoc on sensitive data and critical systems.
Suddenly, that minor favor has morphed into a multimillion-dollar nightmare.
It’s not just a hypothetical scenario. The World Economic Forum has found that 95% of all cybersecurity incidents can be traced back to human error. Despite all the cutting-edge security technologies and ironclad protocols, the unintentional missteps of well-meaning end-users often open the door to disaster.
And the cost of these blunders?
According to IBM, the average global cost of a data breach in 2023 hit a staggering USD 4.45 million, a 15% increase over the past three years. That’s not just a financial blow; it’s a potentially business-ending event.
Five common employee cybersecurity missteps
To better understand the risks, we can examine five of the most frequent cybersecurity blunders committed by well-meaning employees.
1. Allowing unauthorized device access
Proofpoint’s User Risk Security Report reveals that half of working adults let friends and family members use their work devices at home. It seems harmless enough, but those loved ones could stumble upon sensitive company data or unwittingly access unsafe websites and applications. And if the unauthorized user downloads malware? Cybercriminals could gain access to corporate data, cloud applications, and storage, opening up a Pandora’s box of security risks, including data breaches, intellectual property theft, and reputational damage.
To address this risk, you should implement strict security controls, like password protection and two-factor authentication, and drill the importance of device sanctity into your employees’ minds.
A one-time onboarding security training won’t cut it; instead, introduce a comprehensive information security plan that all employees must follow and encourage team leaders to enforce cybersecurity discipline within their teams.
2. Misdelivery of sensitive information
Imagine one of your end-users accidentally sending an email packed with confidential data to the wrong recipient. This is something that happens more often than you’d think, especially in industries like healthcare, where misdelivery is the most common error leading to a data breach.
To prevent these mix-ups, consider requiring encryption for sensitive emails, implementing pop-up reminders for double-checking addresses, and deploying data loss prevention solutions that act as a safety net.
3. Reusing passwords
You can have an effective password policy in place, but if your employees are reusing their passwords on less-secure personal devices, websites, and applications, then they’re still leaving the door wide open for cybercriminals.
While there’s no 100% foolproof way to stop end-users from making the mistake of reusing passwords, solutions like Specops Password Policy can at least help you know if their passwords have become compromised.
The solution continuously checks your Active Directory against a database of more than 4 billion unique breached passwords, alerting users to change if their found to be using a compromised password.
4. Exposing remote interfaces
Remote work has also introduced a new set of challenges. IT teams often need to perform remote management tasks, but exposing administrative interfaces to the internet is like handing the keys to your kingdom to anyone with a Wi-Fi connection.
To allow remote access without opening your virtual front door, you must be selective about what you expose online. Additionally, employing automated maintenance solutions will help you minimize vulnerabilities and risks.
5. Misusing privileged accounts
It’s important to remember that your IT employees are humans, too, and they may take risks they know they shouldn’t. For example, it’s tempting for an IT admin to work from their privileged account even if they’re just handling everyday IT tasks — it’s convenient, and it keeps them from having to switch back and forth between their admin and user account.
But that convenience comes at a steep price; if their admin account gets compromised, it’s a major risk.
The safest bet? Separate user accounts with limited privileges for daily work, reserving admin powers for critical tasks only.
Implement the principle of least privilege (PoLP), ensuring that employees only have access to the resources and permissions necessary to perform their specific job functions. And regularly review and audit user permissions, revoking any unnecessary privileges promptly.
Cybersecurity is a team sport
In the end, cybersecurity is a team sport. No matter how robust your technical defenses are, your people are often the first line of defense — and your weakest link.
By understanding the common pitfalls and implementing smart policies and training, you can transform your workforce from liability to asset in the battle against cyber threats. After all, when protecting your business, an ounce of prevention is worth millions in cure.
Interested to know how many open risks could be lurking within your Active Directory? Run a read-only scan with the free auditing tool and get an exportable report on your password-related vulnerabilities.
Download Specops Password Auditor here.
Sponsored and written by Specops Software.