Kaspersky Lab study finds almost all cloud data breaches are caused by humans
A report published by security specialist Kaspersky Lab, has revealed that the majority of all cloud data breaches are caused, not by technology failures, by human error. The firm’s research discovered that ‘social engineering’ of staff accounted for 90% of data breaches in the cloud.
Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information. (Wikipedia) However, security issues associated with employees is certainly nothing new. According to a Databarracks study, in 2015, human error was identified as the main cause of data losses for UK businesses.
Corporate cloud data breaches
Meanwhile, Kaspersky’s study of corporate breaches revealed that cloud service providers are not the cause for most breaches, despite any perception otherwise. While customers expect cloud providers to be ultimately responsible for the security of data stored on their cloud servers, occurrences of data breaches are usually due to actions by customers’ staff.
Kaspersky Lab found that approximately 90% of all corporate data breaches in the cloud are down to social engineering techniques targeting customers’ staff – not because of problems caused by the cloud provider. In fact, only 11% of all incidents can be attributed to the actions of the cloud provider. The firm also reported that a third of cloud-based incidents are caused by social engineering techniques affecting employee behavior, while Only 39 percent of SMBs and half (47 percent) of enterprises have implemented tailored protection for the cloud. And it seems that many corporates using cloud services fail to adjust their security policies correctly. “The first step for any business when migrating to public cloud is to understand who is responsible for their business data and the workloads held in it,” said Maxim Frolov, VP of global sales at Kaspersky Lab.
Frolov said:
Cloud providers normally have dedicated cybersecurity measures in place to protect their platforms and customers, but when a threat is on the customer’s side, it is no longer the provider’s responsibility, …Our research shows that companies should be more attentive to the cybersecurity hygiene of their employees and take measures that will protect their cloud environment from the inside.
Education, education, education
Kaspersky Lab advises companies using cloud services to take the following steps:
-
Explain to staff that they can become victims of cyberthreats. Staff should be educated so as to not click on links or open attachments in communications from unknown users;
-
Staff should also be educated about unapproved use of cloud platforms, and procedures should be created for purchasing and consuming cloud infrastructure for each department; and,
-
Corporates should use endpoint security solutions to prevent social engineering attack vectors. This means protecting mail servers, mail clients and browsers.
Sources and credits: Kaspersky Labs, Silicon
