Humans: The biggest asset for cyber-attacks
Phishing, vishing, smishing, human-error
Every single time that we imagine someone directing a Cyber-Attack, we can all see and remind of the famous Matrix screens with green code and numbers being typed in such a fast pase that we can even think As hackers as some of the greatest erudites of our cyber-society. But, have we ever stopped and thinked about that we are almost daily a part of a cyber security threat? Have we ever stopped to think that the weakest point of a cyber-security infrastructure are humans? There are two possible ways that a human represents the weakest point in my opinion. 1.- HUMAN ERROR: This part is crucial coming from the Cyber-security team. Just imagine that someone while creating a firewall, reviewing a code infrastructure, applying an SSL certificate to a web page, creating numerous VMs or servers as part of the organization infrastructure, someone just has a typo-error, a miss-click in one of Azure's, AWS, Google's cloud services, or someone making a variable public in a source code, someone forgetting to review one of the SQL's basic Security standards, someone just by error compromising an entire server, an entire data base, or even an entire source code to a possible attacker. Now, organizations infrastructure in IT with ISO security standards are the main firewalls to try and avoid the human error. But, still we have heard of big attacks to Uber's, Facebook's, Instagram's, Banks' data-bases compromising millions of user's private information. 2.- SOCIAL ENGINEERING: The previous point was related to such a technical breach, speaking of pen-testing an organizations infrastructure or trying to find the possible human error in a server, firewall, code, etc. But, the next one sometimes doesn't even requires a technical background for the attacker to be able to breach an organization. It just requires, social skills. Have you ever recieved a call from a cousin from far away who needs money? A mail indicating you have won an iPhone totally free? A text message saying that you made a deposit to a bank account without your knowledge? If you haven't I'm sure you have heard of someone who has. And even a story of someone who fall in a social engineering trick. This 'tricks' are not only dedicated for personal attacks. They are also targetted to organizations and even some big company names have lost money from a Social Engineering attack. Sometimes organizaitons don't take the time to train their people to this kind of attacks, or even employees forget to double-check all possible sources of communication just to be sure that they are not leaking information or transactions into the wrong hands. Clicking on links without being totally sure the source is legitimate and reliable. And with the current involvment of IA recreating voices or even faces in video/voice calls, this kind of attacks are expected to increase and represent a bigger threat for cyber-security in the future. Does this mean that we shouln't have humans in companys? Absolutely no. That is not the purpose of this blog entry. The purpose is to make the reader aware that security breaches will not always even need a computer for an attacker to create a breach. Never trust no source of digital communication by default, try always to be aware of the possible ways an attacker may reach to you. Even find phishing self-training in YouTube, and if you are part of an organization, always promote that there is Security training to maintain all employees self-aware of their digital life for both personal and business matters. But, as all areas of Cyber-security. We can protect our infrastructure and train the company's assets to mitigate incidents, but Humans will ever represent an asset for a cyber attacker.
