Common misconceptions in cybersecurity by security agencies, regulators, and businesses

TLDR:

Key Points:

• Social engineering is the common root cause behind most cyber attacks
• Many security agencies, regulators, and businesses focus on technical controls rather than addressing human error

In the article “What security agencies, regulators, and businesses get wrong about cybersecurity,” Stu Sjouwerman of KnowBe4 highlights the importance of prioritizing threats and mitigations in cybersecurity. He points out that social engineering, stemming from human error, is the major culprit behind successful cyber break-ins. While technical controls like firewalls and encryption receive a lot of attention, social engineering is often neglected.

Sjouwerman emphasizes the need for a shift in focus towards initiatives that change employee mindset, behavior, and exposure to cyber threats, such as phishing simulation programs and regular training exercises. By focusing on high-priority threats like social engineering and unpatched software, organizations can improve security behavior and culture, ultimately mitigating the biggest threat in cybersecurity.

He also recommends reducing online exposure through OSINT tools and teaching employees to stay cautious and conservative when posting online to prevent attackers from weaponizing information for targeted social engineering attacks. By prioritizing continuous cybersecurity training and skill development, businesses can reduce instances of fraud, scams, and cyberattacks.