One Small Step From A Major Breach

Small actions can have huge impacts.  For example, crew members on the Titanic did not have the binoculars that would allow them to watch for icebergs because the key to the locker that held them was accidentally carried off the ship before the voyage.  Have you ever thought about how small changes on your network can impact the life and success of your company?  

Imagine the following scenario. 

Your IT team recently made some changes to your network security to proactively avert security risks that can lead to severe ransomware attacks. The solution they came up with was sound. And it checked off requirements from your cyber insurance policy. 

However, on Monday your HR specialist calls the helpdesk asking them to assist her with getting her payroll application to work. Payroll has to be done by 2 PM, so now HR is in emergency mode because if payroll doesn’t get filed people don’t get paid on time. This is a huge problem. 

After a couple of minutes digging into the issue, the help desk determines that the new security was causing the problem. They turn it off on the HR specialist’s computer. But this security product was protecting each computer on the network from malicious traffic.  It also was preventing sensitive data like Social Security Numbers from leaving the network. 

When the help desk turned off the software and solved the issue, they made a note in a ticket—one of 40 that were on the board for the day—that they had made the change. 

Not a big deal, right? The plan was to revisit the software to turn it back on.  However, the situation was no longer a priority and IT had too much work to get around to it. 

Eventually, after a busy week, they completely forgot about turning off the software. No one else in the organization was aware of the problem and your HR specialist was happy that she could get her work done. The ticket was closed, and no one was the wiser. 

But here’s the thing.  Your HR specialist gets a lot of phishing emails and some look legitimate. Now normally, she is pretty good at telling the fake emails from the legitimate ones. And normally, she verifies emails before clicking on attachments or sending out requested sensitive information.  Today, however, she’s getting ready for a well-deserved vacation, and her mind is elsewhere. 

So, as she’s nearing the end of her day, counting the remaining hours for the chance to get out of the cold and get to her cruise ship, and her thoughts are on her vacation. At lunch, she checks into her flight and begins the fun task of choosing from the excursions and activities that are being offered by the cruise ship.  

She returns to her desk distracted and ready to finish up her work.  That’s when she receives an email from the CFO.  It seems harmless enough.  The CFO has a report that needs reviewing, so your HR specialist clicks the link.  

Her computer no longer was protected—even though IT thought it was.  

That one simple click has the potential to set in motion a cybersecurity incident. Files could be compromised.  Data could be breached.  Your entire system could be shut down all from that one seemingly simple click because attackers can get into your system from one user. One computer. 

Cyberattacks can cost a company millions, and many never recover.  Data is stolen, money is lost, and a once solid company can easily become bankrupt, all because of one simple click.  And even those companies that survive must deal with fallout that includes damage to their reputation.  Are you willing to lose everything because of one payroll application conflicting with one of your security products? 

The things leading up to cyberattacks are often small.  For example, If that software was turned back on, nothing would have happened after the issue with the payroll application.  If the HR person hadn’t clicked the link. Very small actions can lead to some very big problems.  

How can you make sure nothing like this happens to you? 

Nothing can prevent human error or that one small action that exposes your company to a potentially catastrophic event, but you can take a simple action to prevent it.  That action is having a third-party security assessment.  This allows for someone outside of the situation to make sure your security is working even when things fall through the cracks internally. 

Businesses are starting to see a need for recurring third-party security assessments that test their security. They are informed and have a prioritized plan from IT to make sure concerns critical to their business are addressed.  

You can’t predict or completely avoid simple actions that expose your company to risk.  So, why not take one simple step, and make sure your company is protected?