Your Clients’ Biggest Cyber Risk? Their People. Five Ways to Defend Against “People Risk”.

Defending against “People Risk”: Five Ways to Prepare

With social engineering and phishing, your “defenses” are a combination of your technical defenses and of your people. At Corvus, we review your IT setup and identify any gaps that could lead to greater vulnerability (this is included in our Dynamic Loss Prevention reports). Any business should cover 5 key aspects to both prevent and mitigate the impact of “people risk”:

• Training and Education: Social engineering often comes down to a momentary lapse in judgment – someone absentmindedly clicked a link, or rushed to respond to an email without thinking it through. Employees often know soon after they’ve made a mistake that something is wrong, but the damage has been done. That’s why regular education is critical to help them get ahead and recognize the signs of a social engineering effort. Routinely educating employees with examples of what to look out for is now a necessity for any organization. Organizations can even learn if they are at elevated risk by looking at how many new employees they have since new employees are most at risk for falling for social engineering. If your clients aren’t already engaged in some sort of training and education, this would be the first step.
• Monitoring Sentiment: Look out for rogues. What looks like a social engineering incident is not always an accident; sometimes the call is coming from inside the house. Monitoring internal employee sentiment may help your client identify trends morale that may lead to disgruntled employees before a cyber event occurs. This could involve using reports that gather data from sites like Glassdoor and LinkedIn to help your client know when their risk is highest.
• Monitoring dark markets: Being aware of the risks your employees face is critical. People often reuse passwords, so your clients should ensure that their employee’s passwords, emails and other info are not showing up for sale in databases used by cybercriminals. This requires gathering data through dark-web monitoring on an ongoing basis to stay ahead of the curve.
• Response: With a high likelihood that any organization will be affected by social engineering at some point, your clients should have proper resources to respond to cybersecurity events. Ensuring that the proper staff in place to respond to cyber events can mitigate the impact or stop breach incidents altogether. Services exist to guide clients through the response to a breach as part of some cyber insurance policies.
• Transferring risk: Cyber insurance policies typically offer coverage for the types of social engineering exploits that lead to losses for your clients. The best policies go beyond coverage and help to inform the policyholders’ strategy for preventing losses. Many of the services mentioned above come as a value-add with cyber insurance policies, such as phishing testing, monitoring of company employee sentiment, evaluation of your IT team staffing, and dark web monitoring. Cyber insurance also helps clients navigate the stressful situation of dealing with a breach, including finding third-party resources to help.