Human Error as a Cybersecurity Risk

Human error is a significant cybersecurity risk that can lead to data breaches, ransomware attacks, and other security incidents. According to an IBM assessment, human error is involved in 95% of information security errors. Human error can occur in both information technology (IT) and operational technology (OT) environments, and it can be caused by a variety of factors, such as lack of awareness, fatigue, and carelessness.

The key elements of human error as a cybersecurity risk include:

• Lack of awareness: Employees who lack awareness of cybersecurity risks and best practices are more likely to make mistakes that can lead to security incidents. This includes failing to recognize phishing emails, using weak passwords, and sharing sensitive information with unauthorized parties.
• Fatigue: Employees who work long hours or are fatigued are more prone to making mistakes that can lead to security incidents. This includes misconfiguring systems, failing to apply security patches, and overlooking security alerts .
• Carelessness: Employees who are careless or lack attention to detail are more likely to make mistakes that can lead to security incidents. This includes misplacing devices, failing to encrypt sensitive data, and leaving systems unlocked ⁴.

To create a secure and compliant enterprise environment, businesses can adopt the following steps:

• Establish clear security policies: Businesses should establish clear security policies that define the roles and responsibilities of employees in maintaining a secure environment. This includes implementing strong password policies, data protection guidelines, and acceptable use policies for personal devices and cloud services ⁵.
• Provide cybersecurity awareness training: Businesses should provide cybersecurity awareness training to employees to help them understand the risks and best practices of cybersecurity. This includes providing regular training on phishing emails, password management, and social engineering attacks .
• Implement security controls: Businesses should implement security controls that address the risks and vulnerabilities of their IT/OT systems, processes, and controls. This includes implementing technical and procedural controls that align with the regulatory frameworks and industry-specific standards, as well as monitoring and testing the effectiveness and efficiency of the controls ⁷.
• Encourage reporting of security incidents: Businesses should encourage employees to report security incidents and provide a clear and easy-to-use mechanism for reporting. This includes establishing a security incident response team that can quickly respond to incidents and minimize their impact ⁸.

More information and resources on human error as a cybersecurity risk:

• Human Error in Cyberspace – ISACA
• Mitigating Human Errors in Cybersecurity & Compliance: Practical Tips for Organizations
• Why Human Error is a Major Threat to Cybersecurity in 2022
• Four examples of human error in cybersecurity — and how to fix them
• Statistics and Facts: Human Error in Cybersecurity – Comparitech
• 8 Common ‘Human Errors’ in cybersecurity and preventive measures

Resources: