GDPR = General Data Protection Regulation (EU)The General Data Protection Regulation (GDPR) is new legislation enacted by the European Union intended to better protect the privacy and security of individuals located in the EU. It is the most comprehensive privacy initiative since the 1995 European Union Data Protection Directive. The GDPR completely replaces the EU Data Protection Directive. GDPR gives users more control over personal data collected and how it is used. The regulation is broad, far-reaching and affects anyone who handles personal data for individuals located in the EU. Enforcement begins May 25, 2018, and covers both new personal data, as well as legacy personal data collected prior to that date.
When weighing up the biggest security hazards to an organization, it may come as a surprise to discover that the End User within the organization is often the first to compromise security. Through no fault of their own, and mainly due to a lack of awareness, employees frequently open the virtual gates to attackers. The End User is the person who uses the software or hardware after it has been fully developed, marketed, and installed. It is also the person who keeps calling the "IT guy" with questions about why the product isn't working correctly. With the rise in cybercrime as well as the increase in the consumerization of IT and BYOD, it is more important than ever to fully educate employees about security attacks and protection. Although BYOD has given them an increased level of flexibility, it has also given the end user even more potential to cause security breaches. Bring your own device (BYOD) refers to employees who bring their own computing devices - such as smartphones, laptops and tablet PCs - to work with them and use them in addition to or instead of company-supplied devices. The prevalence of BYOD is growing as people increasingly own their own high-end mobile computing devices and become more attached to a particular type of device or mobile operating system. BYOD means users must be aware of the risks and responsible for their own ongoing security, as well as the business. Threat actors actively target end-users as a primary route to compromise. Some criminals may be targeting the end-user directly, for example to conduct financial fraud, others will be leveraging the user to gain access to the organizations IT infrastructure. It is important to note that threat actors can target end users on their home networks and mobile devices, who will then unwittingly bring the “infection” inside the organization. Increasingly these days, the criminals use a technique called spear phishing; an attacker sends a highly targeted email, often with personal contextual details that fools the user into clicking a link and, unknown to them, downloading malware. Once this has been downloaded, it provides access to the end users device which is used as a launch point to harvest network information and expand control inside the network. Additionally, spear phishing can be used to fake a page the targeted ender user is familiar with, such as Dropbox, and ask them to login. The end user will not be able to login but in attempting to do so the fake page will record their login credentials. Due to the detrimental ramifications, it is vital that end users have a full understanding of the most common ways for threat actors to target them. This includes educating employees that they will be targeted, encouraging them to be vigilant at all times, teaching employees what qualifies as sensitive data, how to identify and avoid threats, acceptable use policies and security policies.
|
AuthorSThe Cog Blog is a collection of important articles about the Cogs of your Business. Some of the blogs are written by Killian Consulting, and others can be found throughout the web. Sources have been cited. ArchivesCategories
All
|
RSS Feed
|
© 2015-2019 Killian Consulting Firm. All Rights Reserved.
|