The Weakest Link in the Chain is Growing Weaker: Anticipating the Effects of Employee Stress and Fatigue on Cybersecurity

November 10, 2021

Since well-known hacker Kevin Mitnick helped popularize the term 'social engineering' in the 1990s, both physical and cybersecurity professionals have become increasingly aware of the risks associated with the human element. The idea itself, and many of the techniques associated with social engineering, have been around as long as there have been scam artists.

But today an online trickster can wreak havoc for individuals and organizations with greater ease and efficiency than ever before. That hackers exploit common psychological vulnerabilities to compromise network security or steal funds is not news. What is news is how those vulnerabilities are changing, and how they will reshape the cybersecurity landscape for the foreseeable future.

The Evolution of Social Engineering through the Pandemic

By exploiting human nature through fear, the illusion of urgency, scarcity or familiarity, or simply the default human tendency to trust others, hackers have continued to repurpose well-worn tactics to convince unsuspecting users to follow their directions. Whether that has meant sending funds or providing credentials, hackers have continued to use simple psychological techniques to fool even attentive individuals at both home and at work. The ability of hackers to get past our technological and human defenses can be surprising and frightening, as well as costly.

Making matters worse, hackers have recently discovered another exploitable human vulnerability: stress. Social, political, and economic instabilities dominate daily newscasts, and trust and confidence in authorities, as well as in our neighbors and coworkers, has been badly shaken.

Work-related stress, exhaustion, cynicism, and negativity have surged during the pandemic, with 42 % of women and 35% of men in the United States saying that they feel burned out often or almost always in 2021. Baseline behavioral health has significantly declined during the COVID-19 pandemic, and employees are still discovering how to work in a remote-first world. Distraction, stress, and fatigue all play a role in an employee’s cybersecurity decisions and increased levels can leave individuals and organizations more vulnerable to cybercrime.

The Connection Between Stress and Cybersecurity

Stress affects concentration, short-term memory, decision-making, problem-solving, and impulse control—all behavioral factors that can increase vulnerability. Opening the wrong email attachment or clicking on the wrong link when someone is frazzled can have catastrophic consequences. It is important to recognize the important behavioral reality that, as stress increases, situational awareness and vigilance decrease, and executional errors increase. There is little denying that human errors are the leading cause of security breaches, despite increased attention on the issue.

The risk of an outsider threat also increases as hackers realize that employees have their guards down due to emotional exhaustion or pandemic fatigue. Anger or resentment about an organization’s posture on vaccines, masks, or other health or social and political issues can increase the risk of an outsider threat. Employees with a real or perceived grievance may feel justified in striking back through a malicious action, alone as an insider, or be more open to working with an external threat actor who recruits them for espionage or sabotage.

Cybersecurity in a Post-Pandemic World

Unfortunately, the behavioral health consequences of the pandemic are just beginning to surface and will likely emerge to be as great or greater than the challenges of managing the medical risks of COVID-19. The American Psychological Association’s annual Stress in America poll indicates that the COVID-19 pandemic has already resulted in significant mental health distress with nearly half (48%) of those surveyed stating that their level of stress has increased compared with before the pandemic.

And the emotional toll of the pandemic is also likely to linger. While hackers have taken note of the gradual wear and tear on people’s defenses, and have sought to exploit these emerging human vulnerabilities, they may not yet be fully aware of their long-term potential. The behavioral consequences of this crisis will likely continue for several years after the public health threat has abated.

Human element projection

Protecting the People from Themselves

People are the weakest link in the cybersecurity chain. That link was already weak simply due to innate cognitive and behavioral traits that are just part of human nature. That said, it is increasingly important for anyone concerned with cybersecurity to recognize that this link has grown weaker under the stress of the pandemic and related socio-economic challenges, and that it is likely to grow weaker yet over the next months and years.

In addition to working with partners, including human resources and employee assistance professionals, to better support our employees, it will be necessary to use technology to protect the human element. By using the advanced strategies and technologies to recognize and block malicious attempts to exploit our employees, we can better protect them, and our organizations, from harm.

To learn more about the human element in cybersecurity, download A Perfect Storm for Social Engineering: Anticipating the Human Element in Post-Pandemic Cybersecurity.

Related Posts

B 12 03 22 SIEM
Learn about Abnormal’s enhanced SIEM export schema, which provides centralized visibility into email threats
Read More
Blog phishing cover
The phishing email is one of the oldest and most successful types of cyberattacks. Attackers have long used phishing as a common attack vector to steal sensitive information or credentials from their victims. While most phishing emails are relatively simple to spot, the number of successful attacks has grown in recent years.
Read More
Blog brand cover
For those of you who have visited the Abnormal website over the last month, you’ve seen something different—a redesigned brand focused on precision. It’s new and innovative, and different from any other cybersecurity company, because it was created with one thing in mind: our customers.
Read More
B 11 22 21 AAA
At Abnormal, our customers have always been our biggest priority. Customer obsession is one of our five company values, and we live this every single day as we provide the best email security protection available for the hundreds of companies who entrust us to protect their mailboxes.
Read More
Blog microsoft abnormal cover
Before we jump into modern threats, I think it’s important to set the stage ​​since email has been around. Since email existed, threat actors targeted email users with malicious messages, general spam, and different ways to take advantage of the platform. Then of course, more dangerous attacks started to come up… things like malware and other viruses.
Read More
Blog black friday scam cover
While cybersecurity awareness is a year-round venture, it is especially important to be mindful during certain times of the year. With Thanksgiving here in the United States on Thursday, our thoughts will likely be on our family and friends and everything we have to be thankful for this holiday season.
Read More
Blog automation workflows cover
Our newest platform capabilities help customers streamline critical security workflows, like triaging phishing mailbox submissions or triggering tickets to investigate account takeovers, through automated playbooks. Doing so can decrease mean time to respond (MTTR) to incidents, further reducing any potential risk to the organization and eliminating manual workflows to save time and increase the efficiency of IT and security teams.
Read More
Blog tsa scam cover
On November 9, 2021, we identified an unusual phishing email that claimed to be from “Immigration Visa and Travel,” inviting the recipient to renew their membership in the TSA PreCheck program. The email wasn’t sent from a .gov domain, but the average consumer might not immediately reject it as a scam, particularly because it had the term “immigrationvisaforms” in the domain. The email instructed the user to renew their membership at another quasi-legitimate-looking website.
Read More
Blog pyspark cover
At Abnormal Security, we use a data science-based approach to keep our customers safe from the most advanced email attacks. This requires processing huge amounts of data to train machine learning models, build datasets, and otherwise model the typical behavior of the organizations we’re protecting.
Read More
Blog tiktok attack cover
As major social media platforms have expanded the ability of creators to monetize their content in the last few years, they and their users have increasingly found themselves the targets of malicious activity. TikTok is now no exception.
Read More
Blog ransomware guide cover
While various state agencies and the private sector keep track of ransomware attacks and related tactics worldwide, malicious actors change and evolve their ransomware strategies all the time. We’ve put together a comprehensive guide that will define ransomware, how to detect it, and what steps to take if you’ve fallen victim to a ransomware virus attack.
Read More
Blog detection efficacy cover
One of the key objectives of the Abnormal platform is to provide the highest precision detection to block all never-before-seen attacks. This ranges from socially-engineered attacks to account takeovers to everyday spam, and the platform does it without customers needing to create countless rules like with traditional secure email gateways.
Read More