B 10 3 22 Technology Industry Solution Brief

Data Sheets

Discover the AI-based email security platform that protects technology companies from the full spectrum of email attacks.

Abnormal for the Technology Industry

Email Security

B 09 26 22 Legal Solution Brief

Discover the AI-based email security platform that protects law firms from the full spectrum of email attacks.

Abnormal for the Legal Industry

Blog cybersecurity awareness month

White Papers

October is the perfect time to evaluate your email security practices, both for your employees and across your organization. These resources can help.

Cybersecurity Awareness Month: CISO Resource Kit

B 09 22 22 Government Solution Brief

Government

Discover the AI-based email security platform that protects state and local governments from the full spectrum of email attacks.

Abnormal for State and Local Government

Kroenke Sports & Entertainment

B 09 16 22 Kroenke Opt 1 V2

Customer Stories

Videos

Together, Abnormal and Microsoft provide Kroenke Sports & Entertainment with a robust, efficient security solution that blocks advanced threats from reaching inboxes.

Delivering Wins for Employees, Partners, and Fans with a High-Performing IT Team

B Higher Education

Education

Discover the AI-based email security platform that protects educational institutions from the full spectrum of email attacks.

Abnormal for Higher Education

United States

Choice Hotels

B 09 14 22 Choice Hotels

Hospitality

Case Study

With Abnormal automatically handling advanced email threats, Choice Hotels now uses its time to fortify the entire hospitality cybersecurity space.

Connecting the World Through Technology and Hospitality

B 09 13 22 Healthcare Solution Brief

Healthcare

Discover the AI-based email security platform that protects healthcare organizations from the full spectrum of email attacks.

Abnormal for Healthcare

B 09 12 22 Retail Solution Brief

Retail

Discover the AI-based email security platform that protects retailers from the full spectrum of email attacks.

Abnormal for Retail

Resource Center: A Perfect Storm for Social Engineering: Anticipating the Human Element in Post-Pandemic Cybersecurity

Top Bar

Cybersecurity Awareness Month: Free CISO Resource Kit

B Essential Guide

Discover common email security challenges, critical capabilities for cloud email security, and 10 considerations to shape your cloud email security strategy.

The Essential Guide to Cloud Email Security

B 08 08 22 H2 Threat Report com

Threat Reports

From January-June 2022, Abnormal found a 48% increase in email attacks, and 68.5% of the attacks included a credential phishing link.

H2 2022: Threat Actors Impersonate 265 Brands in Credential Phishing Attacks

B Gartner Highlights 1

Analyst Research

The Gartner Market Guide for Email Security explains what integrated cloud email security (ICES) solutions are and why they’re essential for modern enterprises. Download a copy now to learn why enterprises are moving away from the SEG.

2021 Gartner Market Guide for Email Security

B 07 19 22 2022 Email Security Trends

We surveyed 300 security leaders to discover what matters most to them when it comes to email security in the current threat landscape.

2022 Email Security Trends Report: Managing Risks Amidst the Changing Threat Landscape

B 03 25 22 CISCO Guide to VEC

Supply chain compromise attacks can cause substantial financial loss through invoice or payment fraud. Learn how and why attackers leverage compromised accounts from vendors to launch attacks that are specifically designed to bypass traditional email security.

CISO Guide to Supply Chain Compromise

Supply Chain Compromise

Template - Resource Center

Resource Center

The challenge of dealing with cybercrime is complex. Human factors and the human-computer interface are central components of cybersecurity. But because threat actors understand human behavior, they know how to manipulate it to achieve their goals—stealing money and valuable information from organizations worldwide.
Download the white paper, written by behavioral scientist Steve Crimando to learn:
<ul><li>Why humans are the weakest link in a cybersecurity strategy</li><li>How the COVID-19 pandemic has changed human behavior</li><li>Which tactics are most used by cybercriminals to take advantage of the human element</li></ul>
Fill out the form to receive your copy of the white paper. 
After reading this white paper, you are eligible for .5 CPE credits through (ISC)².

Thanks for your interest in the Anticipating the Human Element in Post-Pandemic Cybersecurity shite paper! <a href="https://cdn2.assets-servd.host/gifted-zorilla/production/files/Human-Element-Cybersecurity.pdf">Click here</a> to download the PDF, or view the text below. To claim your (ISC)² CPE credit, please fill out <a href="https://docs.google.com/forms/d/e/1FAIpQLSeXpNB-pZ-mhmRUQCxme-d5JCj_4lDYyxVyRHiDBb2ypV5xfQ/viewform" target="_blank" rel="noreferrer noopener">this form</a>.

The challenge of dealing with cybercrime is complex. Human factors and the human-computer interface are central components of cybersecurity, and while technology alone will not prevent cybercrime, neither will people. People alone also can also not be relied upon as a last line of defense in an organization’s cybersecurity strategy. 
Because threat actors understand human behavior, they know how to manipulate it to achieve their goals—stealing money and valuable information from enterprises and small businesses alike. These criminals use various types of social engineering to complete their schemes, relying on urgency and name recognition to trick their victims. Unfortunately, this has only become more prevalent during the COVID-19 pandemic as organizations and employees reshape the landscape of work. 
Since March 2020, the stress associated with COVID-19 has impacted employees in hundreds of ways, with people worried about their health, families, careers, and finances. When combined with the political chaos and social unrest, the pressure has been overwhelming for many people and made it more difficult to stay focused on cybersecurity. Threat actors have taken advantage of this situation, with an increase in the number and severity of attacks.
Humans have always been the weakest link in cybersecurity, and research shows that this will not abate post-pandemic. In order to truly protect our employees from themselves, cybersecurity professionals must understand human behavior and what this means when it comes to social engineering. It’s only by recognizing the social engineering threat that we can find ways to prevent it.

A central finding of the <a href="https://www.verizon.com/business/resources/reports/dbir/" target="_blank" rel="noreferrer noopener">Verizon 2021 Data Breach Investigation Report</a> is that 85% of breaches involve the human element. While individual behaviors, personality traits, online activities, and attitudes toward privacy and technology impact individual and organizational vulnerability, research has consistently shown that people are the weakest link in cybersecurity.
The fact that hackers exploit common psychological vulnerabilities to compromise network security is not news. What is news is how those vulnerabilities are changing, and how they will reshape the cybersecurity landscape in the wake of the COVID-19 pandemic. 
Public health emergencies simultaneously present significant threats to both physical and psychological wellness. Researchers have predicted that the COVID-19 pandemic will cast a very long shadow in its impact on behavioral health. The isolation, disruption of daily routines, financial hardship, uncertainties, and frequent misinformation associated with the pandemic has resulted in significant psychological impacts with <a href="https://www.thelancet.com/pdfs/journals/lancet/PIIS0140-6736(20)30460-8.pdf" target="_blank" rel="noreferrer noopener">global reports</a> of depression, anxiety, stress, and loneliness in the general public. Accurately anticipating the behavioral changes in the workforce related to these impacts will be critical to successfully navigating the post-pandemic cybersecurity environment.

A pioneer in psychological research, Kurt Lewin proposed <a href="https://en.wikipedia.org/wiki/Lewin%27s_equation#:~:text=Lewin's%20equation%2C%20B%20%3D%20f(,explanation%20of%20what%20determines%20behavior." target="_blank" rel="noreferrer noopener">a heuristic formula</a>, B = f (P, E), as an explanation of what determines human behavior. Lewin suggested that behavior (B) is a function (f) of the interaction between the person (P) and their environment (E). Our current environment is unlike any in recent memory, and it is not defined exclusively by the ongoing pandemic. Social, political, and economic instability dominates daily newscasts, and trust and confidence in authorities, as well as in our neighbors and co-workers, has been badly shaken. Exhaustion and burnout have driven a whole new cohort of people to quit their jobs, and the workplace is shifting dramatically. 
In considering the implications of Lewin’s equation to the current challenges in cybersecurity, the “P” factors represent the “person” aspect of the formula. These are, for the most part, static characteristics, such as the psychological influences of perceived authority, urgency, trust, and scarcity, which are fairly universal, and which hackers consistently exploit to trick their targets. The “E” factors include everything going on around the target in their personal and professional lives. Those forces include the uncertainty, exhaustion, and confusion related to the rollercoaster ride of the pandemic. Stress, burnout, and disillusionment are driving forces in the psychology of human errors leading to security breaches. 
While much has been written about the P factors, the E factors are constantly shifting and are of equal importance in evaluating post-pandemic cybersecurity. They must be understood as well by cybersecurity professionals as they are by cybercriminals, who increasingly develop new avenues for effectively exploiting human vulnerabilities.

Human element formula

Social engineering is any form of cybercrime based on impersonation, and is occasionally referred to as pre-texting. As part of the attack, a cybercriminal tries to convince his victim to send money or provide valuable information or access to a service or system. The method is typically via email and is what we’ll focus on most here, but social engineering can also occur across texts, chat messages, and phone calls. Social engineering scams can also be completed in person, but that method represents greater risks of detection for the criminal. 
These attacks can be completed in a variety of ways, but the most popular version occurs when the attacker pretends to be a trusted person. They then convince the target to follow their instructions. In doing so, the target unwittingly creates an opportunity for the attacker to steal money or compromise security.
Social engineering scams can be categorized in multiple ways:
<ul><li>Phishing: A social engineering attack conducted via email. Related attacks, called smishing and <a href="https://abnormalsecurity.com/glossary/vishing">vishing</a>, are social engineering attacks conducted via SMS and voice, respectively. Phishing attacks tend to be broad and may target hundreds of people across multiple organizations with the same message.</li><li>Spear Phishing: Similar to a phishing attack, this email or electronic communications scam is targeted towards a specific individual, organization, or business. Spear phishing is more targeted than phishing and typically contains specific information that the target would expect to receive.</li><li>Whaling: A phishing attack targeting a corporate executive or government official. This attack type is called whaling because the targets tend to be “big whales” within an organization, with access to large funds or extra sensitive information.</li></ul>
Each of these social engineering methods involves some type of impersonation, either of a person or a brand. The social engineer often uses sophisticated techniques to make their impersonations more convincing, including making email addresses, URLs, and websites look genuine to fool their targets. They do this to manipulate their targets through normal human emotions and concerns, playing on urgency and creating pressure to convince people to do something before they’ve had time to think it through.

According to the most recent <a href="https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf" target="_blank" rel="noreferrer noopener">FBI IC3 Internet Crime Report</a>, business email compromise (BEC) is the most costly cybercrime, accounting for 44% of all financial losses in 2020 and costing organizations $1.8 billion last year alone. By definition, a BEC attack is any type of phishing attack where the target believes they have received an email from a legitimate person or business. 
This can be executed by email impersonation, email spoofing, or an email account takeover in which the attacker has full access to a legitimate sender account. As part of the scam, the victim receives an email that appears to come from a trusted sender and seems genuine, but in fact, contains a phishing link, a malicious attachment, or a request to transfer money to the attacker. 
While BEC attacks target both individuals and businesses, an attacker typically uses BEC to access funds from organizations or credentials for business-related services. Most cyberattacks are financially motivated, but they also can be ideological in nature. In order to access account credentials, an email might contain a phishing link leading to a fake account login page where an unsuspecting target enters their username and password, only to have that information fall into the hands of a cybercriminal.
BEC attacks can also be the gateway for a ransomware attack—an increasingly common, disruptive, and costly type of cyber threat. These attacks are typically initiated through phishing and trick someone into opening an attachment that allows administrative access, which is then used to install malware that encrypts a victim’s files. The attacker then demands a ransom from the victim or their organization in order to restore access to the data. In many instances, that ransom is ultimately paid, since most organizations can’t operate without access to their data.

Cybersecurity often resembles a game of Whac-a-Mole, as attackers continue to invent new methods to thwart constantly-evolving cybersecurity. Attackers are not only cognizant of the vulnerabilities in networks and systems, but also of the changing attitudes and behaviors of their targets. 
They understand how people may behave differently at different times of the day or year, as well as in response to the changing use of technology, or the societal impacts of the pandemic. They are keenly aware of both the P and E influences on human behavior that create vulnerabilities and opportunities for exploitation. 
The P factors are part of the human condition; they are relatively stable and predictable. They may vary somewhat from person to person, or due to cultural influences, but in general can be exploited by someone with malicious intent, from cybercriminals to psychopaths. These characteristics also include cognitive biases, which are errors in thinking, specifically in processing and interpreting information. There are <a href="https://www.businessinsider.com/4-basic-problems-cause-all-the-cognitive-biases-that-screw-up-our-judgment-2017-3" target="_blank" rel="noreferrer noopener">188 recognized biases</a> that influence the way we view all aspects of the world around us, as well as our behavior, and can lead to poor decisions and judgments.
The P factors are simply part of human nature and how people think. Using well-known social engineering techniques and coercive language, hackers convince their targets to comply with their requests for information or access by leveraging these P factors. The most common human tendencies exploited by social engineers include:<ul><li>Authority: An attacker may represent themselves as an authority figure, such as an executive or an in-house IT specialist, to create the impression that their directions must be followed and not questioned. There is a natural human tendency for humans to avoid pain, and attackers know that people are more likely to follow instructions when they come from someone in power.</li><li>Intimidation: Again using fear as a lever, the attacker informs or implies that there will be negative consequences if certain actions are not performed. Consequences could include subtle intimidation such as “I’ll tell your manager” and more serious results like, “The whole system will go down if you don’t install this patch!” Social engineers are experts in creating a sense of impending doom.</li><li>Consensus/Social Proof: People seek confirmation and will typically do things that they see or believe other people are doing. The attacker might try to convince their target that everyone else has already taken a certain action, and therefore, the target should do so as well.</li><li>Scarcity: An attacker can create an illusion of scarcity by telling their would-be target that there is a limited opportunity to take a specific action. Human nature is such that when we believe things will become less accessible, we can be compelled into action. This concept is often used in sales by suggesting that an opportunity is available for “a limited time only!” but can also be used by attackers to convince their targets to take quick action.</li><li>Urgency: By creating a time-imperative, an attacker can create the impression that the target must act quickly or by failing to do so, there may be dire consequences. For example, if the target does not update their password in the stated time frame, they will lose their ability to access the network. In addition to using fear as a motivator, a tight timeline for taking action increases stress, decreases the opportunity for people to think the situation through, and increases the likelihood of an error.</li><li>Familiarity/Liking: People typically follow the lead of other people whom they like. If we like someone, we are more likely to do what the person asks. Social engineers may attempt to build rapport with the victim to build a relationship before launching the attack. Attackers also use this tactic after compromising an account, taking advantage of an established relationship to convince the target to take an action they normally would not take.</li></ul>
These common social engineering strategies and techniques are not mutually exclusive. They can be used in combination, making them less obvious and potentially more confusing for their victims. There are endless variations on these themes that are used every day to trick people into complying with the will of the social engineer.
Hackers understand the power of the P factors, like fear, ego, or not wanting to miss an important opportunity or task, especially for someone of authority. At the same time, they effectively capitalize on E factors, like social, political, and economic stress, as well as concerns about personal health and safety.

The onset of the pandemic in early 2020 forced quick and drastic changes in the ways that people work. The shift to remote work left employers and employees more vulnerable to cybercrime, and attackers took advantage. 
As work shifted from the central office to thousands of homes, there was a significant uptick in coronavirus-related spear phishing email messages, as well as an increase in malicious activity against platforms adopted for remote work. Companies like Abnormal saw large increases in social engineering attacks focused on VPN software, remote access infrastructure, video conferencing software, and other cloud-based solutions. 
In addition to exploiting technical vulnerabilities in the transition to remote work, hackers quickly recognized changes in employee behavior that also presented opportunities for exploitation. Several aspects of working from home can easily increase complacency and decrease situational awareness. With the change in location, schedules, and other markers that signal that people are actually “at work,” boundaries can become fuzzy and employees can become less vigilant. 
Multiple cognitive biases can conspire to create the illusion of safety, leading those working from home to lower their guard. Some employees may have challenges balancing working with parents, children, or pets who are also in the home, or get distracted by household chores or personal electronics suddenly at their disposal. Such distractions can lead to missing the risk indicators of a cyber threat.

No matter where the employees are working now—whether still at home, on some type of hybrid schedule, or back in the office—they are all subject to pandemic fatigue, stress, and the effects of the current environment on their overall psychological wellness. The American Psychological Association’s annual <a href="https://www.apa.org/news/press/releases/stress/2021/sia-pandemic-report.pdf" target="_blank" rel="noreferrer noopener">Stress in America poll</a> indicates that the COVID-19 pandemic has already resulted in significant mental health distress with nearly half (48%) of those surveyed stating that their level of stress has increased compared with before the pandemic. 
Stress impacts short-term and working memory, decision making, judgment, logic, and reasoning, all of which can be exploited by a well-timed social engineering attack. As stress increases, situational awareness and vigilance decrease, and executional errors increase. Stress directly affects cybersecurity behaviors and can significantly increase the chances of mistakes that can compromise cybersecurity. The relationship between stress and behavior is critical to cybersecurity and should not be minimized or dismissed.

Human element symptoms

If and when the COVID-19 pandemic ends, psychological functioning for most people will not automatically or instantaneously rebound. The behavioral consequences of this crisis will likely linger for several years after the public health threat has abated. 
Research on post-pandemic behavioral health forecasts a dramatic increase in the need for professional psychological help, even well after the virus is controlled. For example, research in the UK by the <a href="https://www.centreformentalhealth.org.uk/sites/default/files/publication/download/CentreforMentalHealth_COVID_MH_Forecasting4_May21.pdf" target="_blank" rel="noreferrer noopener">National Health Service and Centre for Mental Health</a> predicts that levels of demand for emotional help will likely reach two to three times that of current capacity within five years of the post-pandemic window.

Human element projection

The behavioral health consequences of the pandemic are just beginning to surface and will likely emerge to be as great or greater than the challenges of managing the medical risks of COVID-19. Cybersecurity professionals must be prepared.

People are simultaneously an organization’s greatest asset and greatest vulnerability. Human behaviors, from clicking on a bad link to opening the wrong email attachment, can be devastating to network security. Such actions can be the byproducts of bad judgment and ignoring cybersecurity practices, or the results of contact with a particularly skillful social engineer. They can just as easily be mistakes made by stressed and fatigued employees, or a combination of any or all of these factors. 
Since early 2020, the extreme stresses associated with the pandemic have affected employees’ health, relationships, and finances, all during a time of heightened political chaos and social unrest, while they attempted to meet the shifting demands of their jobs. The ill-effects of these colliding forces have been overwhelming for many people. 
The behavioral health field is sounding the alarm regarding the behavioral consequences of COVID-19. They are telling us that it won’t simply be over when it’s over, and we must be prepared for the lasting effects of the pandemic. As articulated in Lewin’s equation, these coronavirus-related environmental factors, in concert with the complex interaction of bio-psycho-social people factors, will serve as ready levers for the skillful social engineer. 
The human vulnerability has always been the weakest link in cybersecurity, and it is likely to remain an even greater concern for the foreseeable future. In the near term, cybersecurity professionals must work closely with human resources departments, health and safety specialists, behavioral scientists, and mental health practitioners to understand and assess the emotional and cognitive impact of the evolving workplace and social environment, as well as be aware of those aspects of human nature that allow cybercriminals to ply their trade. When possible, security leaders should provide the tools necessary to stop these attacks before they reach the human element, effectively blocking the threat before people must interact with it. We are in a new era of cybersecurity, and people will continue to be our biggest threat. We must protect them where we can. The new cyber threat landscape will demand nothing less.

Anticipating the Human Element in Cybersecurity

Human element whitepaper cover

Homepage

A Perfect Storm for Social Engineering: Anticipating the Human Element in Post-Pandemic Cybersecurity

Breadcrumbs

Download the white paper to understand why COVID-19 has created the perfect storm for social engineering, and what you can do to mitigate the risk.

Anticipating the Human Element Post-Pandemic

description

generator

cybercrime, cybersecurity, component, technology, prevent, people, organization’s, dealing, complex, human-computer, interface, central, relied, line, defense

keywords

https://optimise2.assets-servd.host/gifted-zorilla/production/images/resources/human-element-whitepaper-linkedin.png?w=1200&h=630&q=82&auto=format&fit=crop&dm=1636475030&s=0cb1d40a3c1cac84f658407a1ae63049

https://abnormalsecurity.com/resources/human-element-post-pandemic-cybersecurity

referrer

robots

twitter:card

twitter:creator

twitter:description

https://optimise2.assets-servd.host/gifted-zorilla/production/images/resources/human-element-whitepaper-twitter.png?w=800&h=418&q=82&auto=format&fit=crop&dm=1636475013&s=68cf325954655ede157e809cb8f0537c

twitter:image

twitter:image:height

twitter:image:width

twitter:site

twitter:title

{"title":{"title":"Anticipating the Human Element Post-Pandemic | Abnormal Security"}}

The challenge of dealing with cybercrime is complex. Human factors and the human-computer interface are a central component of cybersecurity, and while technology alone will not prevent cybercrime, neither will people. People alone also can also not be relied upon as a last line of defense in an organization’s cybersecurity strategy.

A Perfect Storm for Social Engineering: Anticipating the Human Element in Post-Pandemic Cybersecurity

Download Now

Related Resources