• Criminals increasingly use
sophisticated social engineering to
hack into corporations.
• Many employers do not train
workers to identify phishing
• Risk managers should take the
lead in overseeing cyber security
breaches and external cyber liability risks to focus on the risks of employee behavior.
“I don’t want to say [employee behavior] is more important [than external
risks] but it’s not getting its full share of attention,” he said. “It’s not top of mind
for many organizations.”
He cited an example where criminals left USB memory sticks inside various
restrooms of a corporation. They were labeled “confidential salary information.”
Not surprisingly, employees who found them plugged the USBs into their computers.
That launched programs that captured and transmitted sensitive data to a
criminal organization, Frappolli said.
“That’s a really good example of how easy it is to exploit employees,” he said.
QUARTERBACKING CYBER RISK
“Rarely is it deliberate. It’s not malicious. … It is behaviors they could be educated
Cost may be one reason organizations have not focused more on employee
training, but Frappolli said, it’s also a belief that the “threat always seems a little bit
more remote than it is.”
Rob Rosenzweig, vice president and national cyber risk practice leader at Risk
Strategies Company, said risk managers must take ownership of cyber security.
“In many ways, risk managers are the quarterbacks,” said Rosenzweig, a 2017
Risk & Insurance® Power Broker® winner in the Technology category.
“There are lots of cooks in the kitchen — legal, information technology, HR
— but at the end of the day this is a systemic risk to all businesses. It certainly is
within the domain of a risk manager.
“The coordination of those stakeholders internally often falls on risk
management at our clients,” he said. “They are able to drive home to those various
stakeholders what the risk is and why everyone should be involved in the process.”
Plus, he said, risk managers are more aware of resources, such as training
or other proactive measures, which can be provided either at no cost or at a
discounted rate by insurance companies or brokers.
“It’s a win-win for everybody,” Rosenzweig said. “For clients, it’s prevention and for
insurers, it makes their clients better risks. I expect to see more in the coming years.”
Prevention, of course, depends on whether the breach was due to carelessness
“If you have an internal person who knows you really well and has gone over
to the dark side for criminal acts, that’s a tough one to deal with,” said Bob Parisi,
managing director, Marsh FINPRO.
But companies can make it more difficult for them. It can be as simple as
automatically canceling log-in credentials when employees leave or when vendors
complete their work, said Berglas of K2 Intelligence.
A survey by Sailpoint found that two of five former employees could still access
their former company’s computer system after they left.
It’s also crucial to segregate data, so that files are available only to employees
who need the information to do their jobs, Berglas said. Requiring two-factor authentication, such as an additional password or requiring the use of a
thumbprint on an iPhone, is also important, he said.
Michael Kaiser, executive director of the National Cyber Security Alliance,
said companies should determine their “most critical or crown jewel assets. What
would harm you the most if stolen,
lost or destroyed and how do you build
protection layers around that?”
Segregating information, he said,
can be more challenging in small
to mid-size organizations where
responsibilities are more diverse.
According to a survey by Kaspersky
Lab and B2B International, intentional
fraud by employees in enterprise
companies amounts to more than $1.3
million in costs, said Andrey Pozhogin,
cyber security expert at Kaspersky Lab,
in an email.
Security Breach Investigation
Report said that of the top five ways
that result in 95 percent of security
breaches, four of those five directly
involve employee behavior.
Some employee activities are
malicious: The IT employee at the
American College of Education
who allegedly changed the system
password before being fired and
then offered to sell it back to the
organization for $200,000; or
the 20 percent of employees who
admitted to a Market Pulse Survey
by SailPoint that they would sell
their company passwords, some for
as little as $150.
But most employees are culpable
only of not being wary enough.
“You have to be more pessimistic,
more mistrusting and more
suspicious of intentions,” said Miles.
“That’s not a natural behavior of
humans. Social engineering exploits
It doesn’t have to be as blatant
as the bogus CEO’s email to his
accounting department. And that
scam probably didn’t start there.
That’s where it ended.
It starts with easy questions, by
phone or email, from an apparent
co-worker or vendor asking for a
name or a title. Then, the hackers
dive deeper, pulling together
corporate hierarchies, co-worker
relationships and personal activities.
Sometimes, the emails,
apparently from inside the
organization, ask users to click onto
a link to review a file or log onto a
Or it could be an email from a
vendor with an attached invoice that
has to be paid or a message from a
merchant with instructions on when
a package is expected to be delivered, said Larry Lidz, chief information security
officer at CNA. When the attachments are clicked, the embedded malicious
materials are used to access systems.
In the day-to-day time crunch at work, employees may not take the time
to look at such innocuous emails suspiciously. And once the link is clicked, the
hackers are inside the system.
“As far as my experience,” said Austin Berglas, senior managing director and
cyber defense practice head at K2 Intelligence, “with few exceptions, the majority
of the successful breaches start because a cyber criminal exploits an employee or
third-party who had connectivity inside the target network.”
He said 11 percent to 15 percent of employees will click on an infected email
“That’s a pretty significant number,” he said. “It often just takes one.”
Martin Frappolli, senior director of knowledge resources at The Institutes,
which provides training for insurance and risk management professionals, said that
corporations are sometimes too distracted by the never-ending news of big data