Latest / The HIDDEN Podcast by Babble / Episode 3: Why 95% of Cyber Breaches Start with People — and What to Do About It
Transcript
- Lynn Murape: Joining me in the virtual studio today is James Gaskell. Thanks for being here, James. Welcome to the HIDDEN™ Podcast, where we simplify cyber security and all things tech for those of you who, like need it to be explained without all the So if you've ever wondered why you still feel vulnerable even though you've bought all the fancy tools, come to the right place. ⁓ your host, Lynn Murape and job is to take one of our resident experts and help them translate their cyber expertise into plain This means having practical conversations That's a wrap on today's episode of the HIDDEN™ podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. And if you're wondering where you stand across the six HIDDEN™ layers, our cyber security snapshot in the description below. a lot less painful than a breach. Until next time, don't let your risks stay HIDDEN™. James Gaskell: No problem, and thank you for having me. Lynn Murape: It's a pleasure to have you. So before we dive in, do you mind telling our listeners or viewers out there a little bit about yourself in terms of what you do and where you live? James Gaskell: Yeah, sure. I'm one of the account managers here at Babble. I work primarily within the public sector, but also ⁓ some of the larger private sector accounts. I've in the industry doing telecoms MSP and antivirus and cyber security things for about 10 years now. I'm based up in the Northwest of England. Lynn Murape: usually built around Babble's HIDDEN™ cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Lovely, awesome. Well, I've never been to England before, but it's definitely on my bucket list. So before we get into the episode in and of itself, do you mind telling us a bit about, you know, what you like most about what you do? James Gaskell: I love most about this industry in particular, specifically around the cyber security, is it's always changing. There's always something new to learn. There's always something new to ⁓ find about. It's a constant cycle of learning and behavioural changes and it makes it really engaging for me. Some industries very static. This is a very dynamic place to work and it really keeps you on toes. You can't rest for a minute. Lynn Murape: I can imagine. I mean, I'm not as close to the industry as you are, but even me as a common civilian, know, cyber security is top of mind for everybody, right? Hence this podcast. today we're unpacking a very crucial question, which is ⁓ confident are you that your people ⁓ spot a convincing phishing attempt? ⁓ James, we often think cyber attacks are purely technical, right? But the data shows that most are whopping 95 % of breaches trace back to human error. is that still the case? James Gaskell: I mean, the statistic there really does speak for itself. attacks the most common of cyber crime. There's billions, and billions of emails, spam emails sent every day all over the world to targeted addresses, know, just attempting to break in to get a little bit of information. Now, ⁓ I know because I researched and in the industry that this is a really effective way of getting that information. Trying to break into those different of targets because just many they can do in one go, can scatter shot attack it. And it's effective against what we call the digital natives who are the and the Gen Z, the primary targets of this, the people who have grown up ⁓ on the internet. we're very commonly sharing our information. We chuck in an email address when we want free Wi-Fi. We scan things and we'll get something for free. And we're really the targets the most common of those attacks. And because such a huge proportion of the UK businesses ⁓ those generations staff members, load of cyber attacks are against those users and those businesses as well. So it's super common and very, very successful. Lynn Murape: Yeah, it's definitely really scary to just hear about the statistics and the prevalence as well. Something that you had said jumped out at me in terms of scatter shot attacks. Do you mind unpacking a little bit what those are? James Gaskell: Yeah, I the benefit of the phishing attacks you can do it to such a wide audience that if you that your rate of returns is one in a million, you send out million emails and only one of them come back, for any other industry wouldn't be worth it. But the wealth that people can generate, the amount of information they can with phishing attacks and then the they can extort from customers from that is through the roof. And if it's as simple as just pressing go on a button on a bunch of email addresses you've already got, that is something that can be done over and over again. It's very, very light touch. And you know, most people have a spam filter and they just ignore it. And that's not a concern. If only one person clicks it, then that's been a little bit of a success and it can be done over and over and over again. Lynn Murape: scary stuff and it reminds me of the conversation that I had with ⁓ O'Dell in the first episode of this podcast which was you about how it is to just not only these attacks but to scale them and obviously AI sits the centre of all of that so if you haven't tuned into that episode please do so. But bringing it back to this one. James Gaskell: Mm-hmm. Lynn Murape: Threat actors are increasingly using targeted social engineering attacks to evade defenses and to trick users. So James, what's changed about phishing and social engineering over the last two to three years? James Gaskell: There's so much to unpack in that because people act online, you know, during COVID, especially in the UK, everyone was forced to work from home. We were all asked to use new software, new devices, ways of working, and we had to adapt to it very, very quickly. And technology always changing, people like me, and I'll hold my hands up here, I'm very, very accepting of being scan this, follow this link, do that. And I'll admit, I got caught not long ago with a simulated phishing attack. We were at a work event. earlier the year and our team had put up some scan this QR code and claim your Amazon voucher or your free jacket and I love a free Amazon voucher I love something for our I mean, I'll drive 200 miles for a free lunch So I mean, I mean I'm an easy target but I scanned it and I followed through and I handed over my details I gave my address. gave my office. I gave my email. I gave my boss's name. I gave him his email and the event, about two hours later, they asked everyone to stand up and said, if you've seen all these posters, stay standing. you didn't see them, sit down. And everyone, well, everyone, load of people sat down and I thought, here we go. What have I done here? ⁓ And, you know, I'd it. And luckily, as I it was a simulated attack. It was all fake. It was just to show how easy it is to fall into these, these bad habits. And it it's so, so easy because I I've worked in the industry. I worked for a company that all they did was cyber security products, Lynn Murape: Yeah. James Gaskell: and I got caught out. And so it's not a case of, ⁓ this person's an easy mark. This person here is stupid. This person here not paying attention. It's because we as and people who live in this day and age and of a certain age bracket, we are conditioned and we just that information It's no qualms to it. We just give it away. How many times given away your email address kind of thing. And that's all it And that's what makes it so easy. So repeatable and once they've got one bit of information, they can store it down and keep it and then they can sell it and then somebody else has it they can attack it as well and use it in a different way. And that's what makes it so different and so difficult now with AI and all the information they can get from different sources. They can pin you down. They track your location. I mean, it's a very minority very big brother, but the intelligence we put behind it now is quite scary in way. And it's that particular simulated attack is something I've been really open about talking to my customers with. It's a laugh, right? We can all have a laugh and giggle with it, especially because some of the SLT this business also did it. But imagine if that hadn't been simulated, if that had been real, if someone at a venue that we were attending they were going to replicate that for their own personal gain, and you were using a work device that had Lynn Murape: Yeah. James Gaskell: sensitive information on it, whatever that may be, be that addresses, banking information, financial information, ⁓ There's a huge, huge problem with it. so, ⁓ yeah, I think ⁓ just how available data is, that's what's made it so targeted and so tempting. Lynn Murape: Yeah. Yeah, a lot of great points, well made as usual. And I love that you brought up the SKO. Obviously, being based in South Africa, I wasn't able to attend, but I attended virtually. And I feel like I would definitely fall victim to it as well. And it goes back to an earlier point that you made in terms of ⁓ digital natives, right? We're just so used to giving away so much of our personal information. And seldomly take the time to take a step back and to actually okay, where is this going? Why am I being asked for this? We're always just looking either at reward that lies at the end, like a free Amazon jacket, or maybe fear-based, right? Because a lot of the phishing attempts that I've come across personally, right? Not even just on my work email, my personal email, it's always about, you need do this, it's allegedly from your bank, and they just play on your well. it also speaks to that element of complacency as well that you've mentioned in the past because it's kind of just rote at this point just going through the motions just give me what I need and then let me be about my day. But like you said, luckily, it was just a simulation, but it's not always the case. James Gaskell: Mm. Hmm. incident Yeah. Well, that's a really interesting point that what you made about being from the bank, that fear element of it, because there was a time when I changed the detail on some home insurance very recently I changed one piece of information for my home insurance to contact my wife because we were during the process of a move she was handling the admin side of things from that. And me updating one bit of information for the home insurance had a cascade effect that affected my actual bank. when I went into my overdraft, which I'm one to do, it sent her the notification rather myself. So she was getting text messages about my bank ⁓ and ⁓ being the overdraft she's I have a bank account with this so she could ignore it ⁓ and the only reason we picked on it and she mentioned it to me ⁓ is that we've been in a situation a couple of weeks prior where I was getting information about one of her loans because I was classed as a primary contact. And so there was like a break in the information chain and it was all fine. It was all resolved. It didn't cause any issues. But had we assumed, which we did for a couple of weeks, that it was a phishing attempt and just ignored it. If we'd have carried on ignoring it and not communicated it to each other, we'd have been in real trouble. But there was no human element involved there. There was no one we can actually sit there and speak to face to face and say, this is what we need to do. And because we're so reliant on those technology and the rules are so strict and how you need to engage with technology. Sometimes it's easier just to assume it's true. Lynn Murape: Yeah, definitely. I'm glad that everything worked out for the best, but we know that... ⁓ because they're getting so sophisticated and they can actually be quite pushy as well because sometimes you'll these attempts, because you want to err on the side of caution, but sometimes, it could be an error on the legitimate source's side and there's no way of really telling, like you said, without having that human voice to talk as well. That's definitely a great point to make. So thank you for adding that little anecdote there. ⁓ And this nicely segues into the next question. James Gaskell: Mmm. Lynn Murape: I have for you, which is around behaviour, right? James, in your opinion, why are attackers targeting behaviour instead of trying to break through firewalls? James Gaskell: I'm going to misquote a customer here. They pay a lot of money for a premium firewall. And if an attacker can breach the firewall, what else can they do? And a lot of times these firewalls, they come with insurances, they come with assurances, service level agreements. They are very, very good at what they do. They are designed to be good. They're constantly maintained, monitored, and it takes a lot of effort to crack through them. And a lot of times these people doing it, they haven't got the expertise or the incentive or the inclination to try and hack through. What's easier is, I mean, this is going back a couple of years now, probably 10, maybe 15 years, but part of the company I worked for did a, it wasn't called cyber security at the time. It was just called, I think it was just called behaviour or something like that. They dropped a load of pen drives in a car park, in our secure car park. They put a load of pen drives on the floor in the car park, about 15 of them. And there was something on the pen drive that when you installed it onto your computer, it would send a message to IT who'd plugged it in so they could. wrap them on the knuckles and say, don't plug pen drives into your secure device, you fool, because not smart. But people curious. People are easily misled. People are confused. People are busy. People are prone to making mistakes. We are not machines. We are human beings. And so that is why they target behaviour. It's because it's easier to predict behaviour than it is changes in firewalls. And it's easier to influence it as well. Lynn Murape: Yeah, I couldn't agree more. I mean, all it takes is one moment in time and one lapse of judgment for ⁓ basically everything to go belly up. Where do you see the biggest gaps in SMB when it comes to human risk? James Gaskell: From my experience, it's that cyber security is approached kind of like a car MOT and that you'll go to it and you know two weeks before your MOT you start sweating and you think, oh how much is this going to cost me? What do I need to do? Do I need it serviced? Do I need knee breaks? I need wipers, tyres, whatever? And so you once a year you throw a load of money at it, you rush around like an idiot for a day and then once that day is over and you've got that lovely pass certificate you forget about it. you do not, unless you have a problem, your brakes start squeaking, you will not think about it again. And I think that is really the biggest problem there because, know, it's, as I said, reason I love this industry is it's a learning curve, right? And is so easy to become complacent and stuff. We know it is, ⁓ but everything keeps changing, it's what brings me back to it and keeps me coming back and pushing to sell it. ⁓ Having people it as a learning curve, as an active dynamic environment, repeatable ways to ⁓ learn. There are many, many different ways to teach people how things can be resolved online. ⁓ think small business as usual style tests, for lack of a better word, or ⁓ dumps or demonstrations is better than once blue moon you do a huge day on it because people get saturated and it won't go in. ⁓ It needs to become business as usual. Lynn Murape: Just looking at cyber security as a tick box exercise is definitely the beginning of, I don't wanna be dramatic and say the beginning of the end, but it's definitely mindset that one should take. So I completely agree with that. So let's switch James Gaskell: Mm. Hmm. Lynn Murape: gears a little bit and talk about this element of visibility, right? Like let's say the average UK business owner knows that human risk is a little bit of an issue, ⁓ you ⁓ know what you don't know, if that makes sense. ⁓ what does quote unquote lack of visibility into human risk ⁓ mean? ⁓ James Gaskell: An easy way to know you've got a good handle on things is IT, head of IT often assume that they know what people are doing because they see the IT team and people who use the computers the most and they will know what that team is using. But do you really know what finance team are using or your credit control team are using to perhaps write their emails? that information is put in, it's online, it's stored somewhere. That is information that can control if they're using third party apps to do different things. So IT is a huge, huge problem. So if you ask random users what they're using, they're going to throw out that you're not expecting to hear. You know, we pay a lot of money internally for a CRM. know I'm really guilty of keeping stuff on a And then I take it from OneNote and put it into the CRM because easier for me to use the OneNote than it is the CRM when I'm out on the road talking to my customers. It's just convenient. But if there's a gap there or if someone's using a personal device to make notes. You still see using pen and paper, right? Pen and paper is really common. But if you lose notebook, that information is gone. So it's, yeah, there's lots of different of it. And when you start peeling back the layers of it is that people are actually doing in the real world, what you out is that there are ideals or policies in place where the IT department say, right, is what people should do. And everyone in a nuclear circle in that immediate vicinity is following those steps. But you take one outside of the room and those policies fall apart. And then you go to people who are very rarely in the office, and those policies aren't even known. And then you get further and further away from it until you get people who are basically using their work devices like personal devices or not security functions or not following procedures. And because you don't have visibility of that in you can't see them doing it, there's no reporting set up. There's these huge gaps in your posture. Lynn Murape: You brought up some excellent points, particularly around shadow and personal devices. So we'll dive into the latter in episode when we cover the risks around BYOD and things like that. But coming back to IT in particular, I can also definitely attest to looking into these different tools that'll help me be more efficient, more help me save time. But before you hit the ground running, it is absolutely important to run it past your IT team or is in charge of looking after the security of business as well. Because if that is green lit by the powers that so to speak, then it is classified as shadow IT and it's not the business's radar and therefore it could lead to a breach. Just wanted to make that I have broken that down in plain English as well and sure I'm the same page as you. All right, why do most treat human risk reactively so after someone clicks on a link for example? James Gaskell: going back to the lack of visibility, you sometimes only there's a problem after you have been made aware there's a problem. A lot of people, in the SMB sector, think they're too small. Think, we're too small. There's no point targeting us. We've only got 12 people in the business. And that's just not true anymore. talked about how easy it is to target people, even if you are only 12 people you only deal with a handful of customers. you're part of supply chain to some larger organisations, you are a vulnerable link in the chain somewhere getting a foot in the door, even it isn't something for immediate use, is going to be useful for down the line. Some people are really top of it. Some people really understand it. And is always growing. You know, people listening to this are people who are already how serious it can be, but it's definitely an area where I think there needs to be more of an understanding about it because so easy to think, ⁓ no, we'll be fine. And then it hits. It's like when house is into, it's too late to putting up security cameras and floodlights at that point. All your stuff's already gone, you don't want it to again. And it's very, very difficult sometimes to excuse the expenditure because sometimes it's seen expenditure. It's not seen as an investment before the fact. It's, you wait to see what the damage is going to be I'm afraid to say the damage can be massive. It be really, really painful. Lynn Murape: Yeah, definitely. I mean, one just needs to look at the headlines that have been coming out, what seems like daily to see serious the situation is. So ⁓ let's switch gears to something a little bit more because as we know, while your people can be your biggest risk, they can also be your strongest line defense. let's take a look at what that looks like in practical terms. What does good look like when it comes to managing human risk? James Gaskell: ⁓ It's a lot easier than people think and obviously we've been really doom and gloom about how dangerous it is out there. A lot times people are, if they haven't been attacked, know, it is an that they are on someone's radar but it hasn't landed yet. But if you haven't attacked yet, you haven't been attacked yet. And it's not impossible or actually really that cost prohibitive to get your people doing the right things. There's loads and loads of people out there, not just Babble, but we do specialise in it too. We work with some great partners to get your people up to speed and show you where those gaps are. obviously this is around the HIDDEN piece and there's a whole section around risk element and it's such a broad topic that I could hours talking about how you address every individual aspect of it. But just getting a place, just getting handle of how people in your organisation perceive cyber security in posture and then making very small incremental changes to a desirable endpoint to allow you to operate with confidence your people are doing the right things. It starts with baby steps. It really does small, small steps, sure, for example, that everyone actually is of how dangerous things can be, how easy it is to fall into these traps. Because the minute they see that actually this person here is my colleague or my peer has been out, my God I need to change how I approach this because I would have done too. I just need to spend half a second to think about it. And those changes can be rolled out really, really easily and very, quickly. So as I say, little baby steps to get you to a desired end point are definitely what I would recommend. Lynn Murape: Love that, you know, because it can definitely be overwhelming, you know, when you have all these leaks at the bottom of your buckets and you don't know which one to cover first. James Gaskell: Mm-hmm. Lynn Murape: But something that I love about talking to each and every one of you experts is just that sense of, yes, it's a lot to take in, but small little steps really do make a big difference in the bigger scheme of things, and especially starting with human risk. And just as a sidebar, we will definitely be having more conversations, diving into the different elements of human risk, but just keeping it at a broad level for now. As you were speaking, I was just thinking about how powerful that SKO was. I think everybody tuning in or there at the event definitely learned ⁓ lesson about how easy it is to get caught out as well. So ⁓ human risk measurable. Right now we've spoken this of starting to get a lid over it and talking about the of visibility or rather the importance of it. ⁓ So if a business is serious about improvement, as they obviously tuning into this episode, how do they now go about measuring human risk properly? James Gaskell: That's a really difficult question because if not the flags there, you don't what you're measuring against. There is no solid state of what good looks like. And this is I said about the baby steps. I would always recommend for those instances is you speak to an expert. It's so important for them to be able to decide where you want to be. With any kind of technology rollout, you need to really define what the endpoint looks like before you start. Because if you think you've got a vague idea and you start going towards it, then you get drift and you kind of get further away from the actual core of the problem. And so I would always recommend, when you are looking to try and find out, you know, how it becomes measurable is you one of us on a call with you and we'll talk you through it so we can see. Because everyone's estate is unique and what everyone wants their end to be unique and so we can get you where you want to be but we just to figure out what that is. Lynn Murape: Perfect. I couldn't have said it better myself. So I don't have any other questions for you, but is there something that you would to add before we officially close? James Gaskell: It seems but it isn't. You just need to decide to make the change and it is as easy as deciding to make the change to shore that human risk element If you're unsure about it, if you want to know more about it. Internally we've got so many people who talk your ear off about what good looks like and how we get you And so many products, as you say, we talk and talk and talk about it, but we can help you get there. We can explain it bite-sized chunks and don't... worry about appearing foolish because the reason so successful is that we as are fallible and they know to target. It's the same as any kind of marketing thing that people know what works and this something that works. Targeting behaviours works. And so don't feel ashamed to come to speak to us about it because you can only fix it by trying fix it. Lynn Murape: Perfect, all right. Couldn't have ended it on a better note. So further ado, thank you so, so much again, James. It has been an pleasure. James Gaskell: No problem. Thank you for having me.