Read Internal Auditor August 2018 online
LET OP: Vanaf 2018 dien je in je ledenprofiel van IIA Nederland aan te geven of je toegang wilt tot de digitale versie van Internal Auditor. De online versie én de app zijn gratis te bezoeken wanneer je lid bent van IIA Nederland, maar het moet wel bij ons bekend zijn dat je die toegang wilt. Je krijgt dan een IIA Global inlog zodat je op de website en in de app kunt inloggen. Lees meer
The Human Factor
"I’m a big fan of the TV series Westworld. For those who haven’t seen it, HBO’s science fiction thriller takes place in a Western-themed, no-holds-barred amusement park where guests interact with lifelike robotic hosts. The show’s many plot twists keep viewers guessing, though eventually we learn there’s much more going on than just gun fights and pleasure seeking. The park’s creators have been quietly taking advantage of guests to carry out a hidden agenda. And while the plan relies in part on Westworld’s futuristic technology, one of its main tools is simple human deception.
Beyond the realm of fiction, of course, people’s susceptibility to deception and manipulation is a real-world concern for organizations — particularly when it comes to cybersecurity. With a phone call, email, social media exchange, or in-person conversation, skilled social engineers can gain the trust of their victims to commit fraud or other organizational crimes. And as Kimberly Hagara, vice president, Audit Services, at University of Texas Medical Branch, notes in “Pulling Strings” (page 34), the attackers are becoming increasingly sophisticated. “Now the tactics are much more trust-based,” she says. “Getting into an organization or a system relies more on human interaction.”
In some cases, the attackers leverage systems access to hold the organization’s data hostage. Their success depends not only on malicious software, known as ransomware, but often on the perpetrators’ ability to deceive. According to a recent survey by security firm SentinelOne, nearly 70 percent of successful ransomware attacks in 2017 resulted from hackers gaining access to enterprise networks by phishing via email or social media.
In our cover story, “Held Hostage” (page 28), author Arthur Piper examines the risk of ransomware, how to respond to an attack, and considerations for prevention and detection. The article also stresses that employees often represent the greatest vulnerability to these types of attacks. With that in mind, risk management advice includes ensuring training is provided to all personnel and that policies on responding to ransomware incidents have been well-communicated.
Cyberattacks don’t have to be high-tech to present a real threat. Despite all the sophisticated tools available for carrying out an attack, crafty perpetrators can weasel their way through even the best defenses with simple techniques that exploit human psychology. Ironically, in the age of artificial intelligence and advanced digital security, preventing cybercrime often comes down to a deeper understanding of nontechnological, human factors. The weakest link in the security chain is often the employee who opens the door, physical or virtual, to an intruder. And when that happens, to borrow from Westworld’s season two tag line, “chaos takes control.”"
~David Salierno
