Non-human Resources

How to close the weakest link in your cyber defenses

By Camellia Chan, CEO, and Founder of X-PHY a Flexxon brand

Every cyber security professional knows that human error is the common factor behind the majority of successful cyber breaches. Software patches that are not updated, thoughtless clicking on phishing emails, tweaks to software configurations, or ‘personalized’ re-settings of anti-virus software are all too often the innocuous start of a cascading, expensive, and reputation-damaging security breach.

The extent of that human error – whether caused by malicious intent or straightforward carelessness – has most recently been quantified by the World Economic Forum (WEF). In its Global Risks Report 2022, it calculated that 95 percent of all security issues can now be traced to human error.

Of course, cyber security professionals are also extremely aware that our industry as a whole is understaffed and under-resourced. Nearly 20 percent of the WEF’s network of academic, business, government, civil society and thought leaders believe that cybersecurity failure will become a critical threat to the world in the next two years. At the same time, there is a 3 million gap in the number of cyber professionals needed worldwide.

Remote insecurity

The potential for human error has been greatly exacerbated by the pandemic and the accelerated dependence of both individual organizations and entire economies on digital systems.

Rapid digitalization accompanied by remote, and now hybrid, working has led to a proliferation of platforms and devices to make remote working possible. The corporate network has become more diffuse, its boundaries have gotten fuzzier, and sensitive data is routinely shared with a wide range of intermediaries, from cloud service providers to data aggregators and APIs, among others. The attack surface is greatly expanded.

The widespread adoption of cloud-enabled services and networks itself has also changed the typical threat vector. Threats can now flow from cloud to machine level, putting endpoint devices and their operating systems in the direct line of fire.

At the same time, remote workers are sending corporate details over their residential networks, using the same laptop and the same weak password for both personal and professional applications.

Costly inaction

With no clear barrier between work and home, a familiarly informal ‘office’ setting, and even a more relaxed dress code, the psychological factors that keep workers ever vigilant easily morph into cyber fatigue and ‘what’s the worst that can happen?’ mindset. Which is why, even with the most robust infrastructure and policies in place, major corporations can still fall.

The pandemic has certainly increased the opportunities for human error to cause indescribable damage to corporate systems. But even as a new form of normalcy returns to corporate life, the opportunities created for cybercriminals will continue to grow. The expansion of IoT-enabled devices, edge-computing, 5G and blockchain-enabled applications present new opportunities and new threats.

As these essential business tools converge and connect, as virtual 3D spaces become networked and pervasive, users – employees – will be asked to navigate inherent security vulnerabilities in complex, decentralized systems without sophisticated onboarding capabilities or structured security policies.

New vulnerabilities

On the offense, attacks proliferate as cyberthreat actors continue to take advantage both of more aggressive attack methods and lower barriers to entry. For example, ransomware-as-a-service (RaaS) gives non-technical criminals the ability to successfully penetrate a corporate network.

Now that malware can be powered by AI, the low-skill, high-reward model of cyber criminality is set to increase – particularly as the expansion of cryptocurrency usage keeps ransom payments away from scrutiny by regulated banks and law enforcement agencies.

As physical supply chains become more digitalized, those same criminals have discovered new vulnerabilities to exploit. The weakest link in any system may no longer be the error of an employee but at some technology provider or other third party down the supply chain. Cyber-attacks are therefore no longer exclusively aimed directly at a big corporation’s infrastructure, but at the smaller less well-protected companies that support and supply them.

Beyond software

Today, most cybersecurity depends on software defenses, but business leaders and their cybersecurity professionals need to update their arsenal if they wish to protect their devices and their data. By design, firmware has a better view of the system—and a greater ability to protect it. As such, security at the that level of the storage drive is the best way to minimize attacks.

This is what an AI-infused solid-state drive (SDD) can do. The AI element provides intelligent, intuitive and immediate defense by detecting anomalies in data-access patterns that typically indicate ransomware, cloning attacks, physical drive theft, and even other side-channel attacks.

Embedding AI at the firmware level, where it sits close to a user’s data, ensures real-time threat detection and protection against zero-day exploits. Data within the drive is closely protected 24/7 – making it an ideal solution for complementing software-based defenses at every participant in a supply chain.

What’s more, when developed on a zero-trust framework, only authorized and authenticated personnel can access the content within, which further serves to protect users, applications, and data from external threats. As to the SSD itself, hardware sensors can provide real-time physical protection should employee’s device be stolen, lost or tampered with.

Leading OEMs are already implementing this kind of technology in the latest models, and we can realistically expect more to arrive as businesses seek secure devices that diminish the impact of human error by minimizing the amount of human intervention needed to keep data safe. In a constantly evolving, multi-threat world, it is the last – and very necessary – line of defense.

About the Author

My Name is Camellia Chan and I am the CEO and Founder of Flexxon. Camellia Founded Flexxon in 2007 and has over 20 years of experience in the Electronics Manufacturing industry. As the CEO and founder of Flexxon, Camellia oversees the company’s business development and growth, industry partnerships, and expansion to regional and global markets. Under her leadership, Flexxon has become
a world-leading brand in providing NAND flash storage solutions across sectors; specifically in four niche areas – Cyber Security, Industrial, Medical, and Automotive (CIMA).