--- title: When It Comes to Cyber Security, The Weakest Link is Still Employees description: When It Comes to Cyber Security, The Weakest Link is Still Employees --- [![TowerWall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/head-logo-2.svg "TowerWall")](https://towerwall.com/) [![TowerWall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/towerwall-logo-white-test.svg "TowerWall")](https://towerwall.com/) - [Our Partners](https://towerwall.com/how-we-protect-you/our-technology-partners/) - Our Solutions - - Our Cybersecurity Solutions - We operationalize infosec, building security solutions that safeguard your most critical assets. - - [Solutions Overview](https://towerwall.com/cybersecurity-solutions/) - [Risk Assessments & Security Reviews](https://towerwall.com/cybersecurity-solutions/risk-assessments-security-reviews/) - [Program & Policy Development](https://towerwall.com/cybersecurity-solutions/program-policy-development/) - [Incident Response & Remediation](https://towerwall.com/cybersecurity-solutions/incident-response-remediation/) - [Managed Detection & Response](https://towerwall.com/cybersecurity-solutions/managed-detection-response/) - - [Compliance & Privacy](https://towerwall.com/cybersecurity-solutions/compliance-privacy/) - [Comprehensive Security Training](https://towerwall.com/cybersecurity-solutions/comprehensive-security-training/) - [Vulnerability Protection](https://towerwall.com/cybersecurity-solutions/vulnerability-protection/) - [Penetration Testing](https://towerwall.com/cybersecurity-solutions/penetration-testing/) - Virtual Security Officers - - Virtual Security Officer - Leverage the experience and security acumen of Towerwall’s on-demand security experts. - - [Virtual Chief Information Security Officer (VCISO)](https://towerwall.com/virtual-security-officers/virtual-chief-information-security-officer-vciso/) - [Virtual Data Protection Officer (vDPO)](https://towerwall.com/virtual-security-officers/virtual-data-protection-officer-vdpo/) - [Virtual Chief Privacy Officer (vCPO)](https://towerwall.com/virtual-security-officers/virtual-chief-privacy-officer-vcpo/) - We Advise - - We Advise - One-size security solutions only lead to failure. - Industries - [Higher Education](https://towerwall.com/industries/higher-education/) - [Financial Services & Banking](https://towerwall.com/industries/financial-services-banking/) - [Healthcare](https://towerwall.com/industries/healthcare/) - [BioPharma & Bio-Therapeutics](https://towerwall.com/industries/biopharma-bio-therapeutics/) - [Retail](https://towerwall.com/industries/retail/) - [Government](https://towerwall.com/industries/government/) - [Catholic Diocese](https://towerwall.com/industries/catholic-diocese-cybersecurity/) - [Cannabis](https://towerwall.com/industries/cannabis/) - [Small Business](https://towerwall.com/industries/small-business/) - [Enterprise](https://towerwall.com/industries/enterprise/) - Trends & Threats - [Remote Workforce](https://towerwall.com/trends-threats/remote-workforce/) - [Vendor Questionnaire](https://towerwall.com/trends-threats/vendor-questionnaire/) - [HIPAA](https://towerwall.com/trends-threats/hipaa/) - [Ransomware](https://towerwall.com/trends-threats/ransomware/) - [GDPR](https://towerwall.com/trends-threats/gdpr/) - [Cloud Security](https://towerwall.com/trends-threats/cloud-security/) - [Phishing](https://towerwall.com/trends-threats/phishing/) - [Cybersecurity Insurance](https://towerwall.com/trends-threats/cybersecurity-insurance/) - [Resources](https://towerwall.com/resources/) - - Resources - Our latest insights, events, and tools to keep you safe. - - [Insights](https://towerwall.com/resources/?resources_category=MTU%3D&focusarea=0&industries=0&search=) - [Webinars](https://towerwall.com/resources/?resources_category=MTg%3D&focusarea=0&industries=0&search=) - [Whitepapers](https://towerwall.com/resources/?resources_category=MTY%3D&focusarea=0&industries=0&search=) - [View All](https://towerwall.com/resources/) - [Company](https://towerwall.com/company/) - - Our Company - We are the industry’s leading cybersecurity preparedness partner. - - [Who We Are](https://towerwall.com/company/) - [Our Team](https://towerwall.com/company/our-team/) - [Our Approach](https://towerwall.com/our-approach/) - [Our Values](https://towerwall.com/company/our-values/) - - [Awards & Recognition](https://towerwall.com/company/awards-recognition/) - [Certifications & Affiliations](https://towerwall.com/company/certifications-affiliations/) - [Community Involvement](https://towerwall.com/company/community-involvement/) - [Careers](https://towerwall.com/company/careers/) - [Contact Us](https://towerwall.com/company/contact-us/) Topics Training, employee, cannabis, Enterprise, Gap Assessment # When It Comes to Cyber Security, The Weakest Link is Still Employees [By Michelle Drolet](https://blog.towerwall.com/author/towerwall2020) [Read More](https://blog.towerwall.com/author/towerwall2020) 2 Minute Read June 21, 2017 We need to make sure the highly regulated world of cannabis business knows how to protect its data, customer and otherwise, yet also control access to it without too much hassle. As an insurgent breed, hackers are savvy and will seek out the path of least resistance. When your defenses are good, the weak link is often your employees. Data breaches are most likely to be the result of employee error or an inside job, says the [ACC Foundation: State of Cybersecurity Report](http://www.acc.com/legalresources/resource.cfm?show=1416923). Of course you want to maintain normal operations around your firewalls, malware defenses and data protection. But all too often employees are an afterthought. ### **Don’t Let Sleeping Dogs Sleep** Some unscrupulous former employees may see an opportunity to profit. Inactive user accounts are ripe for exploitation by attackers. By using legitimate, but inactive, accounts, a former employee can easily impersonate legitimate users and mask their nefarious activity. There’s also serious potential risk involved when accounts associated with former employees or temporary contractors are not deleted when employment ends. They may be left with unauthorized access to sensitive data, which is especially dangerous if the split wasn’t amicable. ### **Simple Rules for Sleeping Dogs** There are a few simple rules you can put in place to ensure inactive accounts aren’t a potential route ***in*** for attackers or a potential route ***out*** for sensitive data. - Account access should be revoked immediately when an employee or contractor is terminated or leaves for any reason. You may prefer to disable access rather than delete accounts. - Accounts should be monitored and flagged if they don’t have an associated business process and owner. - Automatically log off users after a period of inactivity and use screen locks to guard against access via unattended computers. - Be vigilant for failed log-ins and attempts to access deactivated accounts. - Profile user behavior so that log-ins at odd times of the day or night, or log-ins from new devices, are flagged. You’ll also want to enforce multi-factor authentication wherever possible, ensure that passwords and user names are fully encrypted, and configure and authenticate centrally. Careful account monitoring is especially important at large organizations where breaches are more than twice as likely, according to that same ACC Foundation report. ### **Gap Analysis and Training to Fill Gaps** It’s easy to focus in on the technology that you need to employ to bolster your cyber security defenses and forget that people can neatly sidestep all your efforts by taking the wrong action. Perhaps your IT staff isn’t quick enough to patch or review logs. Maybe your security policies are not enforced in any meaningful way, or your employees don’t know any better than to click on a malicious link in a phishing email. Attackers will go to great lengths to exploit any weaknesses or gaps here, and in many cases, they can persuade people to effectively lower the defenses and let them in. The first thing to do here is to perform gap analysis and find where employees lack the skills required to implement your cyber security plans and policies. You have to know where they are going wrong before you can steer things rights. Provide relevant training via outside experts, or even conferences and online courses. Make learning modules bite-sized and easy to understand. They must be updated to reflect the latest threats, and employees should complete them every few months. No one should be immune from this. Senior management may be resistant, but they actually pose the greatest risk if a phishing attack is successful. They should complete the same training. ### **Putting the Fox in the Hen House** As a way to test how porous employees could be, the largest bank in the country tested staff with a fake phishing email after it suffered a data theft just a few weeks prior. Despite increasing their cyber security spend, [20 percent of these employees clicked on the bogus emai](https://www.finextra.com/news/fullstory.aspx?newsitemid=28278)l. Had it been real, that action would have downloaded a malicious payload onto the bank’s network. If you don’t take some time out to spend resources on awareness for employees and specific training where necessary, then you can unroll all your good efforts to improve your security and keep your business intact. As you can imagine, the disruption to business from an attack is no picnic. [This article was originally posted in Cannabis Business Executive >](https://www.cannabisbusinessexecutive.com/2017/06/comes-cyber-security-weakest-link-still-employees/) #### When It Comes to Cyber Security, The Weakest Link is Still Employees Back to Top ## Related Insights ### [Cybersecurity is only as strong as your weakest link—your employees](https://blog.towerwall.com/cybersecurity-strong-weakest-link-employees) Training, employee, cannabis, Enterprise, Gap Assessment ### [Scan the Dark Web for Threat Intelligence](https://blog.towerwall.com/scan-the-dark-web-for-threat-intelligence) Training, employee, cannabis, Enterprise, Gap Assessment [View All Insights](https://blog.towerwall.com) × ## Talk with us now about: #### Your security needs. - ![Phone](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/phone-icon.svg "Phone") [Call 774.204.0700](tel:774.204.0700) - ![Mail](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/mail-icon.svg "Mail") [Email Us](mailto:info@towerwall.com) ### The front line of cybersecurity.™ For over 23 years, Towerwall, a woman-owned business, has helped scores of companies safeguard their data and leverage their investment in IT with advanced information security technology solutions and services. Our experience in all facets of information security coupled with serving in the CIO/CISO/ISO roles provides a unique first-hand understanding of the security challenges organizations face daily. ### Connect - - - - - [Career Opportunities](https://towerwall.com/company/careers/) - [Contact Us](https://towerwall.com/company/contact-us/) © Towerwall, Inc. and its licensees. All rights reserved [Privacy Policy](http://towerwall.com/privacy-policy/) Sitemap [Created by Howbridge](https://meethowbridge.com/) [![Towerwall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/footer-logo.svg "Towerwall")](https://towerwall.com/)