Today, it has been reported that an employee of the US Geological Survey (USGS) viewing adult content at work has led to a government network being compromised by malware. Investigators have since found that the culprit had viewed over 9,000 sites at work.
“This story is a fable in how the bad actions of one employee can throw an entire network into jeopardy. And before we get on our high horse and start to think that it could never happen in the UK, remember that official data found 160 adult content requests a day from devices connected to the Houses of Parliament. In fact, in a survey we ran of 1000 UK adults, 10% of respondents openly admitted to visiting adult websites on a work device or while connected to a company network. And that’s just scratching the surface of what the average employee is up to. A further 13% admitted to downloading or viewing pirated content. Putting aside the inappropriateness of these activities, adult and pirate websites are often cesspools of malware and viruses.
“The lesson is that all organisations, government or not, cannot just assume their employees are operating appropriately online – they need to deploy solutions that monitor and control what employees are accessing on their work devices to reduce the risk of malware getting onto the corporate system. There is no way that this employee’s consumption of adult content should have only been identified retrospectively – if the USGS had taken the right measures they could have stopped this activity long before malware made it onto the network.”
“Not only has this employee earned a stinging HR rebuke, they also laid high value assets bare and put the organisation at risk. Luckily for them, The Earth Resources Observation and Science (EROS) Centre doesn’t operate any classified networks, meaning a major breach of national security was avoided. But hackers still had access to the US Geological Survey network, giving a clear indication of how fundamentally flawed the traditional approach to security is. Investigators have recommended blacklisting unauthorized websites and monitoring web usage, but this doesn’t provide the protection needed. Of course, blocking porn sites at work is a given, but how do you identify them all? Also, locking down uncategorized websites can often lead to denying access to web resources that employees actually need to use for their job. This creates friction, and users will inevitably find ways around restrictions and create black holes for security teams.
“Ultimately, this highlights that users are still the weakest link and can sometimes make stupid decisions. Threats can come anywhere, from dodgy websites to unknown email attachments and downloads. At the moment hackers need to only get it right once, because there will always be someone that will visit the wrong site or click on the wrong link. No amount of blacklisting (or HR chats) will change this, and it’s time to stop putting the burden of security on employees, because it is not their job to be the last line of defence. To do this, federal agencies should adopt layered cybersecurity defences that incorporate virtualisation-based application isolation, which allows users to open web pages, emails and documents in isolation from the host PC and network. This leaves hackers with nowhere to go and nothing to steal, allowing employees to get on with their job.”
ISBuzz Team embodies the collaborative efforts of the dedicated staff at Information Security Buzz, converging a wide range of skills and viewpoints to present a unified, engaging voice in the information security realm. This entity isn't tied to a single individual; instead, it's a dynamic embodiment of a team diligently working behind the scenes to keep you updated and secure. When you read a post from ISBuzz Team, you're receiving the most relevant and actionable insights, curated and crafted by professionals tuned in to the pulse of the cybersecurity world. ISBuzz Team - your reliable compass in the fast-evolving landscape of information security
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.