How CISOs can protect against employees’ psychological vulnerabilities
The majority of cyberattacks rely on social engineering to gain access, steal data or resources, and trick victims into doing cybercriminals’ bidding. This is why cybercriminals deploy a wide range of coercive tactics designed to deceive and manipulate employees by preying on their psychological vulnerabilities.
In our recent CISO’s Guide to Social Engineering Susceptibilities , we examine each of the seven major elements of human psychology that hackers exploit: fear, obedience, greed, opportunity, sociableness, urgency, and curiosity. Beyond giving CISOs a deeper understanding of how cybercriminals leverage each of these vulnerabilities, the report focuses on using cybersecurity awareness training (CSAT) to help employees recognize when they’re being targeted and take action to prevent a breach.
Get Your Copy
Let’s briefly explore the seven main vulnerabilities and consider how CISOs can mitigate them with the right training.
Fear is among the most powerful motivators cybercriminals use. They impersonate company leaders, law enforcement officials, and other authority figures to frighten employees into doing what they say (note the overlap with obedience). Cybercriminals also threaten to expose private information, shut down critical systems, and cause harm in countless other ways. Effective CSAT teaches employees to be on the lookout for threatening language, a sense or urgency, and other appeals to fear.
Obedience can be a dangerous psychological trait because it makes victims susceptible to intimidation and compliant with malicious demands. Cybercriminals often instrumentalize the fear of punishment when they order employees to provide sensitive information, resources, or access. This is why CISOs need to warn employees to question assertions of authority – especially when suspicious requests are involved.
It’s natural for human beings to crave recognition and resources, which is why cybercriminals often manipulate victims by offering rewards. Many people have fallen for get-rich-quick schemes, assurances that their debts will be eliminated, and other scams that leverage greed and the fear of losing money. CSAT should provide real-world examples of this tactic in action (phishing attacks, for instance) and prepare employees to resist it.
Opportunity is often a psychological corollary of fear and greed – employees don’t want to miss out on the chance to make a lucrative investment or advance their careers. Employees can also view demands from the boss as opportunities to demonstrate their value to the company. CISOs need to remind employees that perceived opportunities can severely cloud their judgment.
Sociableness is one of the most fundamental aspects of human psychology, and cybercriminals know how to exploit it – from developing trust-based relationships with victims to scraping their data from social media sites. CSAT can show employees how cybercriminals leverage fake relationships to deceive victims while reminding them to be careful about what they post online and verify the identities of their interlocutors.
Urgency is one of the most potent psychological weapons cybercriminals possess. When victims are told that they must act immediately to avoid serious consequences, it’s much more difficult for them to make rational judgments (fear and obedience can be activated quickly in these scenarios). CISOs should show employees how cybercriminals manufacture a sense of urgency to manipulate their behavior.
Curiosity often leads employees to click on corrupt links, download malicious files, and engage in many other hazardous behaviors. Cybercriminals know how to seize victims’ attention with flashy offers and other tempting promises, which is why CISOs should remind employees to keep their curiosity in check.
While employees have different psychological risk factors depending on their personalities and behavioral patterns, these vulnerabilities often intersect and put the company at risk in multiple ways. The best way to mitigate these risks is with a comprehensive CSAT platform that covers all psychological vulnerabilities while accounting for individual differences between learners.
