What Measures Should Be Taken for Risks Stemming from the Human Factor?

Ayşim Niksarlı, Director of Cybersecurity Consulting at Focerta, emphasizes that the human factor in cybersecurity should not be viewed solely in terms of awareness training. The growing prevalence of attacks such as “smishing” (SMS-based phishing) and “vishing” (voice-based fraud) makes it essential to enhance the level of awareness among employees.

“When we talk about the human factor, our thoughts often turn immediately to awareness training. While such training is certainly important, we are currently seeing a significant rise in fraud attempts via SMS and voice calls. Consequently, it is critical to support employees—including new hires during their onboarding—with educational content and videos specifically addressing smishing and vishing. Beyond this, however, broader foundational principles are equally vital. For instance, the ‘need-to-know’ principle—ensuring an individual has access only to the information required for their specific role and responsibilities—as well as the ‘segregation of duties’—preventing individuals from holding conflicting authorities or tasks—are fundamental concepts that, when applied, effectively reduce risks stemming from the human factor.”

The Importance of the Human Factor
The human factor plays a critical role in both the business world and daily life. In an era of rapid technological advancement, its significance has only grown. In the realm of cybersecurity, in particular, human error can pose substantial risks. For this reason, awareness training and security principles have become essential tools for managing the human factor.

The Role of Awareness Training
Awareness training ensures that employees remain informed about potential threats. New threats, such as those involving SMS or voice-based fraud, should be incorporated into the content of these training programs. Such training teaches employees how to respond to these types of threats and strengthens the organization’s security.

The Importance of Orientation Training
Orientation training for new staff members serves as an excellent opportunity to enhance security awareness. Including topics like “smishing” (SMS-based phishing) and “vishing” (voice-based phishing) in these sessions ensures that new employees are well-prepared to face such threats.