Are HR Employees The Most Likely Target for Threat Actors?

Written by Ben Canner, enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity.

Here’s a question haunting CISOs, IT security team members, and other decision makers regarding cybersecurity: what department in your enterprise is the most vulnerable to a digital threat?

Employees are well-known to be the largest attack vector in any enterprise’s digital surface. The prevalence (and continuing success) of phishing attacks and social engineering serves as proof of this. If the most vulnerable employees and departments could be more adequately protected, your entire enterprise could breathe a much needed sigh of relief.

Most cybersecurity observers and experts would assume their finance departments are threat actors’ primary target. Granted, finance is certainly a lucrative and popular target. Hackers often will send phishing emails to finance team members, hoping they will fill fulfill false invoices without realizing the deception. However, the most likely digital threat target in your enterprise may surprise you; it’s likely your HR department.

Your HR department handles some of the most sensitive information in your enterprise: employees’ social security numbers, tax information, salary information, etc. Much of the information these professionals collect from employees is personal and sensitive, so it needs to be treated differently than other types of data. According to the Verizon 2018 Data Breach Investigations Report, a phishing email to the HR department could give hackers the tools to file false tax returns. Hackers could then direct the subsequent fraudulent tax refunds to their own bank accounts, causing potential losses in the hundreds of thousands.

Talent Management Software (TMS) is a software tool used by HR professionals to manage employees within an organization. Closely related to HR software, Gartner Inc., defines TMS as an integrated set of applications that support an organization’s need to plan, attract, develop, reward, engage and retain talent. Such applications include workforce planning, talent acquisition & onboarding, performance appraisal/assessment, goal management, learning management, competency management, career development, succession management & compensation management.

On the topic of cybersecurity, a talent management system is what is at risk when thinking about data breaches or hackers. So when searching, evaluating and choosing a talent management tool, be sure to select a TMS vendor that takes data protection and data privacy regulations very seriously.

Indeed, the Verizon 2018 Data Breach report has noted a worrying uptick in HR department-directed attacks in 2018. In their article on the matter, Business Insider attributes the increase in attacks to a lack of cybersecurity training for HR employees. This reinforces the constant cybersecurity refrain that every employee receives continual and engaging cybersecurity training.

The digital marketplace is a perilous place, and every employee (including your HR department) needs the tools to conduct themselves safely while working within it. Cybersecurity training is a short-term and long-term investment, the benefits of which can be felt for years to come.

Here are some quick, easy ways to ensure HR data security:

1. Create an HR folder and set access permissions
2. Gather and collect employee data via an SSL-enabled form (secure sockets layer)
3. Encrypt employee data stored in the talent management system

Looking for more? Download our talent management buyers guide and check out the top-24 products available in the market with full page vendor profiles, key capabilities and questions to ask yourself and the vendor before purchasing a talent management solution. For those just starting the talent management software search process, this is truly the best resource to help get you going.

And don’t forget to follow us on Twitter, LinkedIn and Facebook for all the latest in Work Tech space!