Guarding the Gate: How Kenyan Employees Can Prevent Internal Threats and Human Error in Cybersecurity

In 2023, a major cyber incident shook a Kenyan financial institution. But unlike the typical headlines of external hackers and rogue nation-states, this breach came from within. A seemingly harmless error by an employee—an accidental click—opened the doors to a significant data leak, compromising sensitive customer information.

While external threats like hackers often steal the spotlight, internal threats and human error are just as dangerous. IBM’s 2023 Cost of a Data Breach Report found that insider threats—whether intentional or accidental—accounted for 23% of global data breaches, causing millions in losses. In Kenya, where digitization across government and corporate sectors is growing rapidly, these internal risks pose a serious challenge.

So, how can government and corporate employees play their part in reducing internal cybersecurity threats? Here are crucial tips and best practices for protecting your organization from the inside out.

1. Know the Stakes: Data Mismanagement Leads to Disaster

Every time you send an email, download a document or access a database, you’re dealing with sensitive information that could become a target for cybercriminals. Internal mishandling of data-sensitive massive consequences. In 2023, the Communications Authority of Kenya (CAK) reported that 35% of cyber incidents in the public sector were due to employees mishandling or accidentally leaking sensitive data.

What You Can Do:

• Understand the importance of data classification: Not all information is equal. Critical data like citizen records or financial information must be handled with the highest level of security.
• Review access permissions regularly: Ensure you and your team only have access to the information necessary for your roles.
• Think before you share: Whether in an email or a shared document, double-check who you’re sharing sensitive data with. Are they authorized to view it?

2. Watch for Phishing and Social Engineering: Don't Get Tricked

One of the most common internal threats is phishing. It’s not just about receiving an email from a “Nigerian prince” asking for money anymore. Phishing attacks are sophisticated and often target employees who unknowingly give hackers access to internal systems.

In 2023, phishing attacks in Kenya rose by 28%, with a significant number aimed at government and corporate employees. These emails can appear to come from trusted colleagues, vendors, or even high-ranking executives.

How to Avoid Getting Phished:

• Be skeptical of unexpected emails that ask for sensitive information or direct you to click on unfamiliar links.
• Verify the sender’s identity before responding to any suspicious email. If you’re unsure, contact the sender through a different communication channel.
• Never open attachments from unknown sources. These could contain malware that infiltrates your system.

3. Train and Retrain: Cybersecurity is Everyone’s Responsibility

Even with the best cybersecurity tools in place, the weakest link often remains human error. Lack of awareness or insufficient training can lead to disastrous mistakes. Many employees don’t fully understand how their actions—however innocent—can impact the broader cybersecurity framework of the organization.

According to the 2023 Verizon Data Breach Investigations Report, over 80% of data breaches globally were linked to employee actions. These include anything from clicking on phishing emails to using weak passwords.

How to Strengthen Employee Cybersecurity:

• Regular cybersecurity training: This should be mandatory for all employees, from junior staff to senior executives. The training should cover best practices, recognizing threats, and understanding their role in cybersecurity.
• Simulate phishing attacks: Some organizations are using mock phishing campaigns to test how employees respond. It’s a powerful tool to gauge readiness and improve response.
• Encourage reporting: Create a culture where employees feel safe reporting potential security incidents, even if they’ve made a mistake. Quick reporting can prevent small issues from becoming major breaches.

4. Strengthen Password Hygiene: Weak Passwords, Big Problems

It’s surprising how many internal threats can be traced back to weak or reused passwords. Hackers often exploit this through credential stuffing, a method where stolen passwords from one account are used to access others. 60% of breaches in the corporate sector, as reported by Verizon, were a direct result of weak or compromised credentials.

How to Improve Password Security:

• Use complex, unique passwords for every account. Passwords should include a mix of letters, numbers, and special characters.
• Enable two-factor authentication (2FA): This adds an extra layer of security by requiring a second form of verification before granting access.
• Avoid sharing passwords: Even internally, employees should never share passwords over email or messaging apps.

5. Insider Threats: Beware of Privilege Misuse

Not all internal threats are accidental. In some cases, employees—whether disgruntled or acting on behalf of malicious actors—can exploit their access to sensitive data. This is known as privilege misuse, and it can cause significant harm to an organization. 75% of insider threats are driven by employees with authorized access misusing their privileges.

How to Prevent Privilege Misuse:

• Limit access to sensitive data: Only those who need specific information to perform their job should have access. Review access permissions regularly.
• Monitor unusual employee behavior: Sudden interest in files or systems outside an employee’s scope can be a red flag. This could signal that they’re planning to misuse their access.
• Implement strict policies for data access and movement: Make sure that moving sensitive data off company devices or networks is strictly monitored and restricted.

6. Secure Remote Work: Don't Let Distance Become a Weakness

With the rise of remote work, especially in the wake of the COVID-19 pandemic, more employees are accessing sensitive systems from home. But remote work comes with its own set of challenges. Many home networks lack the robust security measures that exist within the corporate office, making employees’ devices vulnerable to attack.

In 2023, 40% of cyberattacks on Kenyan corporations involved compromised employee devices connected to unsecured home networks.

How to Secure Remote Work:

• Use VPNs (Virtual Private Networks) to encrypt internet traffic and protect data.
• Ensure all devices have updated antivirus software and are patched with the latest security updates.
• Avoid using personal devices for work: Use company-issued devices that are pre-configured with security measures.
• Implement multi-factor authentication (MFA) for access to sensitive systems when working remotely.

7. Mobile Devices: Small Tools, Big Targets

In today’s workplace, mobile devices have become indispensable for communication and productivity. But with this convenience comes risk. Mobile device breaches are becoming more common, with employees unknowingly exposing corporate or government data to cybercriminals through insecure apps or networks.

According to Check Point Research, 25% of data breaches in 2023 involved compromised mobile devices, making them one of the top targets for hackers.

How to Protect Mobile Devices:

• Lock your device with strong passwords or biometric authentication like fingerprints or facial recognition.
• Keep devices updated with the latest security patches.
• Avoid downloading unverified apps, which can serve as entry points for malware.
• Enable remote wiping: In case of loss or theft, sensitive data can be wiped remotely to prevent access by unauthorized parties.

Conclusion: It’s All in Your Hands—Literally

While technology provides strong defences, the greatest cybersecurity risks often stem from human error and insider threats. Kenyan government and corporate employees must realize that cybersecurity isn’t just an IT issue—it’s everyone’s responsibility. By adopting best practices, from creating strong passwords to identifying phishing attempts, employees can prevent accidental data leaks and protect their organizations from internal threats.

The stakes are high. Whether you’re working in a government office handling citizen data or in a corporate setting managing financial accounts, your vigilance can make the difference between a secure system and a devastating breach.

Let’s all do our part. Cybersecurity starts with you.

Let’s all do our part. Cybersecurity starts with you.

Cyber Hygiene Community