Human Factor Weaknesses 25 articles

Overview Credential reuse behavior refers to the practice of using the same username and password combination across multiple accounts or services. This behavior arises from user convenience or poor password…

Overview Delayed patch application due to human processes refers to the postponement or slow implementation of security updates caused by manual workflows, organizational procedures, or human error. This delay creates…

Overview Fatigue-induced operational errors refer to mistakes or lapses in judgment made by personnel due to physical or mental exhaustion. This vulnerability arises when individuals responsible for cybersecurity tasks experience…

Overview Human error in access provisioning refers to mistakes made during the process of granting, modifying, or revoking user access rights within an organization’s systems. These errors can result from…

Overview Human error in configuration changes refers to mistakes made by individuals when modifying system, network, or application settings. These errors can introduce vulnerabilities or disrupt security controls, often arising…

Overview Inadequate security training refers to insufficient or ineffective education provided to employees and stakeholders regarding cybersecurity principles, policies, and best practices. This weakness arises when organizations fail to equip…

Overview Inadequate segregation of duties awareness refers to the insufficient understanding or implementation of separating critical tasks and responsibilities among different individuals within an organization. This weakness arises when personnel…

Overview Insecure use of collaboration tools refers to the improper configuration, management, or usage of platforms designed for team communication and file sharing, which can lead to unauthorized access or…

Overview Lack of incident reporting awareness refers to the insufficient understanding or recognition among employees and stakeholders about the importance of promptly reporting security incidents. This weakness arises when organizations…

Overview Lack of security ownership refers to the absence of clearly defined responsibility for cybersecurity within an organization. This weakness arises when no individual or team is accountable for managing,…

Overview Misunderstanding of security responsibilities occurs when individuals or teams within an organization are unclear about their roles in maintaining cybersecurity. This confusion can arise from inadequate communication, poorly defined…

Overview Overconfidence in security controls refers to the excessive trust placed in existing security measures, leading to a false sense of protection. This vulnerability arises when organizations assume their defenses…

Overview Overreliance on automation in cybersecurity refers to the excessive dependence on automated tools and processes to detect, respond to, and manage security threats without sufficient human oversight. This weakness…

Overview Policy non-compliance refers to the failure of individuals or systems to adhere to established security policies and procedures within an organization. This weakness arises when rules designed to protect…

Overview Poor change management practices refer to inadequate or improperly controlled processes for implementing changes to IT systems, applications, or infrastructure. This weakness arises when changes are made without proper…

Overview Poor password hygiene refers to the practice of using weak, easily guessable, or reused passwords that compromise account security. This vulnerability arises when users fail to follow recommended password…

Overview Poor risk communication refers to the ineffective or inadequate sharing of information regarding cybersecurity risks within an organization or between stakeholders. This weakness arises when risk-related data is unclear,…

Overview Privilege misuse occurs when authorized users exploit their granted access rights beyond intended purposes, either intentionally or unintentionally. This vulnerability arises from excessive, inappropriate, or poorly controlled privileges within…

Overview Security awareness gaps refer to deficiencies in an organization's or individual's understanding and recognition of cybersecurity risks and best practices. These gaps arise from insufficient training, lack of regular…

Overview Shadow IT adoption refers to the use of information technology systems, software, or services within an organization without explicit approval or knowledge of the IT department. This practice arises…