During ongoing operations, an administrator executes a storage management command and mixes up the production and test systems. Within seconds, all production data at a site is deleted. The last complete backup is from the previous day — an entire working day of customer data and transactions is irretrievably lost.
Incorrect use or administration (G 0.31) is among the most common causes of security incidents — and the number of unreported cases is high, because many errors are covered up or not classified as security-relevant.
What’s behind it?
Every system is only as secure as the people who operate it. Operator errors occur when authorised users or administrators unknowingly ignore, circumvent or misapply security measures. The causes range from lack of training through time pressure to ergonomically poorly designed user interfaces.
Typical sources of error
- Faulty administration — Wrong configuration of firewalls, overly generous permissions, incorrect DNS entries, accidental deletion of data or systems.
- Circumvention of security measures — Users disable screen locks because they are perceived as annoying, or forward emails to private addresses to work “more flexibly”.
- Accidental data disclosure — Confidential documents are sent to wrong recipients, access rights on file shares set too broadly, cloud storage accidentally made public.
- Physical operator errors — Tripping over unprotected cables rips out connecting lines. Spilled drinks cause short circuits.
- Wrong password handling — Passwords on sticky notes on the monitor, sharing credentials with colleagues, using identical passwords for different systems.
Impact
Incorrect operation can violate all three protection goals simultaneously. Confidentiality is compromised when access rights are set wrongly. Integrity suffers when data is accidentally changed or deleted. Availability collapses when a faulty configuration command takes a service offline. The consequences can match those of a targeted attack.
Practical examples
Misconfigured firewall rule. An administrator adds a firewall rule to open a new service. Through a typo in the subnet mask, the entire internal network range is accidentally opened for access from the internet. The error remains unnoticed for a week until an automated vulnerability scan flags it.
Accidentally public cloud storage. A project group stores confidential project documents in a cloud folder. When setting up the share link, an employee accidentally selects “Anyone with the link” instead of the intended restricted share. Search engines index the folder, and the documents become publicly discoverable.
Cable damage through trip hazard. In an office, the network cable of a critical workstation is laid unprotected across the floor. An employee trips over it, the plug is ripped out of the wall socket and the network panel is damaged. The entire floor loses network connectivity for several hours until a technician repairs the panel.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 44 mapped controls below in the section ‘ISO 27001 Controls Covering This Threat’.)
Prevention:
- A.6.3 — Information security awareness, education and training: Regular training reduces operator errors due to ignorance.
- A.8.9 — Configuration management: Standardised, versioned configurations prevent ad hoc changes.
- A.5.10 — Acceptable use of information and other associated assets: Clear policies define how devices and systems are to be used.
- A.8.19 — Installation of software on operational systems: Controlled installation processes prevent faulty software configurations.
- A.7.14 — Secure disposal or re-use of equipment: Documented procedures for device lifecycle management.
Detection:
- A.8.15 — Logging: Complete logging of administrative actions makes errors traceable.
- A.8.16 — Monitoring activities: Monitoring detects unusual configuration changes and deviations from baselines.
Response:
- A.5.24 — Information security incident management planning and preparation: Procedures for handling incidents caused by misuse, including rollback.
- A.5.25 — Assessment and decision on information security events: Triage to distinguish real security incidents from harmless operator errors.
BSI IT-Grundschutz
G 0.31 is linked by the BSI IT-Grundschutz catalogue to the following modules:
- ORP.3 (Awareness and training) — Requirements for the qualification of users and administrators.
- OPS.1.1.2 (Proper IT administration) — Documented procedures and four-eyes principle for critical tasks.
- OPS.1.2.4 (Telework) — Specific risks in remote work and mobile administration.
- SYS.1.1 (General server) — Requirements for secure administration of server systems.
Sources
- BSI: The State of IT Security in Germany — Annual report with findings on human errors
- BSI IT-Grundschutz: Elementary Threats, G 0.31 — Original description of the elementary threat
- ISO/IEC 27002:2022 Section 6.3 — Implementation guidance on information security awareness and training