{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/human-error","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/human-error/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/human-error/"},"term":{"en":"Human error","da":"Menneskelig fejl"},"aka":{"en":["accidental insider","user error"],"da":["insiderfejl","brugerfejl"]},"domain":["security"],"cluster":"fundamentals","layer":"people","status":"current","summary":{"en":"An honest mistake by a person - a wrong click, a lost laptop, a file sent to the wrong address - that harms security.","da":"En ærlig fejl begået af et menneske - et forkert klik, en tabt bærbar, en fil sendt til den forkerte - der skader sikkerheden."},"body":{"formal":{"en":"A threat in which someone with legitimate access causes harm without meaning to, for example by setting a system up wrongly, sharing data with the wrong person or losing a device.","da":"En trussel, hvor en person med lovlig adgang gør skade uden at ville det, fx ved at sætte et system forkert op, dele data med den forkerte eller miste en enhed."},"plain":{"en":"Like leaving the front door unlocked by accident - nobody planned a break-in, but the house is open all the same.","da":"Som at glemme at låse hoveddøren - ingen havde planlagt et indbrud, men huset står åbent alligevel."},"inPractice":{"en":"An HR assistant at a Danish engineering firm sends a file of salaries to an outside email address with a similar name; the firm must handle it as a data breach and, given the risk to staff, report it to the authority within 72 hours.","da":"En HR-assistent i en dansk ingeniørvirksomhed sender et regneark med lønninger til en ekstern mailadresse med et lignende navn; virksomheden skal håndtere det som et databrud og, fordi det udgør en risiko for medarbejderne, anmelde det til Datatilsynet inden for 72 timer."},"whyItMatters":{"en":"Many incidents start with a mistake, not an attacker, so good design, training and simple routines prevent a large share of harm.","da":"Mange hændelser starter med en fejl og ikke en angriber, så godt design, træning og enkle rutiner forhindrer en stor del af skaderne."}},"deepDive":{"en":"Safety science gives the most useful vocabulary. James Reason's taxonomy in \"Human Error\" (1990) distinguishes slips (the right intention, wrongly executed, such as picking the wrong autocomplete suggestion), lapses (memory failures, such as forgetting to revoke a leaver's access), and mistakes, where the plan itself is wrong, either rule-based (applying a familiar rule in the wrong situation) or knowledge-based (improvising in an unfamiliar one, such as misreading a firewall rule set). Violations are deliberate deviations from rules, usually well-meant shortcuts under time pressure rather than malice, and they sit on the boundary between error and intentional insider behaviour. The distinction matters because each type has a different remedy: slips and lapses are reduced by design and automation, mistakes by training and better information, and routine violations by removing the pressure or friction that causes them.\n\nIn security incidents the dominant error patterns are misdelivery of email, letters and files; misconfiguration, such as publicly readable cloud storage, databases exposed without authentication or overly broad sharing links; publishing personal data by mistake on a website; loss of devices and paper; and failed changes that take systems down. Several of these are latent conditions in Reason's sense, sitting unnoticed for months until someone finds them, which is why misconfiguration is often discovered by outside researchers or attackers scanning the internet.\n\nError-tolerant design treats the error as expected. Examples are external-recipient warnings and delayed send in mail clients, DLP rules that block or quarantine messages containing CPR numbers, secure defaults and policy-as-code that prevent public storage buckets, two-person review and staged rollout for infrastructure changes, full-disk encryption and remote wipe so a lost laptop does not become a breach, and undo, versioning and soft delete. Blaming individuals tends to suppress reporting, while a just culture that separates honest error from recklessness improves detection.\n\nRegulatorily, intent is irrelevant. A misdirected email containing personal data is a personal data breach under GDPR Art. 4(12), and the controller must assess it and notify Datatilsynet within 72 hours under Art. 33(1) unless it is unlikely to result in a risk to data subjects, and inform them under Art. 34 if the risk is high; every breach must also be documented internally under Art. 33(5). Human error is the unintentional branch of insider threat, as distinct from malicious insiders, and it differs from social engineering, where the error is induced by an attacker who exploits the human factor.","da":"Sikkerhedsvidenskaben giver det mest brugbare ordforråd. James Reasons taksonomi i \"Human Error\" (1990) skelner mellem slips (den rigtige hensigt udført forkert, fx at vælge det forkerte autocomplete-forslag), lapses (hukommelsessvigt, fx at glemme at fjerne en fratrådt medarbejders adgang) og mistakes, hvor selve planen er forkert, enten regelbaseret (en velkendt regel anvendt i den forkerte situation) eller vidensbaseret (improvisation i en ukendt situation, fx fejllæsning af et firewall-regelsæt). Violations er bevidste afvigelser fra reglerne, som regel velmente genveje under tidspres snarere end ondsindethed, og de ligger på grænsen mellem fejl og forsætlig insideradfærd. Skellet er vigtigt, fordi hver type har sit eget middel: slips og lapses mindskes med design og automatisering, mistakes med træning og bedre information, og rutinemæssige violations ved at fjerne det pres eller den friktion, der skaber dem.\n\nI sikkerhedshændelser er de dominerende fejlmønstre fejlforsendelse af mails, breve og filer; fejlkonfiguration som offentligt læsbar cloudlagring, databaser eksponeret uden autentificering eller for brede delingslinks; utilsigtet offentliggørelse af personoplysninger på en hjemmeside; tab af enheder og papir; og fejlslagne ændringer, der lægger systemer ned. Flere af disse er latente tilstande i Reasons forstand, som ligger ubemærket hen i måneder, indtil nogen finder dem, og derfor opdages fejlkonfigurationer ofte af eksterne forskere eller angribere, der scanner internettet.\n\nFejltolerant design behandler fejlen som forventelig. Eksempler er advarsler om eksterne modtagere og forsinket afsendelse i mailklienter, DLP-regler, der blokerer eller sætter mails med CPR-numre i karantæne, sikre standardindstillinger og policy-as-code, der forhindrer offentlige storage buckets, firøjneprincip og trinvis udrulning ved infrastrukturændringer, fuld diskkryptering og fjernsletning, så en tabt bærbar ikke bliver et databrud, samt fortryd, versionering og blød sletning. At placere skyld hos den enkelte har en tendens til at undertrykke indrapportering, mens en just culture, der skelner mellem ærlige fejl og hensynsløshed, forbedrer opdagelsen.\n\nRegulatorisk er hensigten uden betydning. En fejlsendt mail med personoplysninger er et brud på persondatasikkerheden efter GDPR art. 4, nr. 12, og den dataansvarlige skal vurdere det og anmelde det til Datatilsynet inden for 72 timer efter art. 33, stk. 1, medmindre det sandsynligvis ikke indebærer en risiko for de registrerede, og underrette dem efter art. 34, hvis risikoen er høj; alle brud skal desuden dokumenteres internt efter art. 33, stk. 5. Menneskelige fejl er den utilsigtede gren af insidertrusler, til forskel fra ondsindede insidere, og adskiller sig fra social engineering, hvor fejlen fremkaldes af en angriber, der udnytter den menneskelige faktor."},"edges":[{"type":"requires","to":"security/human-factor","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/insider-threat","confidence":"high","strength":"normal"},{"type":"causes","to":"security/security-incident","confidence":"high","strength":"normal"},{"type":"causes","to":"security/data-breach","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste (Trussel - insiderfejl)","tier":"course-material"},{"title":"ISO/IEC 27005:2022","tier":"standard"}],"draft":true}