New Strategies

Tackling the end users’ security vulnerability

• By Ryan Corey
• Nov 01, 2015

As IT security professionals, we’re great at providing our clients with firewalls, encryption software and other technological safeguards against data breaches. But, did you know that even your best-protected clients may face an even greater threat than poorly managed networks and systems? So, what exactly is this threat? It’s the end user.

The Growing End User Security Threat

End user security is a huge and growing threat. The term “end user” is defined as any person who uses organizational software or hardware to complete work tasks in any manner that falls outside of the generally accepted range of “Information Technology.”

The end user does not include those who create or edit code, manage/administer the systems or database and perform similar IT functions. In other words, the end user is the “normal” person who uses a system to do their job, long after the system has been installed and configured by IT professionals.

A survey conducted by Bronium, a firm specializing in business security, found that 72 percent of IT security professionals named end users as their biggest security problem. In addition, 80 percent of IT administrators believe that end user carelessness is a bigger threat than malware or hacking.

There are many cases of end user vulnerability. For example, the Damariscotta County Sheriff’s Department in Maine reported that malware was installed on its system when an end user “clicked a link.” Hackers demanded (and received) $300 in bitcoins for confidential records they had stolen from the system and to neutralize the malware. Additionally, hackers targeted selected employees of Fidelity National Financial of Jacksonville, Fla., with a phishing attack to secure their usernames and passwords. Credit card numbers, customer names, account numbers and driver’s license numbers were then obtained by using the pilfered credentials.

Data breaches damage an organization’s reputation, destroy customer trust, and cause deep and sometimes long-term loss of revenues. According to the yearly Data Breach Investigation Report released by Verizon in 2014, 44 million records were compromised in 2012 as the result of 621 confirmed security breaches. Not only has the number of breeches continued to rise since 2012, but so too has the magnitude and publicity of the attacks. To combat attacks from external sources, IT professionals employ a variety of technological safeguards including firewalls, data encryption and two-factor authentication protocols to prevent unauthorized access. However, such defenses are often ineffective again the most common source of breaches—the end user.

How End Users Endanger Systems

Criminals are well aware that end users are the “weak link” in the security chain, and so they frequently target users. Even the best antivirus software or firewall cannot guard against human nature. People are curious, prone to seek the most convenient method of completing a task and frequently inclined to believe that bad things only happen to other people. They often fail to recognize a potential security threat, and even if they are suspicious, they may not know the proper protocol to handle a potential risk.

Weak passwords, mobile devices, and online behavior are just some of the factors that contribute to end users providing attackers with access to an enterprise’s system.

Although debate still rages in the IT world over whether passwords are an outdated form of security, they remain the first line of defense against unauthorized access. Unfortunately, users often establish weak passwords that are easy for others to guess or that can be found by performing secondary research on a target, such as visiting the individual’s social media pages. SplashData compiles an annual list of the worst passwords that have been leaked during the previous year. Each year since 2011, the top two positions on the list have been “123456” and “password.” Other weak passwords include “access,” “LetMeIn,” and “qwerty.” People often choose the name of their favorite team or sport, the name of their child or spouse, company name or a favorite movie.

Second, mobile devices create end user security vulnerabilities. Mobilization has brought many advantages to the business world, but it has also brought security challenges. The use of smartphones, compact portable storage drives, laptops and tablets have been increasing annually. With more companies making the move to the cloud, employees armed with mobile devices can easily work from home, a client’s site or a hotel room. One problem with mobile devices is that they’re mobile, which means they can be easily misplaced, lost or stolen.

A potential hacker with even moderate skills can break a password once the hacker has physical possession of the device. Additionally, it is not uncommon for users to download sensitive files to their mobile devices so that they may complete tasks while out of the office.

Many users are fiercely loyal to a particular operating system or mobile device. They may feel that they are more productive using a Windows-driven laptop, for example, or an Android smartphone, and so they use their own devices rather than secure, business- issued phones and computers. If they download an infected file, such as a video or song from a torrent site, using a personal app, the malware can easily spread to business apps and anything else which connects to the device.

Finally, users frequently expose themselves to exploitation through their online behavior. In many cases, users are simply not educated in security, common threats or best practices.

One of the most common ways for hackers to install malware is to entice users to click on a link. The link may be included in an email that sounds perfectly legitimate, or the link may be a banner ad or “special offer” that the hacker has placed on a website. Links now very often appear in the form of a well-disguised email from either a friend or trusted source. To make matters worse, when a user mistakenly clicks on a malicious link, they often have emotions of guilt, and they tend to hide or ignore the incident.

The Solution: Culture and Learning

Eliminating the end user threat begins with educating users and making them aware of security issues and best practices for mitigation. They must be prepared to deal with potential breaches when they occur. To significantly improve end user security, organizations must establish a security-based culture, and they must employ a training course with a proven learning model.

So, how do you go about educating your end users and establishing a culture of security? Studies have revealed which end user security awareness learning models work best. Given that end users are often a diverse group of people that are comprised of blends of personality and learning types, conceptual and procedural learning is the most effective technique.

The best end user training includes a format made up of technical narrative delivery to teach the scenarios, technical narrative delivery to teach the responses, and then a visualization mechanism to help the end user visually capture the intended behavior conveyed in the technical data.

The problem, of course, is that enterprise security training is expensive and often cost-prohibitive for many organizations. Many people and companies alike are leveraging the power of Massive Online Open Courses or MOOCs to meet their security training purposes.

The N2grate Story

To show how end user security MOOCs can help with training costs, take a look at N2grate. N2grate is a full service Value Added Reseller that provides comprehensive pre-sales and postsales engineering services to customers in the B2G space. With a staff of approximately 30 employees, N2grate’s engineers develop solutions and determine equipment configurations ensuring interoperable, compatible solutions for their customers.

Under N2grate’s original training model, each week of end user security training cost $2,500 per employee, plus travel expenses, averaging $7,000 to $10,000 per year per employee. N2grate learned about the MOOC, Cybrary, through a local media story, and decided to enroll a few N2grate employees in Cybrary’s CCNA and Network+ classes and the Virtualization Management class, two courses employing our MOOC format.

So far, Cybrary has saved N2grate $7,000-10,000 per employee, and it’s projected that our MOOC will save them $50,000 over the next 12 months. Additionally, N2grate’s employees are able to complete the training course on their own time, which allows them to work on projects simultaneously.

Effective end user security MOOCs cover a variety of topics, but some key ones are password security, the acceptable use of mobile devices for business purposes, how to identify and respond to phishing attacks, and how to avoid “over sharing” potentially sensitive information on social media. MOOCs provide a new, lower cost solution for end user security training.

End users are considered the greatest security risk to most organizations. What steps will you take to mitigate the prime threat that your networks and data protection face?

This article originally appeared in the November 2015 issue of Security Today.