New Strategies - As IT security professionals, we’re great at providing our clients with firewalls, encryption software and other technological safeguards against data breaches.

New Strategies

Tackling the end users’ security vulnerability

As IT security professionals, we’re great at providing our clients with firewalls, encryption software and other technological safeguards against data breaches. But, did you know that even your best-protected clients may face an even greater threat than poorly managed networks and systems? So, what exactly is this threat? It’s the end user.

The Growing End User Security Threat

End user security is a huge and growing threat. The term “end user” is defined as any person who uses organizational software or hardware to complete work tasks in any manner that falls outside of the generally accepted range of “Information Technology.”

The end user does not include those who create or edit code, manage/administer the systems or database and perform similar IT functions. In other words, the end user is the “normal” person who uses a system to do their job, long after the system has been installed and configured by IT professionals.

A survey conducted by Bronium, a firm specializing in business security, found that 72 percent of IT security professionals named end users as their biggest security problem. In addition, 80 percent of IT administrators believe that end user carelessness is a bigger threat than malware or hacking.

There are many cases of end user vulnerability. For example, the Damariscotta County Sheriff’s Department in Maine reported that malware was installed on its system when an end user “clicked a link.” Hackers demanded (and received) $300 in bitcoins for confidential records they had stolen from the system and to neutralize the malware. Additionally, hackers targeted selected employees of Fidelity National Financial of Jacksonville, Fla., with a phishing attack to secure their usernames and passwords. Credit card numbers, customer names, account numbers and driver’s license numbers were then obtained by using the pilfered credentials.

Data breaches damage an organization’s reputation, destroy customer trust, and cause deep and sometimes long-term loss of revenues. According to the yearly Data Breach Investigation Report released by Verizon in 2014, 44 million records were compromised in 2012 as the result of 621 confirmed security breaches. Not only has the number of breeches continued to rise since 2012, but so too has the magnitude and publicity of the attacks. To combat attacks from external sources, IT professionals employ a variety of technological safeguards including firewalls, data encryption and two-factor authentication protocols to prevent unauthorized access. However, such defenses are often ineffective again the most common source of breaches—the end user.

How End Users Endanger Systems

Criminals are well aware that end users are the “weak link” in the security chain, and so they frequently target users. Even the best antivirus software or firewall cannot guard against human nature. People are curious, prone to seek the most convenient method of completing a task and frequently inclined to believe that bad things only happen to other people. They often fail to recognize a potential security threat, and even if they are suspicious, they may not know the proper protocol to handle a potential risk.

Weak passwords, mobile devices, and online behavior are just some of the factors that contribute to end users providing attackers with access to an enterprise’s system.

Although debate still rages in the IT world over whether passwords are an outdated form of security, they remain the first line of defense against unauthorized access. Unfortunately, users often establish weak passwords that are easy for others to guess or that can be found by performing secondary research on a target, such as visiting the individual’s social media pages. SplashData compiles an annual list of the worst passwords that have been leaked during the previous year. Each year since 2011, the top two positions on the list have been “123456” and “password.” Other weak passwords include “access,” “LetMeIn,” and “qwerty.” People often choose the name of their favorite team or sport, the name of their child or spouse, company name or a favorite movie.

Second, mobile devices create end user security vulnerabilities. Mobilization has brought many advantages to the business world, but it has also brought security challenges. The use of smartphones, compact portable storage drives, laptops and tablets have been increasing annually. With more companies making the move to the cloud, employees armed with mobile devices can easily work from home, a client’s site or a hotel room. One problem with mobile devices is that they’re mobile, which means they can be easily misplaced, lost or stolen.

A potential hacker with even moderate skills can break a password once the hacker has physical possession of the device. Additionally, it is not uncommon for users to download sensitive files to their mobile devices so that they may complete tasks while out of the office.

Many users are fiercely loyal to a particular operating system or mobile device. They may feel that they are more productive using a Windows-driven laptop, for example, or an Android smartphone, and so they use their own devices rather than secure, business- issued phones and computers. If they download an infected file, such as a video or song from a torrent site, using a personal app, the malware can easily spread to business apps and anything else which connects to the device.

Finally, users frequently expose themselves to exploitation through their online behavior. In many cases, users are simply not educated in security, common threats or best practices.

One of the most common ways for hackers to install malware is to entice users to click on a link. The link may be included in an email that sounds perfectly legitimate, or the link may be a banner ad or “special offer” that the hacker has placed on a website. Links now very often appear in the form of a well-disguised email from either a friend or trusted source. To make matters worse, when a user mistakenly clicks on a malicious link, they often have emotions of guilt, and they tend to hide or ignore the incident.

The Solution: Culture and Learning

Eliminating the end user threat begins with educating users and making them aware of security issues and best practices for mitigation. They must be prepared to deal with potential breaches when they occur. To significantly improve end user security, organizations must establish a security-based culture, and they must employ a training course with a proven learning model.

So, how do you go about educating your end users and establishing a culture of security? Studies have revealed which end user security awareness learning models work best. Given that end users are often a diverse group of people that are comprised of blends of personality and learning types, conceptual and procedural learning is the most effective technique.

The best end user training includes a format made up of technical narrative delivery to teach the scenarios, technical narrative delivery to teach the responses, and then a visualization mechanism to help the end user visually capture the intended behavior conveyed in the technical data.

The problem, of course, is that enterprise security training is expensive and often cost-prohibitive for many organizations. Many people and companies alike are leveraging the power of Massive Online Open Courses or MOOCs to meet their security training purposes.

The N2grate Story

To show how end user security MOOCs can help with training costs, take a look at N2grate. N2grate is a full service Value Added Reseller that provides comprehensive pre-sales and postsales engineering services to customers in the B2G space. With a staff of approximately 30 employees, N2grate’s engineers develop solutions and determine equipment configurations ensuring interoperable, compatible solutions for their customers.

Under N2grate’s original training model, each week of end user security training cost $2,500 per employee, plus travel expenses, averaging $7,000 to $10,000 per year per employee. N2grate learned about the MOOC, Cybrary, through a local media story, and decided to enroll a few N2grate employees in Cybrary’s CCNA and Network+ classes and the Virtualization Management class, two courses employing our MOOC format.

So far, Cybrary has saved N2grate $7,000-10,000 per employee, and it’s projected that our MOOC will save them $50,000 over the next 12 months. Additionally, N2grate’s employees are able to complete the training course on their own time, which allows them to work on projects simultaneously.

Effective end user security MOOCs cover a variety of topics, but some key ones are password security, the acceptable use of mobile devices for business purposes, how to identify and respond to phishing attacks, and how to avoid “over sharing” potentially sensitive information on social media. MOOCs provide a new, lower cost solution for end user security training.

End users are considered the greatest security risk to most organizations. What steps will you take to mitigate the prime threat that your networks and data protection face?

This article originally appeared in the November 2015 issue of Security Today.


  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Making Safety and Security Intrinsic to School Design

    Public anxieties about school safety are escalating across the country. According to a 2023 Gallup report, 44% of parents fear for their child’s physical safety at school, a 10 percentage-point increase since 2019. Unfortunately, these fears are likely to increase if the incidence of school tragedies continues to mount. As a result, school leaders are now charged with two non-negotiable responsibilities. The first, as always, is to ensure kids have what they need to learn, grow, and thrive. Sadly, their second responsibility is to keep the children in their care safe from threats and physical danger. Read Now

  • The Power of a Layered Approach to Safety

    In a perfect world, every school would have an unlimited budget to help secure their schools. In reality, schools must prioritize what budget they have while navigating the complexities surrounding school security and lockdown. Read Now

  • How a Security System Can Enhance Arena Safety and the Fan Experience

    Ensuring guests have both a memorable experience and a safe one is no small feat for your physical security team. Stadiums, ballparks, arenas, and other large event venues are increasingly leveraging new technologies to transform the fan experience and maintain a high level of security. The goal is to preserve the integrity and excitement of the event while enhancing security and remaining “behind the scenes.” Read Now

Featured Cybersecurity


New Products

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge. 3

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3