Why The Human Problem In Cybersecurity Requires A More Humane Solution

People are the biggest vulnerability in cybersecurity. But are businesses doing enough to control and manage this risk? Short answer, no. Looking at cybersecurity spending it becomes evident that many strategies are focused on technological controls, as cybersecurity has traditionally been perceived solely as a technology-centric function. This mindset needs a reboot. People don’t make mistakes from lack of security technology investments; they err because, well, we’re human.

Understanding The Social Behavior Of Human Error
Humans are flawed by design. We have biases, we are judgmental, we repeat the same mistakes over and over again. We do have free will and the ability to choose. Sometimes we’re stressed, sometimes we’re distracted, sometimes we’re tired or just overworked. The remote work situation hasn’t helped either. Most employees are juggling between home and work, leading to cognitive overload. 

Threat actors and adversaries understand these emotions and situations well. They design social engineering attacks that invoke human emotions (such as greed, fear, urgency, lust, anger, et. al.) and which solicit a reaction such as clicking a link, visiting a website, entering credentials, downloading an attachment or application. 

Humans are also fairly predictable. For instance, many users apply simple and common passwords that can be easily guessed or hacked. It’s also not uncommon to reuse passwords across multiple accounts. Attackers are well familiar with these habits -- either they attack vulnerable websites and steal credentials or they simply purchase leaked credentials from underground dark web marketplaces.

There's also a prevalent lack of common cybersecurity knowledge. Even if, hypothetically, employees did possess the security know-how, gaps will generally appear between their knowledge, intention and behavior. What this means is that, even if one has the right security knowledge, it doesn’t guarantee they will pay heed to security protocols and policies. We ignore a speeding sign because we’re oblivious or we’re running late. In the same way, employees often treat cybersecurity policies, instructions and advice in the same way. 

Organizations Conduct Training, But Not Enough To Impact Behaviors
Many organizations run some form of annual security training for their staff. But let’s face it, these types of “check-the-box” training are not enough to influence overall behaviors, attitudes, feelings, perceptions and beliefs with regards to security. To influence these things organizations need to instill a positive culture of cybersecurity. Below are leading factors that support a resilient security culture:

  • Employees have an awareness and understanding of security challenges
  • Employees recognize that security is a shared responsibility
  • Security is embedded in the values of the organization
  • Employees feel safe from recrimination for reporting incidents
  • Employees consider security as part of their job description
  • Employees help colleagues become more secure
  • Employees feel comfortable asking questions to security teams
  • Employees receive monthly training or briefings

Additionally, employees should feel they are an extended part of the security team; they should value security not because they are being told to do so, but because they know that’s the right thing to do. 

How Organizations Can Build A Humane Security Culture
Following these best practices, organizations can build and sustain a culture of security:

1. Articulate the value of security: The key to engaging people is speaking in a language they understand. This means conveying that security isn’t only imperative in a crisis but is an enabler of operations, contributing to the wider success of the organization.

2. Improve Culture At the Top: Culture is infectious and driven top-down. If leadership is not fully engaged or unappreciative of the value of security, then culture will not flourish and succeed. Leadership must endorse security, promote it actively and lead by example.

3. Show Commitment: Culture isn’t static but requires ongoing commitment. This means communicating often, reminding employees of the true purpose of security, offering them tools and training, running regular phishing and social engineering attack simulations that help embed security instincts and promote best practices. 

4. Reward, Don’t Punish: Reward people for their positive contributions to security rather than applying scare tactics. An arrogant, punitive or fear-focused security team will always lead to a weak and toxic business and security culture.

5. Apply Common Sense to Policies: The quality of messaging and communications can make or break the security culture. Apply easy to follow, easy to digest policies clearly and simply defined by a supportive security staff. This can lead to deeper security bonding across the organization.

The effectiveness of your security culture hinges on the quality of your training and communications. Having concise and practical policies will foster a deeper understanding of security and cultivate stronger bonds across the organization. Humans are intelligent, adaptive, and learn over time. But humans are also emotional, unpredictable and error-prone creatures. Organizations must recognize these strengths and weaknesses and practice empathy for building a robust culture of cybersecurity.

Featured

  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West: Day 2

    What a great show ISC West 2024 has been so far. The second day on Thursday was as busy or even more hectic than the first. Remember to keep tabs on our Live From ISC West page for news and updates from the show floor at the Sands Expo, because there’s more news coming out than anyone could be expected to keep track of. Read Now

    • Industry Events
    • ISC West
  • A Unique Perspective on ISC West 2024

    Navigating a tradeshow post-knee surgery can be quite the endeavor, but utilizing an electric scooter adds an interesting twist to the experience. While it may initially feel like a limitation, it actually provides a unique perspective on traversing through the bustling crowds and expansive exhibition halls. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities 3

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3