Why The Human Problem In Cybersecurity Requires A More Humane Solution

People are the biggest vulnerability in cybersecurity. But are businesses doing enough to control and manage this risk? Short answer, no. Looking at cybersecurity spending it becomes evident that many strategies are focused on technological controls, as cybersecurity has traditionally been perceived solely as a technology-centric function. This mindset needs a reboot. People don’t make mistakes from lack of security technology investments; they err because, well, we’re human.

Understanding The Social Behavior Of Human Error
Humans are flawed by design. We have biases, we are judgmental, we repeat the same mistakes over and over again. We do have free will and the ability to choose. Sometimes we’re stressed, sometimes we’re distracted, sometimes we’re tired or just overworked. The remote work situation hasn’t helped either. Most employees are juggling between home and work, leading to cognitive overload. 

Threat actors and adversaries understand these emotions and situations well. They design social engineering attacks that invoke human emotions (such as greed, fear, urgency, lust, anger, et. al.) and which solicit a reaction such as clicking a link, visiting a website, entering credentials, downloading an attachment or application. 

Humans are also fairly predictable. For instance, many users apply simple and common passwords that can be easily guessed or hacked. It’s also not uncommon to reuse passwords across multiple accounts. Attackers are well familiar with these habits -- either they attack vulnerable websites and steal credentials or they simply purchase leaked credentials from underground dark web marketplaces.

There's also a prevalent lack of common cybersecurity knowledge. Even if, hypothetically, employees did possess the security know-how, gaps will generally appear between their knowledge, intention and behavior. What this means is that, even if one has the right security knowledge, it doesn’t guarantee they will pay heed to security protocols and policies. We ignore a speeding sign because we’re oblivious or we’re running late. In the same way, employees often treat cybersecurity policies, instructions and advice in the same way. 

Organizations Conduct Training, But Not Enough To Impact Behaviors
Many organizations run some form of annual security training for their staff. But let’s face it, these types of “check-the-box” training are not enough to influence overall behaviors, attitudes, feelings, perceptions and beliefs with regards to security. To influence these things organizations need to instill a positive culture of cybersecurity. Below are leading factors that support a resilient security culture:

  • Employees have an awareness and understanding of security challenges
  • Employees recognize that security is a shared responsibility
  • Security is embedded in the values of the organization
  • Employees feel safe from recrimination for reporting incidents
  • Employees consider security as part of their job description
  • Employees help colleagues become more secure
  • Employees feel comfortable asking questions to security teams
  • Employees receive monthly training or briefings

Additionally, employees should feel they are an extended part of the security team; they should value security not because they are being told to do so, but because they know that’s the right thing to do. 

How Organizations Can Build A Humane Security Culture
Following these best practices, organizations can build and sustain a culture of security:

1. Articulate the value of security: The key to engaging people is speaking in a language they understand. This means conveying that security isn’t only imperative in a crisis but is an enabler of operations, contributing to the wider success of the organization.

2. Improve Culture At the Top: Culture is infectious and driven top-down. If leadership is not fully engaged or unappreciative of the value of security, then culture will not flourish and succeed. Leadership must endorse security, promote it actively and lead by example.

3. Show Commitment: Culture isn’t static but requires ongoing commitment. This means communicating often, reminding employees of the true purpose of security, offering them tools and training, running regular phishing and social engineering attack simulations that help embed security instincts and promote best practices. 

4. Reward, Don’t Punish: Reward people for their positive contributions to security rather than applying scare tactics. An arrogant, punitive or fear-focused security team will always lead to a weak and toxic business and security culture.

5. Apply Common Sense to Policies: The quality of messaging and communications can make or break the security culture. Apply easy to follow, easy to digest policies clearly and simply defined by a supportive security staff. This can lead to deeper security bonding across the organization.

The effectiveness of your security culture hinges on the quality of your training and communications. Having concise and practical policies will foster a deeper understanding of security and cultivate stronger bonds across the organization. Humans are intelligent, adaptive, and learn over time. But humans are also emotional, unpredictable and error-prone creatures. Organizations must recognize these strengths and weaknesses and practice empathy for building a robust culture of cybersecurity.

Featured

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX
  • Nothing Artificial About this Intelligence

    I have been looking forward to this year’s GSX show in New Orleans, the Cresent City, or if you prefer The Big Easy. It seems like quite a while since we’ve been here. Twenty years ago, ASIS, as it was known then was literally washed out of the city by someone known as Katrina. It is a good thing to come back to NOLA. Read Now

  • From Monitors to Mission Control

    Security Operations Centers (SOC) were once defined by rows of static monitors, each displaying a single feed with operators quietly watching for issues. That model has become obsolete. Incidents evolve too quickly, data comes from multiple locations, and decisions must be made in seconds—not minutes. Read Now

  • New Gas Monkey Garage Venue Uses AI-Enhanced Video Technology

    Gas Monkey Garage, the automotive custom shop and entertainment brand founded by Richard Rawlings of Fast N’ Loud TV fame, has opened a vibrant new restaurant and bar in South Dakota, equipped with advanced, AI-enhanced video tech from IDIS Americas. Read Now

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.