Why The Human Problem In Cybersecurity Requires A More Humane Solution

People are the biggest vulnerability in cybersecurity. But are businesses doing enough to control and manage this risk? Short answer, no. Looking at cybersecurity spending it becomes evident that many strategies are focused on technological controls, as cybersecurity has traditionally been perceived solely as a technology-centric function. This mindset needs a reboot. People don’t make mistakes from lack of security technology investments; they err because, well, we’re human.

Understanding The Social Behavior Of Human Error
Humans are flawed by design. We have biases, we are judgmental, we repeat the same mistakes over and over again. We do have free will and the ability to choose. Sometimes we’re stressed, sometimes we’re distracted, sometimes we’re tired or just overworked. The remote work situation hasn’t helped either. Most employees are juggling between home and work, leading to cognitive overload. 

Threat actors and adversaries understand these emotions and situations well. They design social engineering attacks that invoke human emotions (such as greed, fear, urgency, lust, anger, et. al.) and which solicit a reaction such as clicking a link, visiting a website, entering credentials, downloading an attachment or application. 

Humans are also fairly predictable. For instance, many users apply simple and common passwords that can be easily guessed or hacked. It’s also not uncommon to reuse passwords across multiple accounts. Attackers are well familiar with these habits -- either they attack vulnerable websites and steal credentials or they simply purchase leaked credentials from underground dark web marketplaces.

There's also a prevalent lack of common cybersecurity knowledge. Even if, hypothetically, employees did possess the security know-how, gaps will generally appear between their knowledge, intention and behavior. What this means is that, even if one has the right security knowledge, it doesn’t guarantee they will pay heed to security protocols and policies. We ignore a speeding sign because we’re oblivious or we’re running late. In the same way, employees often treat cybersecurity policies, instructions and advice in the same way. 

Organizations Conduct Training, But Not Enough To Impact Behaviors
Many organizations run some form of annual security training for their staff. But let’s face it, these types of “check-the-box” training are not enough to influence overall behaviors, attitudes, feelings, perceptions and beliefs with regards to security. To influence these things organizations need to instill a positive culture of cybersecurity. Below are leading factors that support a resilient security culture:

  • Employees have an awareness and understanding of security challenges
  • Employees recognize that security is a shared responsibility
  • Security is embedded in the values of the organization
  • Employees feel safe from recrimination for reporting incidents
  • Employees consider security as part of their job description
  • Employees help colleagues become more secure
  • Employees feel comfortable asking questions to security teams
  • Employees receive monthly training or briefings

Additionally, employees should feel they are an extended part of the security team; they should value security not because they are being told to do so, but because they know that’s the right thing to do. 

How Organizations Can Build A Humane Security Culture
Following these best practices, organizations can build and sustain a culture of security:

1. Articulate the value of security: The key to engaging people is speaking in a language they understand. This means conveying that security isn’t only imperative in a crisis but is an enabler of operations, contributing to the wider success of the organization.

2. Improve Culture At the Top: Culture is infectious and driven top-down. If leadership is not fully engaged or unappreciative of the value of security, then culture will not flourish and succeed. Leadership must endorse security, promote it actively and lead by example.

3. Show Commitment: Culture isn’t static but requires ongoing commitment. This means communicating often, reminding employees of the true purpose of security, offering them tools and training, running regular phishing and social engineering attack simulations that help embed security instincts and promote best practices. 

4. Reward, Don’t Punish: Reward people for their positive contributions to security rather than applying scare tactics. An arrogant, punitive or fear-focused security team will always lead to a weak and toxic business and security culture.

5. Apply Common Sense to Policies: The quality of messaging and communications can make or break the security culture. Apply easy to follow, easy to digest policies clearly and simply defined by a supportive security staff. This can lead to deeper security bonding across the organization.

The effectiveness of your security culture hinges on the quality of your training and communications. Having concise and practical policies will foster a deeper understanding of security and cultivate stronger bonds across the organization. Humans are intelligent, adaptive, and learn over time. But humans are also emotional, unpredictable and error-prone creatures. Organizations must recognize these strengths and weaknesses and practice empathy for building a robust culture of cybersecurity.

Featured

  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • Getting in Someone’s Face

    There was a time, not so long ago, when the tradeshow industry must have thought COVID-19 might wipe out face-to-face meetings. It sure seemed that way about three years ago. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West 2024: Post-Show Recap

    ISC West 2024 is complete. And from start to finish, the entire conference was a huge success with almost 30,000 people in attendance. Read Now

    • Industry Events
    • ISC West
  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

Webinars

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3