Why The Human Problem In Cybersecurity Requires A More Humane Solution

People are the biggest vulnerability in cybersecurity. But are businesses doing enough to control and manage this risk? Short answer, no. Looking at cybersecurity spending it becomes evident that many strategies are focused on technological controls, as cybersecurity has traditionally been perceived solely as a technology-centric function. This mindset needs a reboot. People don’t make mistakes from lack of security technology investments; they err because, well, we’re human.

Understanding The Social Behavior Of Human Error
Humans are flawed by design. We have biases, we are judgmental, we repeat the same mistakes over and over again. We do have free will and the ability to choose. Sometimes we’re stressed, sometimes we’re distracted, sometimes we’re tired or just overworked. The remote work situation hasn’t helped either. Most employees are juggling between home and work, leading to cognitive overload. 

Threat actors and adversaries understand these emotions and situations well. They design social engineering attacks that invoke human emotions (such as greed, fear, urgency, lust, anger, et. al.) and which solicit a reaction such as clicking a link, visiting a website, entering credentials, downloading an attachment or application. 

Humans are also fairly predictable. For instance, many users apply simple and common passwords that can be easily guessed or hacked. It’s also not uncommon to reuse passwords across multiple accounts. Attackers are well familiar with these habits -- either they attack vulnerable websites and steal credentials or they simply purchase leaked credentials from underground dark web marketplaces.

There's also a prevalent lack of common cybersecurity knowledge. Even if, hypothetically, employees did possess the security know-how, gaps will generally appear between their knowledge, intention and behavior. What this means is that, even if one has the right security knowledge, it doesn’t guarantee they will pay heed to security protocols and policies. We ignore a speeding sign because we’re oblivious or we’re running late. In the same way, employees often treat cybersecurity policies, instructions and advice in the same way. 

Organizations Conduct Training, But Not Enough To Impact Behaviors
Many organizations run some form of annual security training for their staff. But let’s face it, these types of “check-the-box” training are not enough to influence overall behaviors, attitudes, feelings, perceptions and beliefs with regards to security. To influence these things organizations need to instill a positive culture of cybersecurity. Below are leading factors that support a resilient security culture:

  • Employees have an awareness and understanding of security challenges
  • Employees recognize that security is a shared responsibility
  • Security is embedded in the values of the organization
  • Employees feel safe from recrimination for reporting incidents
  • Employees consider security as part of their job description
  • Employees help colleagues become more secure
  • Employees feel comfortable asking questions to security teams
  • Employees receive monthly training or briefings

Additionally, employees should feel they are an extended part of the security team; they should value security not because they are being told to do so, but because they know that’s the right thing to do. 

How Organizations Can Build A Humane Security Culture
Following these best practices, organizations can build and sustain a culture of security:

1. Articulate the value of security: The key to engaging people is speaking in a language they understand. This means conveying that security isn’t only imperative in a crisis but is an enabler of operations, contributing to the wider success of the organization.

2. Improve Culture At the Top: Culture is infectious and driven top-down. If leadership is not fully engaged or unappreciative of the value of security, then culture will not flourish and succeed. Leadership must endorse security, promote it actively and lead by example.

3. Show Commitment: Culture isn’t static but requires ongoing commitment. This means communicating often, reminding employees of the true purpose of security, offering them tools and training, running regular phishing and social engineering attack simulations that help embed security instincts and promote best practices. 

4. Reward, Don’t Punish: Reward people for their positive contributions to security rather than applying scare tactics. An arrogant, punitive or fear-focused security team will always lead to a weak and toxic business and security culture.

5. Apply Common Sense to Policies: The quality of messaging and communications can make or break the security culture. Apply easy to follow, easy to digest policies clearly and simply defined by a supportive security staff. This can lead to deeper security bonding across the organization.

The effectiveness of your security culture hinges on the quality of your training and communications. Having concise and practical policies will foster a deeper understanding of security and cultivate stronger bonds across the organization. Humans are intelligent, adaptive, and learn over time. But humans are also emotional, unpredictable and error-prone creatures. Organizations must recognize these strengths and weaknesses and practice empathy for building a robust culture of cybersecurity.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Protecting Data is Critical

    To say that the Internet of Things (IoT) has become a part of everyday life would be a dramatic understatement. At this point, you would be hard-pressed to find an electronic device that is not connected to the internet. Read Now

  • Mobile Access Adoption

    Smartphones and other mobile devices have had a profound impact on how the world securely accesses the workplace and its services. The growing adoption of mobile wallets and the new generation of users is compounding this effect. Read Now

  • Changing Mindsets

    We have come a long way from the early days of fuzzy analog CCTV systems. During that time, we have had to migrate from analog to digital signals. When IP-based network cameras arrived, they opened a new world of quality and connectivity but also introduced plenty of challenges. Thankfully, network devices today have become smart enough to discover themselves and even self-configure to some degree. While some IT expertise is certainly required, things are much smoother these days. The biggest change is in how fast security cameras and supporting infrastructure are evolving. Read Now

Featured Cybersecurity

Webinars

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis. 3

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises. 3