The Employee-An Organization's Security Downfall or a Hidden Security Gem

This is a grim reality.However, as opposed to considering the employee as a security liability, I have a more optimistic perspective.These numbers are alarming, especially when we realize hackers only need one employee to fall victim in order to gain ac¬cess to an organization’s valuable data. But what is the root of our vulnerabilities? Throughout our evolution, we learned to overcome harsh natural environments by relying on each other. We learned to inherently trust others in our community because this has enabled us to survive longer. Yet, due to our social nature and our dependence on others, rooted in our nat¬ural desire to survive, we are vulnerable to lies. This is a grim reality. However, as opposed to considering the employee as a security liability, I have a more optimistic perspective.

Training, Assessing and Harnessing the Intelligence

As security professionals, we understand the importance of regular vulnerability assessments of our IT infrastructure, as well as remediation of findings to drive out risk. However, by and large, we mini¬mize

the assessment of our employee population as part of this program. Cer¬tainly, assessing and training won’t render us immune and we may still fall victim to social engineering attacks. However, evi¬dence has shown that security awareness training and behavior training systems have significantly reduced the incidence of human compromise to security related events. Taking this to the next level, we can utilize the intelligence gleaned from our organic computer assessments, to bolster an organization’s security pos¬ture. I see this as crucial element of the next wave of cybersecurity and envision a system which, among other capabilities, achieves this concept by integrating hu¬man security awareness assessments with IAM systems. For instance, even though an IAM system may authenticate a user’s identity during a user’s login request, this user may be refused access on the basis that the user has poor security awareness assessment results. With this integration, an organization’s security program is bol¬stered in that it catches more real social engineering threat attacks.

Safety in Numbers

Just as the saying goes “One Man’s Poi¬son is another Man’s Medicine”, instead of considering humans as a security li¬ability, contemplate the harnessing and utilization of human vulnerabilities for our benefit. Our natural tendency to trust and rely on others may be used to our ad¬vantage. For example, there are several existing security solutions which offer human behavior based training which enables an organization to continuously raise awareness within their employee base of the dangers of phishing. Some solutions include a feature that allows employees to notify the entire community whenever an employee becomes aware of a real phishing event. Does this seem analogous to the security in numbers of the few birds alerting the entire flock? I be¬lieve this concept need not be limited to phish¬ing, but can be used for all suspected security attacks. Imagine a web based social media ena¬bled system, inclusive of gamification, which allows all em¬ployees of an organization to share their experiences related to imminent attacks. I sense it is similar to using an employee base as a grid of organic Intrusion Detec¬tion Systems acting as a security overlay that compliments an organization’s exist¬ing security infrastructure.

Conclusion

Information security defense has become exponentially more complex and chal¬lenging. The attackers have several advan¬tages: they need not stay in one place, they may hide, time is on their side and they may leverage the susceptibility of em¬ployees in order to achieve their desired prize. As defenders, we have a disadvan¬tage in that it is difficult to continuously move our fortress to evade the attacker. A strength we must take advantage of is our ability to harness our individual hu¬man awareness to achieve a “protection in numbers”effect. This has proven success¬ful for many natural ecosystems. We de¬fenders are not fighting a losing war. We are not even part of a war; we are simply surviving within a natural, ever changing physical and virtual world.