It’s a common adage that employees are the weak link in corporate cybersecurity. But I believe they are also the best defense, if they are given policies that are easy to follow and not too numerous and complex. Employee security training and best practices need to be user friendly and simple to be effective.
Cyber attackers don’t need to have advanced hacking skills to break into corporate networks; they just need to know how to trick people into opening attachments and clicking on links. Phishing attacks are the cause of 90% of all data breaches and security incidents. Clearly, employees are the main gateway into the organization for attackers. As a result, they are also the first line of defense. The Verizon report found that employee notifications are the most common way organizations discover cyberattacks. So arming these “sentry” employees with information they need to identify attacks is a critical part of a company’s overall security program — and yet most companies fail at this.
Security Shortcuts
One of the big reasons security rules often don’t work is because they are so complex they drive people to take shortcuts that defeat their purpose. For example, password policies are so complicated and inconvenient that most employees just ignore them. Employees are told to change passwords frequently, but researchers have found that when people are required to come up with new passwords every three months they tend to do things like merely capitalizing the first letter or adding a number on the end to save time. This makes passwords increasingly easier to crack. Being creative gets exhausting when you have to do it repeatedly, yet most companies force this on employees for the sake of security.
Another example of a self-defeating security policy is requiring long and complex passwords. We’re constantly being told to come up with complicated passwords, ideally strings of passphrases that incorporate numerals, uppercase letters, and symbols. When faced with this task, many employees will simply ignore the policy or create a long password that can’t easily be remembered so they write it on a post it note attached to the monitor. Again, these are practices that provide a false sense of security for the organization.
These historical password guidelines are finally being challenged now that they have proven to be ineffective for most organizations. The U.S. National Institute of Standards and Technology (NIST) recently changed its guidelines to reflect this reality, and now recommends getting rid of rules that complicate password practices for end users, such as requiring frequent password resets. They recommend allowing the use of password managers, and allowing people to paste passwords into fields. They also recommend multi-factor authentication, such as codes sent to smartphones and key fobs.
Teachable Moments
Another reason internal cybersecurity practices don’t work is that employees are so overwhelmed with guidance and information about things they should and shouldn’t do that they can’t digest it all. They are shuttled into mandatory half-day security training sessions, at which they often spend time staring at their phones or pretending to pay attention. It’s too much information to expect someone to absorb and remember, but for IT, it serves a purpose: enabling admins to report back to their department heads that they have trained employees on security best practices. It’s a compliance action that isn’t effective and wastes employee time.
I advise IT admins to instead do what hackers do to be effective — customize their work as much as possible. For instance, the most dangerous phishing emails — spear phishing attacks that are targeted at high-value employees — work because they are customized to fool exactly the person they are sent to. Requests for tax information and fake wire transfer requests look like they are sent from the CEO or CFO to someone in the finance department using the appropriate language. People fall for them because attackers have paid attention to detail. IT departments should follow the same playbook and use customized training and guidance rather than general and comprehensive trainings for all employees. I refer to this technique as “teachable moments” because it provides targeted information to specific individuals in a way and time they are most likely to be receptive to and able to learn from.
Most internal security tests are too broad and unfocused. For example, IT departments tend to do phishing tests by sending out the same fake email to all employees. Personally I don’t think these are appropriate for all organizations. “Testing your users” requires a lot of framing and engagement to ensure that it doesn’t make employees feel untrusted, and thus reduce the trust relationship they have with their security team.
The same principle holds true for third party sharing and collaboration services, such as Slack and Dropbox. When we try to block these common tools, often the user will find and use a different one which IT failed to block. If IT instead identifies when they use the service, and provides targeted guidance on how to use it securely, or offers a corporate subscription with security education, they can make a far bigger impact.
A Culture of Openness
An often overlooked aspect of employee security practices is the relationship between the employee and the IT department and security team. In most organizations, employees view the security team as the traffic cops of the enterprise who are constantly telling them they can’t do something they want to do, like download an external software program. Employees complain about delayed IT responses to help desk tickets and there tends to be an adversarial relationship there. This situation needs to change if organizations want to improve the security practices of employees. The security and IT teams need to be seen as trusted and helpful advisors to employees, instead of as regulators.
The best way to change this dynamic is to increase the opportunities for interaction between employees and IT. This can be in the form of office hours, when employees can seek help and information for IT and security issues and not be treated as an annoyance. And IT can be more proactive about getting to know employees and finding out what they are experiencing by mingling more among employees, instead of just showing up when someone requests something.
The single most important thing companies can do is improve the relationship between IT and employees, who are the closest to the data and devices, and thus in the best position to discover and report security anomalies and incidents. Getting to know the employees, what their roles are, and how they work with technology, will increase the chance that they will report security issues and be more conscientious in their security practices. It also can help provide IT the information they need to tailor their security education and testing efforts to individuals. It will take collaboration like this within the organization to really change peoples’ habits and make a difference in keeping organizations safe.