Towards the Human Information Security Firewall

Human security is often forgotten as a major information security factor. This paper explores the security issues that relate to human security and in particular the relationship to risk. The paper also uses case studies of real life security incidents to show the problems and issues that relate to a younger workforce and their lack of security awareness due to their own background and the use of social systems, such as Facebook. The paper also proposes a risk framework that can be used to understand human security issues. DOI: 10.4018/ijcwt.2011040102 International Journal of Cyber Warfare and Terrorism, 1(2), 10-17, April-June 2011 11 Copyright © 2011, IGI Global. Copying or distributing in print or electronic forms without written permission of IGI Global is prohibited. this way follow a similar pattern in their planned exploitation, first starting by conducting their own research into the type of social engineering tricks that may work and on which targets. Then it is important for them to develop rapport and trust with the users, perhaps through fake web-sites (with highly realistic designs). They will then exploit the trust they have fostered and use the information for their own ends (e.g., obtaining money from bank accounts) (Mitnick, 2002). Social Engineering is not considered as being a current security issue. Unfortunately, information technology and the related security threats and vulnerabilities change so quickly that it has become almost impossible to keep end-users abreast of these developments. Another, more effective means of preparing end-users to form part of an effective ‘human firewall’ need to be defined and instituted. The traditional, ad hoc approaches to information security awareness, training and/or education might not be the answer any more. Therefore, the objective of this paper is to identify whether an alternative approach to prepare end-users for their role as fellow information security custodians is possible. The next section will have a detailed look at the current state of information security awareness, training and education as well as some concerns in this regard. A short description of risk assessment will follow and how it can possibly contribute to the secure behavior of end-users. This will be followed by a proposal to educate end-users as risk assessors in the attempt to make them fellow information security custodians and part of the ‘human firewall’. INFORMATION SECURITY AWARENESS TODAY Information Security Awareness is a well established term today. If most employees are educated and made aware of security threats and vulnerabilities, it is like expanding the information security department into the whole company (Hight, 2005). Although the term Information Security Awareness is used in many different forms, for the purposes of this paper, it is seen as including all aspects related to security awareness, training and education. Information Security Awareness has become a key component of sound industry good practice for information security (ENISA, 2007) and most organisations today do have some form of awareness (PriceWaterhouseCoopers, 2008). It is defined by the Information Security Forum as; “an ongoing process of learning that is meaningful to recipients, and delivers measurable benefits to the organisation from lasting behavioral change. ” (ENISA, 2007). Two important factors that can be highlighted from this definition are; firstly, it must be ongoing and secondly, it must lead to behavioral change. The PwC Information Security Breaches Survey of 2008 (PriceWaterhouseCoopers, 2008) reported that only about forty percent of companies provide ongoing awareness training to staff. This can be interpreted that most companies that do perform some form of awareness training do not conduct this on an ongoing basis. Taking into account that information technology is advancing at an alarming rate, the protection thereof obviously remains a ‘moving target’. One example is that more users are nowadays using mobile and wireless technology to link to company information resources and it is a well known fact that these technologies have introduced numerous new security threats and vulnerabilities. This situation can be compared to a virus control software package that is very quickly outdated and hopeless if it is not continuously updated and catering for the latest virus threats and vulnerabilities. For this reason it can be argued that any form of information security awareness should be taking place on a continual basis. The definition of Information Security Awareness above also pointed out that a behavioral change should take place amongst those that were made security aware. It is a general principle that a more educated person makes better decisions (Hight, 2005). Thus, the awareness exercise should influence the behavior of the end-users and security related actions taken. It is important to note that the main objective of 6 more pages are available in the full version of this document, which may be purchased using the "Add to Cart" button on the product's webpage: www.igi-global.com/article/towards-human-informationsecurity-firewall/64310? camid=4v1 This title is available in InfoSci-Journals, InfoSci-Journal Disciplines Computer Science, Security, and Information Technology, InfoSci-Networking, Mobile Applications, and Web Technologies eJournal Collection, InfoSci-Surveillance, Security, and Defense eJournal Collection, InfoSci-Journal Disciplines Engineering, Natural, and Physical Science. Recommend this product to your librarian: www.igi-global.com/e-resources/libraryrecommendation/? id=2