The First Step To Better Security
By: Julian Selz
Tags: Security, Information Security, Business, Tech, Cybersecurity

Fix this one thing before you even think about the latest “advanced threats.”

Securing a company in this day and age is a daunting proposition. As if it weren’t trouble enough to focus on the legal, operational, and financial concerns of running a successful business; now I have to put on my general’s hat and figure out how to defend what I’ve built from hordes of unseen attackers as well?

The traditional response to this conundrum is to “harden your environment.” Get a stronger firewall, buy a better antivirus, use a good password manager — On some days all this can feel like an exercise in futility. After all, we still hear about high-profile breaches and data leaks on an almost daily basis, often from companies we trust. Surely many of these companies, many of which are far larger than ours, have purchased these tools, hired teams and trained personnel in their use, and still they fall victim to clever cyberattacks.

With all of these fancy, high-tech solutions, why is cybersecurity still such an issue?

We’ve written in the past about how the majority of successful cyberattacks is enabled by simple human error. Here’s an example to drive the point home. Most people are familiar with the high degree of security at our banks here in Switzerland. Just the other week, a group of cybersecurity specialists devised an eye-catching way of hacking one. All they had to do was dress up in a Santa Claus outfit and tell the people at the front desk that they were there to help the HR department with a demonstration. Once inside, they had nearly free reign of the premises, the network, everything — that is, after a quick trip to the restroom to put on some normal-looking clothes.

There are two major reasons why security vulnerabilities continue to be so prevalent in the business realm, despite the massive amounts of cash and capital flowing into the sector. The first is that every system we use is managed by people. Because of this, any system we build, no matter how technologically advanced, is only as strong as the people who manage it on a day-to-day basis. The second reason is that we do not currently treat security as a human-based concern. The fact is that your employees are making security-related decisions every minute of every day, while cybersecurity is often still perceived as something that can be fixed with the latest tools and software packages, and maybe a boring all-hands training session once or twice per year. That’s like saying that you can lose weight by buying a more expensive scale and maybe going to the gym once in a while. It might be a nice fantasy, but it’s not very realistic.

According to a recent report by the European Union Agency for Network and Information Security (ENISA), the biggest reason for the lackluster status of security in most businesses is that security too often tends to be too complex and effortful for the average employee to carry out. “Security needs to accept that human effort and attention is a precious resource primarily dedicated to productivity,” the authors write. “Thus, security needs to fit into work processes and tasks rather than disrupt them; policies and tools need to be targeted and easy to follow. If it were possible to make coping with cybersecurity threats a simple, obvious action, we massively increase the likelihood that people will behave in a secure way and thus reduce the likelihood of threats ever materialising.” In other words, if you make security a engaging, simple, and convenient part of your workers’ daily routines, you’ll be much closer to having a secure environment than any amount of “hardened” software could provide.

Here at CybrQ, our philosophy is this: Focus on the user. We’re building a new generation of cybersecurity tools that balances people and technology, rather than choosing between the two. If you truly want to make your company secure, then you need to treat information security as more than just a box to check, and instead as something that plays a critical role in everything your employees do. You need to choose your tools and sculpt your strategies so that everyone — not just techies and IT personnel — can understand and internalize the role they have to play. After all, good security is something that everybody in your company is responsible for, from the head of the company all the way down to the cleaning staff who should know better than to open the door for strangers in Santa Claus costumes.