How to talk security so people will listen (and comply!)
From phishing your own employees to sharing your company's hack history, here are five techniques for getting users' attention about security.
Computerworld - The statistics are staggering: Last year, Symantec blocked a total of over 5.5 billion malware attacks, an 81% increase over 2010, and reported a 35% increase in Web-based attacks and a 41% increase in new variants of malware.
If those findings, documented in the company's latest annual Internet Security Threat Report, cause IT leaders to wonder if they've done everything possible to protect their companies, they might consider looking in the mirror.
That's because security folks, in struggling to establish policies and procedures that are both effective and easy to use, often forget a third and crucial step, experts say: Communicating their security goals in such a way that the broad corporate population not only understands but responds.
"Compliance is necessary, but it's not sufficient," says Malcolm Harkins, vice president and chief information security officer at Intel.
Harkins' goal is to get employees to go beyond compliance toward full commitment to protecting the company's information. "If they're committed to doing the right thing and protecting the company, and if they're provided with the right information, [then] they'll make reasonable risk decisions."
To be sure, employees are not involved in every type of corporate security breach (see Top 10 threat action types), but user behavior and non-compliance are implicated in many, including mobile malware, social network schemes and advanced target attacks. These are increasingly aimed not at CEOs and senior staffers, but at people in other job functions such as sales, HR, administration and media/public relations, as criminals try for "lower-hanging fruit," the Symantec report says.
Against such an onslaught, the stereotypical wall poster of security tips hanging in the breakroom is useless, says Julie Peeler, foundation director at the International Information Systems Security Certification Consortium -- also known as (ISC)² -- a global, non-profit organization that educates and certifies information security professionals. "Security training is not a one-time event. It has to be integrated throughout the entire organization, and it has to come from the top," she says.
When it comes to talking security in a way that users will listen, managers need to ensure that employees understand the security posture of the company from day one, Peeler says. They must be willing to sign confidentiality agreements, attend training and participate in ongoing awareness, all with the goal of remaining vigilant.
Top 10 threat actions used against larger enterprises
(by percent of breaches affected)
|1||Use of stolen login credentials||Hacking||30%|
|2||Backdoor (allows remote access/control)||Malware||18%|
|3||Exploitation of backdoor or command and control channel||Hacking||17%|
|6||Pretexting (classic social engineering)||Social||12%|
|7||Brute force and dictionary attacks||Hacking||8%|
|9||Phishing (or any type of "ishing")||Social||8%|
|10||Command and control (listens for and executes commands)||Malware||8%|
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts