How to talk security so people will listen (and comply!)
- 03 January, 2013 13:04
The statistics are staggering: Last year, Symantec blocked a total of over 5.5 billion malware attacks, an 81% increase over 2010, and reported a 35% increase in Web-based attacks and a 41% increase in new variants of malware.
If those findings, documented in the company's latest annual Internet Security Threat Report, cause IT leaders to wonder if they've done everything possible to protect their companies, they might consider looking in the mirror.
That's because security folks, in struggling to establish policies and procedures that are both effective and easy to use, often forget a third and crucial step, experts say: Communicating their security goals in such a way that the broad corporate population not only understands but responds.
"Compliance is necessary, but it's not sufficient," says Malcolm Harkins, vice president and chief information security officer at Intel.
Harkins' goal is to get employees to go beyond compliance toward full commitment to protecting the company's information. "If they're committed to doing the right thing and protecting the company, and if they're provided with the right information, [then] they'll make reasonable risk decisions."
To be sure, employees are not involved in every type of corporate security breach (see Top 10 threat action types), but user behavior and non-compliance are implicated in many, including mobile malware, social network schemes and advanced target attacks. These are increasingly aimed not at CEOs and senior staffers, but at people in other job functions such as sales, HR, administration and media/public relations, as criminals try for "lower-hanging fruit," the Symantec report says.
Against such an onslaught, the stereotypical wall poster of security tips hanging in the breakroom is useless, says Julie Peeler, foundation director at the International Information Systems Security Certification Consortium -- also known as (ISC) -- a global, non-profit organization that educates and certifies information security professionals. "Security training is not a one-time event. It has to be integrated throughout the entire organization, and it has to come from the top," she says.
When it comes to talking security in a way that users will listen, managers need to ensure that employees understand the security posture of the company from day one, Peeler says. They must be willing to sign confidentiality agreements, attend training and participate in ongoing awareness, all with the goal of remaining vigilant.
Top 10 threat actions used against larger enterprises(by percent of breaches affected)
Analysis of 855 confirmed organizational data breaches investigated in 2011 by Verizon or one of its international forensic partners: the United States Secret Service (USSS), the Dutch National High Tech Crime Unit, the Australian Federal Police, the Irish Reporting & Information Security Service and the Police Central e-Crime Unit of the London Metropolitan Police. Totals exceed 100% as incidents often involve multiple threat events. Source: Verizon RISK Team: 2012 Data Breach Investigations Report
Companies that are most successful in their security message have moved beyond an IT-centric approach to a holistic model. Computerworld caught up with three organizations doing just that -- Intel, Royal Philips Electronics and Endurance Services -- to find out how they managed to make information security a corporatewide responsibility.
Read on for five best practices for getting the security message to sink in with employees.
Put threats into context
People don't internalize security best practices by simply being told what to do or scared into compliance, Peeler says, and Harkins agrees. "You don't want to spin information security compliance as fear," he says. "Fear is like junk food -- it can sustain you for a bit, but in the long run it's not healthy."
Instead, both experts say, employees are more likely to be motivated into compliance if security managers can put risk into a context that relates to them directly.
Most employees know that a security breach affects not just data, but the entire company's brand and reputation -- but some business units might not fully understand their potential role in a security breach, says Harkins.
A marketing team, for instance, might want to launch a new interactive website ahead if its competitors, he explains. The website's content seems harmless enough since it doesn't include intellectual property, only a few interactive screens and videos.
But what if vulnerabilities left by a third-party provider that helped develop the site allow a hacker to implant malware in one of the links found on the site? Explaining the risk ahead of time, and in a way that's specific to the department's line of business, helps ensure the group will do what's necessary to mitigate damage, Harkins says.
Fear is like junk food -- it can sustain you for a bit, but in the long run it's not healthy. Malcolm Harkins, Intel
Real-world examples can also drive the message home when put into context. When a data breach makes the news, use it as a teaching tool -- in training classes, via email or through video presentations.
Discuss the likelihood of a similar breach occurring in your organization. Ask: How would a breach like this have affected our company or a specific business unit? What people or business units should remain extra vigilant against a similar attack? What security measures do you already have in place to protect against such an attack?
Go phishing, internally
Another effective communication technique some companies have adopted is to launch their own simulated phishing scams, see how many employees take the bait, and then use the opportunity to offer advice on avoiding the scam the next time -- when it might be real.
Royal Philips Electronics recently launched a pilot program of controlled phishing attacks, says Nick Mankovich, chief information security officer.
Working with a professional phishing partner, whom Mankovich declined to name, Philips simulates an email scam that tries to get employees to click a link to a website and enter their password and user name. When the unsuspecting employee clicks on the link, a message pops up explaining their error and offers tips to avoid being scammed the next time.
"It's not about embarrassing or surveilling anyone. It's really about giving material that means something at the moment when they click on the [erroneous] link," Mankovich says.
Depending on the exact nature of the attack, tips might include questions like: Did the email come from a trusted source? Was there something misspelled or unusual about the link? Did you remember to hover the mouse over the link and check the bottom of the screen to see if the two matched?
So far, three phishing experiments involving 250 employees each have been conducted; eventually, Mankovich hopes to test the security smarts of all 90,000 email-connected Philips employees worldwide.
"At the end of each pilot we talk to a few of the users to see what they felt about the experience -- both those who fell for the phishing and those who did not," Mankovich says. "We [typically] have a very small percentage of people who did the bad behavior, and those people do get the message."
As for more simulated attacks, "We've decided we're going to run it forever. Those personal hooks do very well" -- though future phishing tests will be stealthier and increasingly intricate, he says.
Protect to enable
In light of the increasingly virulent cyber-threats out in the wild, IT leaders struggle between giving business units the freedom to choose their own apps, launch their own online initiatives and adopt new devices, and putting the brakes on.
But it is possible to strike a balance between the two, Harkins says. Intel adopted its "protect to enable" mantra three years ago. Rather than focusing primarily on locking down assets, the mission of the information security group has shifted to enable business goals "while applying a reasonable level of protection," Harkins says. "The more drag you put on information flow, the slower the business velocity, which also creates strategic risk issues," Harkins explains.
To enable business goals while still effectively communicating its security policies, IT needs three things, Harkins says: an adequate level of acumen as to the business side's situation and needs; input from both technical and business units on the risks versus rewards of a given security decision; and a clear channel of communication among all levels and units of the business.
The more drag you put on information flow, the slower the business velocity, which creates strategic risk. Malcolm Harkins, Intel
Intel's BYOD plan is one product of its "protect to enable" policy. As early as 2009, Intel took a new approach that supports personal devices in the enterprise. "I challenged my team to work with Intel legal and human resources groups to define security and usage policies. This enabled us to begin allowing access to corporate email and calendars from employee-owned smartphones in January of 2010," Harkins says.
The initiative has been highly successful in allowing users to adapt their mobile devices to the workplace while keeping corporate data safe, and Intel continues to define new security and use policies as new devices come onboard.
Insurance provider Endurance Specialty Holdings Ltd. in New York tries to establish policies that don't limit the users from performing their jobs, says CIO Tom Terry. "There's generally a good reason why they're asking for a particular software, tool or device. We attempt to understand the problem they're trying to solve and give them tools to address their needs in a secure manner."
For instance, USB devices were needed by many business units to transfer data, but the IT organization knew that USB devices can be a major contributor to data loss if not managed properly. So the Endurance IT team said "yes, but..." by distributing the devices but also instituting and explaining a policy to ensure they had password protection and encryption.
"When the business sees you working with them in a collaborative fashion, then you can move the dial forward" in terms of a shared corporate response to security, says Terry.
Promote security from the top down
Security initiatives should be mandated and supported at the top levels of the organization. At Endurance, information security is a board-level agenda item and a strategic business objective, says Terry. "Being able to work with your executive team and senior management to help share the communication message makes it much easier rather than being an IT-centric responsibility."
Royal Philips recognized the need for top-down security communications when it created a corporate level organization called Information Security and named Mankovich its first chief information security officer in January 2012. The group "is focused on a simple pitch, which is the adequate protection of information that affects the business of Philips," Mankovich says. "That could mean my laptop, my notebook, even information that's in my head. And it's everybody's responsibility."
Share your company's hack history
Although controversial, sharing -- in confidence, of course -- the number and nature of attempted hacks on your own company's systems, or incidents within business units, can be a strong motivator toward security compliance, Peeler says. "People don't really understand how often a company's own systems are under attack," she points out.
Harkins agrees. "[Security leaders] have got to show logic, show data, and relate it to the business goals and, if not addressed, what impact it can have toward achieving those goals," he says. "The more your predictions start to come true, [the more] you're demonstrating you know what you're doing and you're not trying to impede the business, you're trying to help the business."
People don't really understand how often a company's own systems are under attack. Julie Peeler, (ISC)
Intel has found ways to put breach data to good use without sharing too much confidential information. For instance: "We had an employee who stole intellectual property from us a few years ago and was convicted earlier this year. We posted to all employees the story of what happened, how we found out, and reminded everyone of the expectations we have of them," Harkins relates.
Intel also posts its lost or stolen laptop rates and reminds people how to take care of equipment. It will also share general investigation or incident details, including mistakes made by employees, such as posting information to a social site, and describe the risk that created for the company, Harkins says. "But we don't share who did it or other details that would embarrass or create issues for the employee," he clarifies.
Others have mixed feelings. Mankovich says the transparency approach "bears consideration," but he worries that any shared information could too easily jump the fence to the outside world. "My first reaction is that, with 124,000 employees in 60 countries, we couldn't avoid it going public," Mankovich says. "Knowing that, we must consider the downside of providing the bad guys with attack intelligence. That in itself might increase risk."
Security: Endlessly exciting
Ultimately, convincing employees to remain vigilant is a job shared between IT and the business. "We really have to understand how the workforce is changing, how are we changing the workforce, and how the expectations of people who use our products or partner with us are changing," Mankovich sums up. "The job is endless, but it's exciting."
Read more about security in Computerworld's Security Topic Center.