I
s cyber security a technology problem or a people problem?
Cyber security is complex, highly technical subject that is best left to the Asperger-nerd in the computer room battling against the pimply-faced hacker sucking down Mountain Dew in his mother’s basement, right? It’s a cat and mouse game that pits the white hats against the black hats, the antivirus computer scientists against the hackers, right? It’s certainly not the realm of the average small business owner, right? Wrong, wrong, and wrong!
What if I told you that human error was more responsible for data breaches in 2008 than hacking? What if I told you that hacking was third on the Identity Theft Resource Center’s (ITRC) categorized list of data loss methods? The reality is that cyber security is a people problem first and a technology problem second.
More Awareness, Less Reliance
Most organizations are oblivious to the weakest link in the security chain
I’ve come to a remarkable, if not depressing realization in my information technology career. Over the last 20 years of consulting, I’ve visited scores of clients in hundreds of facilities and I can easily count the number of times I was ever given any sort of cyber security orientation – exactly once. I’ve walked into propped-open back doors of more manufacturing facilities than you can shake a stick at, and more often than not waltzed right up to a machine control panel, hooked up my laptop, and started pounding away at the keyboard while smiling and waving at trusting operators I had never before met in my life. The realization is this; the vast majority of companies, large and small alike, is completely oblivious to the weakest link in the security chain; people.
The misperception that cyber security is all about technology is a serious mistake that is made by both small and large businesses. The small businesses often believe that they are not sophisticated enough to employ their own cyber security programs and, therefore, either ignore it altogether or simply outsource it to an IT subcontractor. The large businesses spend millions of dollars on intrusion prevention systems, biometric security, and other sophisticated technological countermeasures.
Hopefully by now I’ve made the point that cyber security is about much more than firewalls, Trojans, and keyboard loggers. So without further delay, here is a list of five no-cost practices every organization can implement that will go a long way toward securing their data.
Use Passwords, Use Them Well
OK, show of hands… how many of you are rolling your eyes? It sounds obvious, but password laziness and ignorance is still the number one vulnerability for computer systems. I understand how painful it is these days to maintain all of the user names and passwords in our lives these days. However, it is the world we live in and we must accept it and follow these bare minimum password practices:
- No shared passwords: This is especially common in process automation where there are many users of the same machine. Everyone must have their own unique user name and password.
- Complex passwords: Use combinations of letters and numbers, preferably composed of one or more words that are not in the dictionary. Why? Read this article about Dictionary Attacks.
- Change passwords: This is probably the most annoying of these three practices, and I confess that it aggravates me to have to do. However, changing passwords periodically is one of the best ways to prevent misuse of a password that is unknowingly (or even deliberately) disclosed.
Utilize Automatic Updates
Unpatched operating systems and out of date virus definitions are like the gimpy prey of a flock; they are the first to be targeted by the hunter. Many computer viruses and other exploits rely on software vulnerabilities that are typically patched within days or weeks. However, it is not at all unusual for me to see network servers out of date by more than a year. Another common problem is for antivirus subscriptions to expire, preventing the virus definitions from updating.
Clean House
Every program loaded on a computer is a potential vulnerability. The fewer of them there are, the better. A typical Windows PC has loads of “crap-ware” installed on them that can and should be removed using the Add/Remove Programs option in Control Panel. Additionally, there are Windows Components (e.g. Messenger, Media Player) that should be removed if not used. Finally, there are usually Windows Services running by default that are not used. This particular cleanup is generally left to computer professionals, as it is not always obvious which of these is required and disabling the wrong service can lead to “unexpected behavior.”
Create Policies
There are many reasons for establishing written computer and internet policies for employees. One, of course, is legal liability for the employer. The other is (or at least should be) educational. It’s not enough to write up these policies; they need to be presented and explained in an open environment to ensure that they are understood and appreciated. These policies go far beyond telling users they can’t surf porn on the company’s computers. They need to include things like proper care and usage of portable storage devices, remote access procedures and policies, e-mail policies, etc… You can find a list of templates at the SANS Security Policy Project web site.
Protect Sensitive Information
Insiders and subcontractors are another major vulnerability and care must be taken to provide information necessary for them to do their jobs, but no more. This is especially true of subcontractors, of which I am one, who are frequently given and/or create sensitive documents, diagrams, lists, and other data. It is important to establish guidelines for its use to ensure that the information is handled with care and returned or disposed of when the job is complete. As incredible as it sounds, a subcontractor published a complete schematic of Pearl Harbor Naval Base’s power monitoring control system in a white paper available publically on the Internet (I just checked and the information has apparently been removed).
The Bonus Round
What is the hacker’s #1 tool of the trade? I’ll give you a hint; it has nothing to do with computers. It’s called Social Engineering and you can read more of it in my blog, “The Hacker as a Magician.”
Feel free to share your own anecdotes and pearls of wisdom on the subject. What are some of the head-shaking moments you’ve witnessed? Are there any “doh!” moments you care to share?
Credits and citations:
Continue Reading
