Application Security

5/18/2017
02:00 PM
Stan Black
Stan Black
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

All Generations, All Risks, All Contained: A How-To Guide

Organizations must have a security plan that considers all of their employees.

Did you know that 55% of businesses are worried about the risk that millennials pose to their organization? According to a recent study from Ponemon Institute and Citrix, two-thirds of businesses know they can't control all apps and devices, everywhere, all the time. The same study showed that millennials and members of Generation X are the most likely to circumvent security policies and use unapproved apps and devices in the workplace. 

It's important for organizations to recognize that security vulnerabilities reach across generations — they don't discriminate. So although some of us may be more vulnerable than others to certain attacks, it's important for businesses to also have a security strategy that spans their full employee base. 

We each have a different view of security, whether that's because of the technology we used as we grew up, the career path we chose, or how technology touches our daily lives. Regardless of how often we interact with technology, people need to understand their role in securing their own information and, as employees, keeping their company's business information safe. Employees need to adopt a more security-minded and aware culture. Education programs need to teach the workforce to ask questions like, "How secure is my personal information? Am I vulnerable to an attack? Am I a weak link when it comes to my company's business information?" Each person has a different answer to these questions.

The same Ponemon study found the following:

  • 55% of security and business respondents said that millennials, born 1981–1997, pose the greatest risk of circumventing IT security policies and use of unapproved apps in the workplace.
  • 33% said baby boomers, born 1946–1964,are most susceptible to phishing and social engineering scams.
  • 30% said Gen Xers, born 1965–1980, were most likely to exhibit carelessness in following the organization's security policies 

We know the call to action is there, so how do we actually achieve this culture of awareness?

How to Create a Security-Aware Culture
Although cyber attacks from the last couple of years have drawn a significant amount of attention to security, we still have a long way to go teach employees and bring industries up to speed about security best practices. The demand for devices and anytime, anywhere access often becomes paramount to security fears these days. No one can afford to assume that a device or a network is inherently safe. Connecting to free airport Wi-Fi is one of the worst things to do, yet the hunger for data and connectivity that many people have makes them willing to put their digital lives and businesses at risk. 

The key to comprehension and adoption of this security-first mindset is fine-tuning awareness training so that it fits all age groups in our diverse workforce. Awareness must be role-relevant and make the concepts sticky and personal. Another annoying or mandatory training requirement only leads to a broader gap between security and reality. Effective communication blends multiple modes of media, current risks, and clear alignment with peoples' work and home life.

There is no official timeline or work-back schedule for security training. The process is continuous.

How to Know You're Successful
Monitoring the success of training and awareness programs is easier than you'd think. Are phishing attempts less successful? Have security-related help-desk tickets decreased? Has your company cut down on redundant security products (thereby reducing complexity)? Is your workforce asking more questions or flagging more potential holes?

Go back to the basics, practice them, enforce them. 

Related Content:

Stan Black, CISSP, is CSIO of Citrix where he is in charge of the secure delivery of applications and data to some of the world's largest organizations in healthcare, financial services, public sector, and manufacturing. Black defines a converged cyber security posture ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
LindsayCybSafe
0%
100%
LindsayCybSafe,
User Rank: Strategist
5/22/2017 | 4:35:04 AM
Employee training
Great post Stan - finally the industry is beginning to come around to the fact cyber security is required BY DESIGN - everyone has a stake in a firm's protection, and given recent events, a CISOs/CIOs time is better spent on optimising backend software and leaving their staff in the hands of expert education providers to provide certification and reduce the most common exposures.  
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
7 Ways to Keep DNS Safe
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Locked device, Ha! I knew there was another way in.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-15137
PUBLISHED: 2018-07-16
The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed.
CVE-2017-17541
PUBLISHED: 2018-07-16
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature.
CVE-2018-1046
PUBLISHED: 2018-07-16
pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow ...
CVE-2018-10840
PUBLISHED: 2018-07-16
Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.
CVE-2018-10857
PUBLISHED: 2018-07-16
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.