Application Security

5/18/2017
02:00 PM
Stan Black
Stan Black
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

All Generations, All Risks, All Contained: A How-To Guide

Organizations must have a security plan that considers all of their employees.

Did you know that 55% of businesses are worried about the risk that millennials pose to their organization? According to a recent study from Ponemon Institute and Citrix, two-thirds of businesses know they can't control all apps and devices, everywhere, all the time. The same study showed that millennials and members of Generation X are the most likely to circumvent security policies and use unapproved apps and devices in the workplace. 

It's important for organizations to recognize that security vulnerabilities reach across generations — they don't discriminate. So although some of us may be more vulnerable than others to certain attacks, it's important for businesses to also have a security strategy that spans their full employee base. 

We each have a different view of security, whether that's because of the technology we used as we grew up, the career path we chose, or how technology touches our daily lives. Regardless of how often we interact with technology, people need to understand their role in securing their own information and, as employees, keeping their company's business information safe. Employees need to adopt a more security-minded and aware culture. Education programs need to teach the workforce to ask questions like, "How secure is my personal information? Am I vulnerable to an attack? Am I a weak link when it comes to my company's business information?" Each person has a different answer to these questions.

The same Ponemon study found the following:

  • 55% of security and business respondents said that millennials, born 1981–1997, pose the greatest risk of circumventing IT security policies and use of unapproved apps in the workplace.
  • 33% said baby boomers, born 1946–1964,are most susceptible to phishing and social engineering scams.
  • 30% said Gen Xers, born 1965–1980, were most likely to exhibit carelessness in following the organization's security policies 

We know the call to action is there, so how do we actually achieve this culture of awareness?

How to Create a Security-Aware Culture
Although cyber attacks from the last couple of years have drawn a significant amount of attention to security, we still have a long way to go teach employees and bring industries up to speed about security best practices. The demand for devices and anytime, anywhere access often becomes paramount to security fears these days. No one can afford to assume that a device or a network is inherently safe. Connecting to free airport Wi-Fi is one of the worst things to do, yet the hunger for data and connectivity that many people have makes them willing to put their digital lives and businesses at risk. 

The key to comprehension and adoption of this security-first mindset is fine-tuning awareness training so that it fits all age groups in our diverse workforce. Awareness must be role-relevant and make the concepts sticky and personal. Another annoying or mandatory training requirement only leads to a broader gap between security and reality. Effective communication blends multiple modes of media, current risks, and clear alignment with peoples' work and home life.

There is no official timeline or work-back schedule for security training. The process is continuous.

How to Know You're Successful
Monitoring the success of training and awareness programs is easier than you'd think. Are phishing attempts less successful? Have security-related help-desk tickets decreased? Has your company cut down on redundant security products (thereby reducing complexity)? Is your workforce asking more questions or flagging more potential holes?

Go back to the basics, practice them, enforce them. 

Related Content:

Stan Black, CISSP, is CSIO of Citrix where he is in charge of the secure delivery of applications and data to some of the world's largest organizations in healthcare, financial services, public sector, and manufacturing. Black defines a converged cyber security posture ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
LindsayCybSafe
0%
100%
LindsayCybSafe,
User Rank: Strategist
5/22/2017 | 4:35:04 AM
Employee training
Great post Stan - finally the industry is beginning to come around to the fact cyber security is required BY DESIGN - everyone has a stake in a firm's protection, and given recent events, a CISOs/CIOs time is better spent on optimising backend software and leaving their staff in the hands of expert education providers to provide certification and reduce the most common exposures.  
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6443
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.
CVE-2019-6444
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd.
CVE-2019-6445
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control.c, related to ctl_getitem.
CVE-2019-6446
PUBLISHED: 2019-01-16
An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call.
CVE-2019-6442
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y.