Endpoint
12/2/2016
08:00 AM
Roland Cloutier
Roland Cloutier
Commentary
100%
0%

The Human Firewall: Why People Are Critical To Email Security

Technology is just the beginning; employees must be fully on board with security procedures.

Company email systems have become one of the biggest targets for cybercriminals with larger businesses the more frequent target due to their greater surface area of risk, diversity — and more opportunities to exploit.

According to a recent survey, more than half of organizations attribute a security incident or data breach to a malicious or negligent employee. So although companies invest a lot of money, resources, and time into developing a strong email security system, the system won't be worth much if employees —  the human firewall — aren't on board.

Your human firewall encompasses how well employees understand the importance of the right security practices and how easily they can act on them. Right now, most organizations aren't doing an adequate job, but there are steps that companies can take to help keep email safe. It starts with focusing on both technology and the people using it:

1. Put comprehensive security protocols in place and build partnerships within the business.

Your email security program needs to work from the time a message is sent, to when it is received, whether it is coming in or going out of your network. Email servers can perform a number of functions to protect your mail environment and network, and an email platform that secures the data when it's both at rest and in transit is key.

There are several important elements to put this foundation in place, including:

  • Encryption, such as transport layer security (TLS). TLS lets email servers communicate in a secure manner over an encrypted channel, blocking bad actors from accessing the content of emails that they intercept.
  • Email verification systems. Domain-based Message Authentication, Reporting and Conformance (DMARC) is an effective system that lets servers validate that incoming mail actually comes from the organization that is listed as the sender. DMARC is built on both a Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM), ties them together to verify email addresses, and automatically discards any messages that fail the test.
  • DMARC/SPF records. In addition to testing inbound mail, you should publish DMARC/SPF records for your organization's domains, and sign outgoing messages with DKIM, to prevent the sending of fake emails that appear to come from your company.
  • The right role for the security team. Administrative controls should allow the security team to have transparency and operational security oversight of the email platform. This includes using separate administrative accounts as well as monitoring access to these accounts, since they are often prime targets for hackers.

2. Educate and engage employees on how to use security tools properly and make them aware of their individual responsibilities and company policies with ongoing training and communications.

Implementing security best practices for all employees — i.e., policies for "bring your own device" and mandated password changes — plays an important role in employees making the right decisions around email security. However, these protocols should also resonate with employees. Creative communication techniques — such as webcasts and quizzes — can help employees realize the importance of security practices by linking important aspects of security from their private lives to their work lives.

Engaging employees will also help security teams overcome the challenge of employees viewing security as an obstacle that prevents them from doing their work. Instead, when security becomes personal, employees are encouraged to be active partners in helping to protect the organization.  

3. Continually monitor and measure effectiveness of your security program and human firewall to manage your risk.

Monitoring and measuring the effectiveness of email security programs and the human firewall must be an ongoing effort. Employee security awareness must evolve with the constantly changing technology industry. This starts with keeping metrics that track the security awareness of employees over time. Metrics to use should include the number of reported incidents, visits to unapproved sites, email violations, phishing report rates, insider threats, percentage of infections while employees are remote, and the average time it takes employees to report a lost device.

You can also monitor for employee compliance by testing your employees with simulations, such as periodic phishing awareness. Organizations should use this tactic to get a sense of whether communications, training, and policies are connecting with employees and are effective in securing the email system.  

Emails are accessed by every employee and contain confidential information about your company and customers, making them both difficult and crucial to secure. Because of the human element, a mix of comprehensive security protocols, educating and engaging employees, and continuous monitoring is needed to prevent emails from becoming a gateway for hackers.

Company leadership in partnership with security teams and human capital management professionals should reward employees who embrace security practices. For employees who don't comply, fair yet disciplined programs can eradicate behaviors that threaten security. In other words, an email security program is only as secure as the people using it, but your employees can't do it alone. 

Related Content:

As the chief security officer of ADP, Roland Cloutier works to protect and secure one of the world's largest providers of business outsourcing solutions. His expertise includes managing converged security and business protection programs. Roland has functional and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Lily652
100%
0%
Lily652,
User Rank: Moderator
12/11/2016 | 1:08:35 PM
prayer times

It was a very good post indeed. I thoroughly enjoyed reading it in my lunch time. Will surely come and visit this blog more often. Thanks for sharing 

Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
12/2/2016 | 3:29:31 PM
Why So Lax?
I'm ever confused regarding the need for complex email workflows and processes in the workplace.  It should be a no-brainer when it comes to companies that have even the slightest belief their email servers and network could be compromised by the accessing of certain types of email by their users.  First of all, lock it down.  There are two primary ways to utilize email in the workplace:  1) You need to email each other (employees) to get work done.  This is internal.  So, build an internal secure network for your email servers and, viola, the only spam or malicious code you'll get via email will be those crafted by your employees at work and intentionally sent.  This type of email system never gets exposed to the outside world.  2) You need to email out to or receive in from non-employees (vendors, etc).  Use a secure email system where a 3rd party encrypted application is used that a) removes any possibility of outside emails that contain spam or malware (again, unless crafted by your employees or vendors at work and intentionally sent), and b) keeps your communication intentional, private and meaningful.

The arguments against this I often hear relate to ease-of-use or expense.  Well, there are plenty of FOSS (Free and Open Source) solutions out there, so expense (other than that of obtaining resources to build, install, train and maintain) is not an argument when weighed against the expense of becoming a victim of spam, phishing, malware and so forth.  And ease-of-use means what?  So I have to log into an app to send an email to only receipients that I'm allowed to send it to.  I'm at work.  This is a problem?

OK, I sometimes oversimplify but to be honest it is when you oversimplify that the real questions that should be asked are.  Companies do not do business to satisfy the whims of employees; my company's technology infrastructure does not exist so I can surf the web, email my wife about next week's party plans, or receive coupons and evites that may or may not be from trusted sources.

Why so lax?
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.