Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/18/2017
02:00 PM
Stan Black
Stan Black
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

All Generations, All Risks, All Contained: A How-To Guide

Organizations must have a security plan that considers all of their employees.

Did you know that 55% of businesses are worried about the risk that millennials pose to their organization? According to a recent study from Ponemon Institute and Citrix, two-thirds of businesses know they can't control all apps and devices, everywhere, all the time. The same study showed that millennials and members of Generation X are the most likely to circumvent security policies and use unapproved apps and devices in the workplace. 

It's important for organizations to recognize that security vulnerabilities reach across generations — they don't discriminate. So although some of us may be more vulnerable than others to certain attacks, it's important for businesses to also have a security strategy that spans their full employee base. 

We each have a different view of security, whether that's because of the technology we used as we grew up, the career path we chose, or how technology touches our daily lives. Regardless of how often we interact with technology, people need to understand their role in securing their own information and, as employees, keeping their company's business information safe. Employees need to adopt a more security-minded and aware culture. Education programs need to teach the workforce to ask questions like, "How secure is my personal information? Am I vulnerable to an attack? Am I a weak link when it comes to my company's business information?" Each person has a different answer to these questions.

The same Ponemon study found the following:

  • 55% of security and business respondents said that millennials, born 1981–1997, pose the greatest risk of circumventing IT security policies and use of unapproved apps in the workplace.
  • 33% said baby boomers, born 1946–1964,are most susceptible to phishing and social engineering scams.
  • 30% said Gen Xers, born 1965–1980, were most likely to exhibit carelessness in following the organization's security policies 

We know the call to action is there, so how do we actually achieve this culture of awareness?

How to Create a Security-Aware Culture
Although cyber attacks from the last couple of years have drawn a significant amount of attention to security, we still have a long way to go teach employees and bring industries up to speed about security best practices. The demand for devices and anytime, anywhere access often becomes paramount to security fears these days. No one can afford to assume that a device or a network is inherently safe. Connecting to free airport Wi-Fi is one of the worst things to do, yet the hunger for data and connectivity that many people have makes them willing to put their digital lives and businesses at risk. 

The key to comprehension and adoption of this security-first mindset is fine-tuning awareness training so that it fits all age groups in our diverse workforce. Awareness must be role-relevant and make the concepts sticky and personal. Another annoying or mandatory training requirement only leads to a broader gap between security and reality. Effective communication blends multiple modes of media, current risks, and clear alignment with peoples' work and home life.

There is no official timeline or work-back schedule for security training. The process is continuous.

How to Know You're Successful
Monitoring the success of training and awareness programs is easier than you'd think. Are phishing attempts less successful? Have security-related help-desk tickets decreased? Has your company cut down on redundant security products (thereby reducing complexity)? Is your workforce asking more questions or flagging more potential holes?

Go back to the basics, practice them, enforce them. 

Related Content:

Stan Black, CISSP, is CSIO of Citrix where he is in charge of the secure delivery of applications and data to some of the world's largest organizations in healthcare, financial services, public sector, and manufacturing. Black defines a converged cyber security posture ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
LindsayCybSafe
0%
100%
LindsayCybSafe,
User Rank: Strategist
5/22/2017 | 4:35:04 AM
Employee training
Great post Stan - finally the industry is beginning to come around to the fact cyber security is required BY DESIGN - everyone has a stake in a firm's protection, and given recent events, a CISOs/CIOs time is better spent on optimising backend software and leaving their staff in the hands of expert education providers to provide certification and reduce the most common exposures.  
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19767
PUBLISHED: 2019-12-12
The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163.
CVE-2019-19768
PUBLISHED: 2019-12-12
In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer).
CVE-2019-19769
PUBLISHED: 2019-12-12
In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h).
CVE-2019-19770
PUBLISHED: 2019-12-12
In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file).
CVE-2019-19771
PUBLISHED: 2019-12-12
The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.