Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/18/2017
02:00 PM
Contributor, Dark Reading
Contributor, Dark Reading
Commentary
100%
0%

All Generations, All Risks, All Contained: A How-To Guide

Organizations must have a security plan that considers all of their employees.

Did you know that 55% of businesses are worried about the risk that millennials pose to their organization? According to a recent study from Ponemon Institute and Citrix, two-thirds of businesses know they can't control all apps and devices, everywhere, all the time. The same study showed that millennials and members of Generation X are the most likely to circumvent security policies and use unapproved apps and devices in the workplace. 

It's important for organizations to recognize that security vulnerabilities reach across generations — they don't discriminate. So although some of us may be more vulnerable than others to certain attacks, it's important for businesses to also have a security strategy that spans their full employee base. 

We each have a different view of security, whether that's because of the technology we used as we grew up, the career path we chose, or how technology touches our daily lives. Regardless of how often we interact with technology, people need to understand their role in securing their own information and, as employees, keeping their company's business information safe. Employees need to adopt a more security-minded and aware culture. Education programs need to teach the workforce to ask questions like, "How secure is my personal information? Am I vulnerable to an attack? Am I a weak link when it comes to my company's business information?" Each person has a different answer to these questions.

The same Ponemon study found the following:

  • 55% of security and business respondents said that millennials, born 1981–1997, pose the greatest risk of circumventing IT security policies and use of unapproved apps in the workplace.
  • 33% said baby boomers, born 1946–1964,are most susceptible to phishing and social engineering scams.
  • 30% said Gen Xers, born 1965–1980, were most likely to exhibit carelessness in following the organization's security policies 

We know the call to action is there, so how do we actually achieve this culture of awareness?

How to Create a Security-Aware Culture
Although cyber attacks from the last couple of years have drawn a significant amount of attention to security, we still have a long way to go teach employees and bring industries up to speed about security best practices. The demand for devices and anytime, anywhere access often becomes paramount to security fears these days. No one can afford to assume that a device or a network is inherently safe. Connecting to free airport Wi-Fi is one of the worst things to do, yet the hunger for data and connectivity that many people have makes them willing to put their digital lives and businesses at risk. 

The key to comprehension and adoption of this security-first mindset is fine-tuning awareness training so that it fits all age groups in our diverse workforce. Awareness must be role-relevant and make the concepts sticky and personal. Another annoying or mandatory training requirement only leads to a broader gap between security and reality. Effective communication blends multiple modes of media, current risks, and clear alignment with peoples' work and home life.

There is no official timeline or work-back schedule for security training. The process is continuous.

How to Know You're Successful
Monitoring the success of training and awareness programs is easier than you'd think. Are phishing attempts less successful? Have security-related help-desk tickets decreased? Has your company cut down on redundant security products (thereby reducing complexity)? Is your workforce asking more questions or flagging more potential holes?

Go back to the basics, practice them, enforce them. 

Related Content:

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
LindsayCybSafe
0%
100%
LindsayCybSafe,
User Rank: Strategist
5/22/2017 | 4:35:04 AM
Employee training
Great post Stan - finally the industry is beginning to come around to the fact cyber security is required BY DESIGN - everyone has a stake in a firm's protection, and given recent events, a CISOs/CIOs time is better spent on optimising backend software and leaving their staff in the hands of expert education providers to provide certification and reduce the most common exposures.  
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21273
PUBLISHED: 2021-02-26
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key va...
CVE-2021-21274
PUBLISHED: 2021-02-26
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to...
CVE-2021-23345
PUBLISHED: 2021-02-26
All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe src='file:///etc/passwd'>.
CVE-2021-21297
PUBLISHED: 2021-02-26
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default beh...
CVE-2021-21298
PUBLISHED: 2021-02-26
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via th...