7 Real-Life Dangers That Threaten Cybersecurity
Cybersecurity means more than bits and bytes; threats are out there IRL, and IT pros need to be prepared.
November 26, 2018
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4893d8c0e293ed7e/64f0d6055f01119f290361c1/Image_1.jpg?width=700&auto=webp&quality=80&disable=upscale)
Cybersecurity tends to focus on dangers that appear on networks or in messages. The attackers may be half a world away, so the threat is the only thing that matters. But what happens when the threat actor is walking through the front door or sitting next to you at an airport coffee shop? Firewall rules and DNSSec can have minimal impact on the thief sliding a company-owned laptop into his backpack and walking out the door.
"If we all took our computers, encased them in concrete, and dropped them into the middle of the Atlantic Ocean, nobody would ever steal our data, but it wouldn't matter because our data would be on the bottom of the Atlantic Ocean," says Tim Callan, senior fellow at Sectigo. The challenge, he says, is reconciling physical security with the fact that people need to use their computers and mobile devices for legitimate work.
In 2016, Bitglass reported that one in four breaches in the financial services sector were due to lost or stolen devices, while one in five were the result of hacking. Physical security might not have the glamour of fighting malware writers, but there's no question it's a serious component of any effective data protection program.
So what are the physical dangers to enterprise data? Several, but they tend to echo the dangers to any physical assets an organization owns. As a result, some IT security groups leave physical security to the physical-plant security force, but there are both strategic and technical reasons to involve IT security in protecting both the data on systems and the hardware that surrounds those precious bytes.
After talking with security professionals, querying the security community via Twitter, and looking at major security incidents from the recent past, we've put together a list of seven threats that definitely deserve attention. Protecting systems from these threats takes a combination of user education, behavior modification, and technology, but remedying the problems themselves can make a huge difference in an organization's risk profile.
(Image: Stevepb)
Tailgating is one of the classic physical security vulnerabilities, and it differs from the "etiquette" vulnerability discussed earlier because the employee properly entering the premises often has no idea that a violation has occurred. The tailgater simply takes advantage of physics to walk through a door that's slow to close after a proper entry, and suddenly a potential threat is in the building.
Once again, employee training and behavior is key in most instances in which a permanent security guard at the door isn't feasible. In addition, IT security groups have to be aware of a second type of tailgating: the "log-on tailgating" that can lead to unauthorized access to systems.
"The employees have to cooperate because, if I leave my laptop unlocked where any stranger can go use it despite the fact I've been told not to, it's kind of hard for the company to do anything about that," Callan says. Teaching employees to log out or lock the system, even if they'll only be away for a few minutes, can be a solution, as are systems that use proximity badging as a second factor for logging in and out of sensitive systems.
Employees walk away from their computers. Whether the system is sitting on a desk in an office or on a table at Starbucks, it's rare that its owner never leaves the keyboard. The key is making sure employees understand that the threat level of a muffin run at that coffee shop is different than the threat level in the office.
"I might decide to let my computer sit on a desktop while I run over to the other side of the office to do something," says Callan, who admits to leaving his computer visible on a table while getting a second cup of coffee. "[But] if I was in a coffee shop, I wouldn't leave it running. I would lock it." Those small behaviorial changes can make a huge difference in security outcomes for organizations.
All security, physical or cyber, is a balancing act between safety and productivity because, ultimately, people have to be able to do their jobs. "There's always this vulnerability that we're never going to get around, which is the big, giant mass of cells that's sitting in front of the computer," Callan says. "If you can fool that person, you can get into anything because, at the end of the day, we have to give people access." The critical point is understanding that cybersecurity involves hardware and humans as much as it does malware and networks.
Employees walk away from their computers. Whether the system is sitting on a desk in an office or on a table at Starbucks, it's rare that its owner never leaves the keyboard. The key is making sure employees understand that the threat level of a muffin run at that coffee shop is different than the threat level in the office.
"I might decide to let my computer sit on a desktop while I run over to the other side of the office to do something," says Callan, who admits to leaving his computer visible on a table while getting a second cup of coffee. "[But] if I was in a coffee shop, I wouldn't leave it running. I would lock it." Those small behaviorial changes can make a huge difference in security outcomes for organizations.
All security, physical or cyber, is a balancing act between safety and productivity because, ultimately, people have to be able to do their jobs. "There's always this vulnerability that we're never going to get around, which is the big, giant mass of cells that's sitting in front of the computer," Callan says. "If you can fool that person, you can get into anything because, at the end of the day, we have to give people access." The critical point is understanding that cybersecurity involves hardware and humans as much as it does malware and networks.
Cybersecurity tends to focus on dangers that appear on networks or in messages. The attackers may be half a world away, so the threat is the only thing that matters. But what happens when the threat actor is walking through the front door or sitting next to you at an airport coffee shop? Firewall rules and DNSSec can have minimal impact on the thief sliding a company-owned laptop into his backpack and walking out the door.
"If we all took our computers, encased them in concrete, and dropped them into the middle of the Atlantic Ocean, nobody would ever steal our data, but it wouldn't matter because our data would be on the bottom of the Atlantic Ocean," says Tim Callan, senior fellow at Sectigo. The challenge, he says, is reconciling physical security with the fact that people need to use their computers and mobile devices for legitimate work.
In 2016, Bitglass reported that one in four breaches in the financial services sector were due to lost or stolen devices, while one in five were the result of hacking. Physical security might not have the glamour of fighting malware writers, but there's no question it's a serious component of any effective data protection program.
So what are the physical dangers to enterprise data? Several, but they tend to echo the dangers to any physical assets an organization owns. As a result, some IT security groups leave physical security to the physical-plant security force, but there are both strategic and technical reasons to involve IT security in protecting both the data on systems and the hardware that surrounds those precious bytes.
After talking with security professionals, querying the security community via Twitter, and looking at major security incidents from the recent past, we've put together a list of seven threats that definitely deserve attention. Protecting systems from these threats takes a combination of user education, behavior modification, and technology, but remedying the problems themselves can make a huge difference in an organization's risk profile.
(Image: Stevepb)
About the Author(s)
You May Also Like
CISO Perspectives: How to make AI an Accelerator, Not a Blocker
August 20, 2024Securing Your Cloud Assets
August 27, 2024