When it comes to cybersecurity, we often focus on things like firewalls and antivirus software as our primary defense. However, at its core, cybersecurity is heavily influenced by something even more critical – humans.
Let’s start with a definition of cybersecurity: “Cybersecurity is the practice of protecting computer systems, networks, and digital data from unauthorized access, breaches, damage, or theft while ensuring the confidentiality, integrity, and availability of information.”
So, how does the human element tie in? Well, as it turns out, humans have everything to do with cybersecurity.
You may have heard of the recent MGM attacks, where the casino industry confronted a wave of cyber-attacks orchestrated by the advanced “Scattered Spider” group. Caesars Entertainment fell victim to the attack, with a breach targeting its loyalty program, potentially compromising customer data.
The incident began with a social engineering breach, exploiting vulnerabilities at the IT help desk. This paved the way for a complex intrusion, shaking the foundations of MGM Resorts’ cybersecurity infrastructure.
As we can see, the best tools on the market aren’t foolproof if the humans they’re protecting aren’t educated and motivated to defend against cybersecurity attacks. I’d be willing to bet they’ll implement mandatory security awareness training on social engineering and hardening their employee identification and authentication procedures going forward.
The concept of the human element in cyber defense was highlighted often at the Oregon Cyber Resilience Summit, which I recently had the pleasure of attending. The theme of the event was “Building a Secure Community,” and I was shocked that each and every speaker had a tie back to building a strong cybersecurity culture and how absolutely critical it is to focus on human-centric attacks.
Matt Singleton at CrowdStrike highlighted excellent key points, including the importance of putting a profile of the likely threat actors your company may encounter based on industry, size, and location. Other key points included the criticality of evolving our response speed and defenses to the new challenges of the cloud, banding together as a community to protect ourselves against adversaries that are teaming up, mitigating against exploitable human errors to the best of our ability, and applying timely security patches to take full advantage of the defensive resources available to all of us.
A wonderful Palo Alto representative had new insights in our discussion of the challenge to empower our organizations and cybersecurity teams with appropriate playbooks. This highlighted the common struggle to ensure our teams are equipped and prepared with defined steps to follow for a strong cybersecurity culture full of repeatable, well-known procedures to follow and the importance of communicating that information to the relevant stakeholders.
Ted Fitzgerald of Curry County had all of us in stitches listening to his Lessons Learned from their recent ransomware attack. He practiced what he preached in demonstrating to us the importance of sharing cyberattack experiences to build community awareness and a collaborative cybersecurity culture in which we can share information, lessons learned, support, and maybe even laughs as we navigate stressful and often puzzling cyberattacks.
What really hit me was a talk from Ryan Kalember at ProofPoint, a leading cybersecurity vendor, which I’ve mostly experienced through the email security lens. Ryan spoke about the increasing trend of humans targeting humans, Business Email Compromises (BECs), supplier compromises, and other trending human-centric attacks. This really made me think about the root cause of each of these trends… potentially, a lack of an adequately strong culture in which cybersecurity is emphasized and prioritized. Your best defense against your people being targeted through social engineering is to educate them on all of the different common social engineering tactics and vectors.
I’ve presented on social engineering countless times because it is truly fascinating and arguably the biggest threat to your organization’s cyber (and physical) security. Business email compromises and supplier impersonation can be extremely hard to detect from the receiving end until losses have been had. My go-to recommendations for preventing these types of attacks involve educating users on common tactics, creating multi-step and multi-person verification processes for payment changes, and, most importantly, fostering an environment in which employees are praised for asking questions like:
In fact, I’d like to provide some praise to an anonymous company I’ve seen create a very strong cybersecurity culture. Following a BEC/supplier impersonator, they included an email footer in every email alerting contacts to the importance of verifying senders and briefly sharing the indicators of a suspicious request. Here’s an example of what the footer looked like:
This company has become a cybersecurity champion in its industry and regularly reports phishing emails, even more complex ones that make it past their email provider’s filters. Their team strives for and completes 100% of their Security Awareness Training and whistle-blow any suspected phishing emails to their colleagues.
This provides an excellent segue into my top recommendations for building a strong cybersecurity culture.
The human element of cybersecurity plays a critical role in keeping your organization secure. It’s important to know that a strong cybersecurity culture isn’t just a one-time investment but a continuous, evolving effort. It requires a commitment to education, training, and staying vigilant. When every individual within an organization understands the principles of cybersecurity, it becomes a shared responsibility and a collective shield against potential breaches. By building a culture that values awareness and proactive security measures, we strengthen not only our own defenses but also contribute to a safer digital world for all.