Human resources and training departments key to securing the human

As part of European Cyber Security Awareness Month (ECSM), Lance Spitzner, Director, SANS Institute suggests that human resource departments have a critical role to play in helping their organisations improve information security procedures. “Organisations are beginning to realise that they have to secure the human element as technology can only go so far,” says Spitzner, an internationally recognised leader in the field of cyber threat research and security training and awareness.

ECSM is a European Union advocacy campaign that takes place in October. ECSM aims to promote cyber security among citizens, to change their perception of cyber-threats and provide up to date security information, through education and sharing good practices.

“As long as people store, process or transfer information, they too must be secured. One of the most effective ways to secure employees is to change their behaviours through an active, long term security awareness program,” adds Spitzner who has spoken to and worked with numerous organisations, including the NSA, FIRST, the Pentagon, the FBI Academy, the President's Telecommunications Advisory Committee, MS-ISAC, the Navy War College and the British CESG.

According to the SANS Director, based on the available evidence, it is extremely likely that every large organisation will experience an information security breach at some point in time. According to the influential Data Breach Investigation Report (DBIR) which has examined over 100,000 security breaches over the last decade, 81% of the incidents can be described by just 4 root causes namely miscellaneous errors (27%), insider misuse (19%), crimeware (19%) and physical theft/loss (16%).

The biggest factor “miscellaneous errors” is, according to the report, simply any mistake that compromises security. The main threat comes from human error, such as accidentally posting private data to a public site, sending information to the wrong recipients, or failing to dispose of documents or assets securely. However, lack of security awareness also has a part to play in insider misuse, physical theft and lost incidents.

“In the past organisations have had security awareness programs, but these were compliance driven programs designed by auditors to ensure their organisation could ‘check the box’. These programs consisted of nothing more than a once year Power Point presentation or some very basic Computer Based Training (CBT),” says Spitzner, “In recent years, organisations have begun a fundamental shift on how they approach awareness and training. They are building mature security awareness programs that identify and change high-risk human behaviours.”

Spitzner advocates the first task is gaining support of management and answering the key questions of Who?, What? and How? “Once you have a program rolled out you will need the ability to measure it. Measuring provides several things. First it helps you identify where your greatest risks are and where you need to focus your efforts. Second, it can be used to demonstrate the value of the program to senior management, gaining you the support you need to keep the program long term,” he adds.