Security Confidential S3 E0 Cyber Basics: Training the End-User

Tyler Smith: Welcome to Security Confidential by Dark Rhino Security, where we get together and talk about all things information security. I’m Tyler, an information security practitioner at Dark Rhino Security.

Nathan: Hi, my name is Nathan. I am a security engineer with Dark Rhino Security.

Sunaina: And I’m Sunaina.

Tyler Smith: Today we’re going to talk about cybersecurity basics. So, where should we start? Cybersecurity basics tells me the very first thing is end-user awareness and training. The most vulnerable part of any organization is its end user. I think companies don’t really appreciate or understand what security is, and they hear the term “security” and they panic right off the bat. They’re like, “Oh, it’s going to be expensive.” Well, every year companies have corporate compliance training and user training. All you need to do is take 15 minutes of that and incorporate some form of cybersecurity. Typically, we would like to include phishing scams, passwords, and stuff like that. And bam, you have an educated staff. That’s it. Knowing is half the battle. You train your users and there’s a good portion of your concern that goes away because, be it phishing or malware, it usually ends up with someone having opened an email or gone to a website that, God forbid, the sysadmins didn’t block.

Nathan: You’re not going to stop the employees; the employees are going to have time off. They’re going to go on the internet, and they’re going to look at emails. There’s no 100% block for any of that. So, the faster and more thorough you train your staff, the easier it’s going to be on your IT staff, on your attorney budget, and just everything as a whole.

Tyler Smith: And if you fail to educate people about security, you can invest millions in security, and Steve from accounting who doesn’t know what he’s doing clicks on a link in an email, and he’s completely negated every measure you’ve implemented.

Nathan: I feel so bad for accounting. It’s always somebody from accounting.

Tyler Smith: Yeah.

Nathan: I mean, they’re the ones that have the money. Malware is usually about money, and they’re going to go right to the people who control it.

Tyler Smith: The larger thing is targeted training. The people who have the ability to control funds and direct them should be at the upper end of the priority list as far as receiving this training goes. Again, you do everything right, but if somebody doesn’t know what they’re doing, they’ll screw it up.

Nathan: Because you can’t protect people from themselves. Honestly, a good portion of what these appliances do is attempt to protect the end user from themselves, and there’s just no such thing. You just need to train. It all comes down to training. Start training people and just watch the incidents drop.

Tyler Smith: At the same time, while you train, if you do run into an incident, train the end user on what they did, what it caused, and how to remediate. The more you educate, even in troubleshooting, you make them more knowledgeable, more powerful, and more capable of preventing that in the future.

Nathan: Education can take a few forms. If someone does something that violates company policy, you need to address it. In previous organizations where I was running the DLP program for the enterprise, you’d see 200 or 300 hits a day on the DLP system—violations of policy. And you go ask somebody, “Why are there so many?” and they say, “Oh, well, we can’t bother these people. They’re too important. We don’t want to upset them.” I didn’t listen to that at all; I did the exact opposite. It took about 90 days, but we cut that number to a third of what it was because when you looked at who it was, it was the same people violating policy over and over. If you never reach out and tell them they’re violating a policy, and you never educate them on the proper way of doing something, they’re not going to change. It’s like looking at the neighbor kid, expecting him to mow your grass, but never saying anything to him about it. You’re not going to get the lawn cut that way. It’s the same thing with fixing human issues within the enterprise, because most of those people violating policy were doing it because it was part of a broken business practice that was never addressed. When you go back to them and say, “Look, we have a special process for what you’re trying to do. Do it this way. Stop doing it the way you were doing it,” people want to do the right thing. They just need to know what that is.

Tyler Smith: Well, thank you for coming today.

Nathan: Absolutely.

Tyler Smith: And thank you guys for listening. For more information, we will include some resources in the show notes, so check those out. Also, please subscribe to our podcast and we will see you guys next time.

Sunaina: Bye, everyone.