The Human Element of Security - Twenty-Four Seven Security

« Is Security Like a Beautiful Woman? | Main | Security Rules for Web 2.0 »

October 10, 2007
The Human Element of Security

I've blogged and podcasted a bit in this space about all the various features and applications and resources a company needs to protect their systems in these dangerous times. But what I haven't mentioned in awhile is the one resource that has remained stubbornly difficult to completely secure: the human resource.

Came across an entry in Jeff Hayes' Security Blog where, seated in a sports' bar in an East Coast city, he struck up a conversation with someone next to him, and in a fairly short time the person, who was responsible for physical security for a major international accounting firm, was revealing information any bad guy would love to have if they were looking to hack that company's system.

That just goes to show you that even if our security software protected us against every single vulnerability known and unknown, it is the human element that will keep cybercriminals in business for a long, long time. In his blog, Hayes mentions the acronym MICE, which is well known by spies. It stands for money, idealogy, coercion, and ego, and represents the vulnerabilities that can be used to exploit humans for benefit.

The only defense we have against all of the human vulnerabilities is information and training. Employees need to be told (often again and again) how they represent one of the biggest threats to their systems. In essence, companies need to communicate to their employees that they need to control all points of data contact, both incoming and outgoing, and yes, that even stands for people sitting beside you in a sports' bar.