Reducing Security Risks Due to Human Error - Information Security Summit, Kuala Lumpur, Malaysia, June, 2011

Security Don’t tell anyone,
Policy my password is…..

Never share
passwords

A model for reducing information security risks due to human
error By Anup Narayanan,
Founder & CEO, ISQ World

Nelson Mandela offers you a glass of water….

This man…. offers you a glass of water

Question
Which water will you
accept?
Why?

1. Objective: Describe a workable
model for reducing information
security risks due to human error
2. Talk Plan:
We are here
I. Differentiate between
“Awareness” & “Behavior”
II. Case study
III. Solution model
IV. Resources

© First Legion Consulting 5

Awareness?

Do not share passwords!

Shred
documents
before
disposing

Behavior?


Putting it together….

Awareness: Behavior: Culture:

I know I do We do


2. Talk Plan:
We are here II. Case study
III. Solution model
IV. Recap & Resources


Case-study:

Client: One of the largest mobile service
providers in the world

• What? Spent US$ 100, 000 on a security
awareness campaign

• How? Screen Savers, Posters, Emailers

• Who? Target - Entire employees

What did we do?

“Awareness vs. behavior” benchmarking
and produced a scorecard


The scorecard


Reason 1: Operational issues ….

If I don’t share my password,
salaries won’t get processed Response by HR
Manager
here…including that of the
InfoSec manager.

Message in the poster

Don’t share
passwords


Reason 2: Confusion ... Too many rules

Which one
do I follow?


Reason 3: Perception…

Which is safer?

Reason 4: Attitude … influenced by cost…(peer
pressure, top management behavior)

Nothing’s gonna happen to me
if I violate the security policies?

Well, I saw her doing it …shall
I?


“Awareness” & “Behavior”: Independent but
interdependent
Question : A person knows the traffic rules. Does that make the
person a good driver?
Answer: Not necessarily, “Knowing” and “Doing” are two
different things

Question: A person knows the “information security rules”. Does
that make the person a responsible information security
practitioner?
Answer: Same as above

Knowing = Awareness
Doing = Behavior

2. Talk Plan:
II. Case study
We are here III. Solution model
IV. Recap & Resources


• HIMIS – Human Impact
Management for
Information Security
• Objective – To provide a
model to reduce security
risks due to human error
• Creative Commons
License, free for non-
commercial use
• Download –
http://www.isqworld.com
, click on the HIMIS link

HIMIS solution model - Work backwards

Responsible
information
Define Strategize Deliver Verify security
behavior


Define Strategize Deliver Verify

• Choose ESP's (Expected Security Practices) information
security awareness and behaviour requirements valid
for the business
• Review and approval of ESP’s
• Baseline ESP assessment


ESP:
Information
Classification

Awareness Behaviour
Criterion criterion

The employees must
The employees must The employees must
actually classify
know the different know how to specify the
document in day-to-day
information classification classification, for
work. The evidence of
criterion : "Confidential, example, in the footer of
this classification must
Internal, Public" each document
be available.

• For awareness management
– Coverage
– Format & visibility: Verbal, Paper and Electronic
– Frequency
– Quality of content
• Impact visualization
• Clarity & ease of understanding
• Business relevance
• Consideration of cultural factors
– Retention measurement.
• For behavior management
– Motivational strategies
– Enforcement/ disciplinary strategies

Quality of content
• Impact visualization
• Clarity & ease of understanding
• Business relevance Yup! Not the usual glorified
• Consideration of cultural factors power point

Wow! This security
awareness video is so cool!


A 120 minute training plan
• 120 minutes of training in a year
– 45 minutes classroom or e-learning
– 15 minutes screen saver (12 X 1 to 1.5 minutes)
– 15 minutes posters/ wallpaper (same as above)
– 30 minutes through short videos (6 x 5 minutes)
– 20 minutes through quizzes/ surveys (2 x 10 minutes)

Behavior management: What works?

Let’s cut his Let’s talk to
email access him
Let’s fire him


Poor Security behavior Vs.
Inconvenience

Poor
security
behavior

In-convenience


Poor Security behavior Vs. Cost

Poor
security
behavior

Cost
(Enforcement)

Case study 1: Changing behavior (IT Service Provider)

• What we did?
– Quarterly “End-User
Desktop Audits”
– Findings were noted and
“Signed and Agreed by
Auditee”
– Disputes were noted and
“Signed”
– Audit findings were
submitted to InfoSec
Team


Case study 1: Changing behavior (Electronic Retail Store)

• Audit finding: Cash boxes are left open when
unattended

• Cost attached: Branch manager will lose 25% of
annual bonus for every violation

• Compliance today is above 98%


• Define tolerable deviation
• Efficiency
• Collection of feedback
• Confirmation of receipt



• Audit strategy
– Selection of ESP’s
– Define sample size
– Audit methods
• For awareness: Interviews, Surveys, Quizzes, Mind-map
sessions
• For behavior: Observation, data mining, Log review,
Review of incident reports, Social engineering?
– Reasonable limitations
– Behavior may not always be visible


2. Talk Plan:
II. Case study
III. Solution model
We are here IV. Recap & Resources


Recap

Responsible
information
Define Strategize Deliver Verify security
behavior


Tip! Get HR buy-in
People are my
People are my biggest threat!
biggest asset!

HR InfoSec
manager Manager

You must talk the same thing!

Conclusion
If you can influence perception, you can influence the
way people choose or react (behavior)

Perception is influenced if there is a cost for an
action


If I follow the information
security rules will I gain
something. If I don’t follow,
will I lose something?

When you get your users’ to think
this way, you are on your way to a
better information security
culture!


Resources
• Free security awareness videos –
www.isqworld.com
• Bruce Schneier – The Psychology of Security -
http://www.schneier.com/essay-155.pdf
• The Information Security Management
Maturity Model (ISM3) – www.ism3.com


Anup Narayanan,
Founder & Principal Architect
ISQ World, A First Legion Initiative
anup@isqworld.com
www.isqworld.com


Reducing Security Risks Due to Human Error - Information Security Summit, Kuala Lumpur, Malaysia, June, 2011

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Reducing Security Risks Due to Human Error - Information Security Summit, Kuala Lumpur, Malaysia, June, 2011

Ähnlich wie Reducing Security Risks Due to Human Error - Information Security Summit, Kuala Lumpur, Malaysia, June, 2011 (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Reducing Security Risks Due to Human Error - Information Security Summit, Kuala Lumpur, Malaysia, June, 2011