How secure is your human firewall?
Posted on June 13, 2019 by James Haigh
Worldwide spending on information security products and services is more than $114 billion. But the most secure cybersecurity systems can be undone by a Post-It note. That’s why every business needs a secure human firewall.
What is a human firewall?
A human firewall is our biggest line of defence against cybercrime. But it is also our biggest risk. It’s the relationship between us and technology. It’s what protects us from exposing ourselves to risk when technology appears benign.
Here’s an easy example: Your human firewall is that part of you that says “This is too good to be true” when a mysterious millionaire wants to send you money via bank transfer.
That’s an old scam, but it still works. And today, cyber criminals are devising subtler ways to breach our human firewall. To the ruin of lives and businesses.
Cybersecurity is a numbers game. Criminals only need the tiniest bit of information to do extraordinary things. While cybersecurity software can protect your systems, humans aren’t as good at spotting threats. Because we’re just that: human.
That’s why the human firewall has to be strong.
Why is a human firewall important?
A human firewall is important because everyone who has access to your systems is also a potential vulnerability. And we aren’t just talking people who aren’t “digital natives”.
Whether I’m talking to business leaders as part of my job, and to people in my role as a Youth Worker, it’s surprising that everyone behaves the same way. We all expose ourselves to cyber risk, no matter how tech-savvy we think we are.
Everyone thinks they’re safe and secure online. We trust the coffee shop Wi-Fi. We see no harm in Liking the Facebook page. But as you’ll see in the video below, safety is not guaranteed…
When we use the internet, we leave a trail of digital breadcrumbs everywhere we go. Any cyber criminal can pick up this trail and scam you, or your colleagues, friends and family.
“Every 3 seconds someone suffers from identity theft.”
Cost to businesses
The average cost of a cybersecurity breach to a business is both high and widespread. You don’t only have to consider the material cost and potential fines, but long term factors, too.
According to Deloitte, 30% of consumers said they would stop dealing with a business hit by cybersecurity breach, even if they don’t suffer personally. According to Aviva, after you suffer a breach, 60% of your customers will think about moving. And 30% actually do.
You can’t leave security to technology
We design secure systems that grant access when the correct information is entered at the right time. Technology isn’t smart enough to know the true identity of the person inputting that information. Or what their true intentions are. A human firewall is a layer of physical cybersecurity that can help keep your “secure” systems secure.
How to improve your human firewall
One person cannot maintain the human firewall. It requires everyone in the business to maintain awareness and security.
The benefits & limitations of training
Many organisations and individuals that have fallen foul of ‘phishing’ or ‘whaling’ scams. All of these could have been preventable if the right training and knowledge was in place.
I recently attended an IT forum. There, it was decided that all organisations should be spending the equivalent of between 30-60% of their IT budget on staff training in IT. A good proportion of that should go towards cybersecurity.
Despite this, only 1 in 5 businesses in the UK carries out any form of cyber training. If you ask them about that training, they’ll likely tell you that there’s a policy document. Or there’s something about it in the employee handbook.
This is understandable. I understand that if your business has high staff turnover, or hundreds of staff, rolling out training can is expensive and time-consuming.
In order for someone to “know” something, they need to be told about six times. For larger organisations, 50-minute refresher training every 6 months is not enough to keep staff trained on cybersecurity.
However, training is very important. CEOs and other senior managers are especially in need of training for two reasons:
- They are the people who are least likely have taken training in the past
- They are most likely to be the targets of cybercrime
40% of senior managers in a BAE Systems survey said they lack understanding of their own company’s cybersecurity protocols. But if you’re the boss, you’re an attractive target for cyber criminals.
So, if you can’t train everyone, train your key personnel. But in order to make your human firewall really strong, training isn’t enough.
You need to change the culture.
Prioritise your information
More often than not, your staff are victims, not symptoms of cyber crime. 25% of staff who cause breaches are inadvertent actors. You can protect them by only allowing access to information on a “need to know” basis.
If a company of 100 people only grants personal data to a payroll team of 3, hackers will have a much harder time accessing that information.
Being the human firewall
Being the human firewall means making the right judgement every time you receive an email or decide to connect to a network.
We need to create a culture that is curious and cautious. A culture that rewards people who take the time to pick up the phone and double check with the CEO that the email they sent really was from them.
People need to have accountability if they’re the ones in the hot seat. But, they need to trust that it’s okay to turn to the most senior person in the business and confirm their orders.
It’s all too easy for staff to pass the buck up the line. Especially if requests for assurance are interpreted as belligerence or interfering. In this way, creating a more open office culture can help protect you from cyber attacks.
Challenge your staff to question the norms. It doesn’t just help protect your business. It creates a workplace of innovation and ideas.
Cybersecurity is not an IT problem
Cybersecurity affects everyone. Not just in our professional lives, but in our personal lives too. It’s everyone’s responsibility to stay aware of the threats out there and mindful of danger every day.
That sounds exhausting, I know. But vigilance is key. Cybercrime is evolving and companies are being exposed to new scams every day. When we build a culture that’s mindful of cybersecurity, we can protect ourselves and our businesses more effectively.
ramsac can help you change the way your business thinks about cybersecurity. Speak to us today about how we can help you reinforce your human firewall.