What is a human firewall and how do you secure it?

ramsac   623235470

Worldwide spending on information security products and services is more than $114 billion. But the most secure cybersecurity systems can be undone by a Post-It note. That’s why every business needs a secure human firewall.

What is a human firewall?

A human firewall describes a group of people or employees who work together to prevent cyberattacks, data breaches or suspicious activity, often within a business. A firewall should form part of an organisation’s multi-layered cybersecurity strategy aimed at combating the ongoing threat of cyber criminals and protecting sensitive data. Yet, while a human firewall is our biggest line of defence against cybercrime, it is also our biggest risk. It’s the relationship between us and technology. It’s what protects us from exposing ourselves to risk when technology appears benign.

Here’s an easy example: Your human firewall is that part of you that says “This is too good to be true” when a mysterious millionaire wants to send you money via bank transfer.

That’s an old scam, but it still works. And today, cybercriminals are devising subtler ways to breach our human firewall. To the ruin of lives and businesses.

Cybersecurity is a numbers game. Criminals only need the tiniest bit of information to do extraordinary things. While cybersecurity software can protect your systems, humans aren’t as good at spotting threats. Because we’re just that: human.

That’s why the human firewall has to be strong.

How does a human firewall work?

A human firewall is a concept that dictates human thought before action relating to cybersecurity. For example, you receive an email from your boss asking you to buy a selection of gift cards. However, before you take any action or make any purchase, you decide it is better to confirm with your boss that it was them that sent the email requesting you buy gift cards, and not a cybercriminal.

Or, if you get a message asking for bank details to confirm a payment, you check who has sent the email and ensure it’s the email address you expect.

All of these checks that a computer can’t do for us make up the human firewall. To create a human firewall, people need regular training and awareness, as well as up to date information on the latest threats. When employees receive the appropriate training to strengthen the human firewall, they will better protect your IT network from extremely damaging cyberattacks.

Why is a human firewall important?

A human firewall is important because everyone who has access to your systems is also a potential vulnerability. And we aren’t just talking people who aren’t “digital natives”.

From business leaders to young people,, it’s surprising that everyone behaves the same way. We all expose ourselves to cyber risk, no matter how tech-savvy we think we are.

Everyone thinks they’re safe and secure online. We trust the coffee shop Wi-Fi. We see no harm in Liking the Facebook page. But as you’ll see in the video below, safety is not guaranteed…

When we use the internet, we leave a trail of digital breadcrumbs everywhere we go. Any cyber criminal can pick up this trail and scam you, or your colleagues, friends and family.

“Every 3 seconds someone suffers from identity theft.”

How does a cyber breach affect your business?

The average cost of a cybersecurity breach to a business is both high and widespread. You don’t only have to consider the material cost and potential fines, but long-term factors, too.

According to Deloitte, 30% of consumers said they would stop dealing with a business hit by cybersecurity breach, even if they don’t suffer personally. According to Aviva, after you suffer a breach, 60% of your customers will think about moving. And 30% actually do.

Ultimately, a cybersecurity breach will almost certainly have a negative impact on company profit given the estimated cost. That, in turn, could be extremely detrimental to a number of other financial factors including share price which could lead to a loss of confidence from stakeholders and investors.

How to improve your human firewall

Humans design secure systems that grant access when the correct information is entered at the right time. Technology isn’t smart enough to know the true identity of the person inputting that information. Or what their true intentions are. A human firewall is a layer of physical cybersecurity that can help keep your systems secure.

One person cannot maintain the human firewall. It requires everyone in the business to maintain awareness and security.

You can improve your human firewall through:

  • regular training
  • cybersecurity updates against the latest kinds of breaches
  • a clear way to report suspected incidents

More often than not, your staff are victims of cybercrime. 25% of staff who cause breaches are inadvertent actors. You can protect them by only allowing access to information on a “need to know” basis. If a company of 100 people only grants personal data to a payroll team of 3, hackers will have a much harder time accessing that information.

The benefits and limitations of training

Many organisations and individuals that have fallen foul of ‘phishing’ or ‘whaling’ scams. All of these could have been preventable if the right training and knowledge was in place.

All organisations should be spending the equivalent of between 30-60% of their IT budget on staff training in IT. A good proportion of that should go towards cybersecurity.

Despite this, only 1 in 5 businesses in the UK carries out any form of cyber training. If you ask them about that training, they’ll likely tell you that there’s a policy document. Or there’s something about it in the employee handbook.

In order for someone to “know” something, they need to be told about six times. For larger organisations, 50-minute refresher training every 6 months is not enough to keep staff trained on cybersecurity.

However, training is very important. CEOs and other senior managers are especially in need of training for two reasons:

  • They are the people who are least likely have taken training in the past
  • They are most likely to be the targets of cybercrime

40% of senior managers in a BAE Systems survey said they lack understanding of their own company’s cybersecurity protocols. But if you’re the boss, you’re an attractive target for cyber criminals.

That’s why ramsac run in-depth training courses in cybersecurity to help business leaders stay up-to-date and informed about the latest cyber risks.

Being the human firewall

Being the human firewall means making the right judgement every time you receive an email or decide to connect to a network.

We need to create a culture that is curious and cautious. A culture that rewards people who take the time to pick up the phone and double check with the CEO that the email they sent really was from them.

People need to have accountability if they’re the ones in the hot seat. But, they need to trust that it’s okay to turn to the most senior person in the business and confirm their orders.

It’s all too easy for staff to pass the buck up the line. Especially if requests for assurance are interpreted as belligerence or interfering. In this way, creating a more open office culture can help protect you from cyberattacks.

Challenge your staff to question the norms. It doesn’t just help protect your business. It creates a workplace of innovation and ideas.

Cybersecurity is not an IT problem

Cybersecurity affects everyone. Not just in our professional lives, but in our personal lives too. It’s everyone’s responsibility to stay aware of the threats out there and mindful of danger every day.

Cybercrime is evolving and companies are being exposed to new scams every day. When we build a culture that’s mindful of cybersecurity, we can protect ourselves and our businesses more effectively.

ramsac can help you change the way your business thinks about cybersecurity. Our new Cyber Resilience Certification tests how ready you are for a cyberattack, and provides you with a grade depending on your competence. For cyber protection and peace of mind, contact ramsac now.

Related Posts

  • Inherent risk vs residual risk: What’s the difference?

    Inherent risk vs residual risk: What’s the difference?


    Inherent risk and residual risk are key elements of any effective risk management process designed to strengthen cybersecurity defences and protect your company’s data. Read on. [...]

    Read article

  • What is cybersecurity monitoring? How important is it in 2024?

    What is cybersecurity monitoring? How important is it in 2024?


    Cybersecurity monitoring is the continuous surveillance of digital systems to detect and respond to security threats and data breaches in real-time. Discover how cybersecurity monitoring software can protect your [...]

    Read article

  • Examples of sensitive data in your organisation

    Examples of sensitive data in your organisation


    Any confidential information that’s stored, processed, or managed by an organisation or individual is classified as sensitive data. Read our sensitive data examples today. [...]

    Read article

  • How to set up a secure password policy in Microsoft 365

    How to set up a secure password policy in Microsoft 365


    Discover the essentials of a robust password policy for cybersecurity in Microsoft 365. Learn what to include and what to avoid. Read the blog today. [...]

    Read article

  • A guide to sensitivity labels and how to apply them

    A guide to sensitivity labels and how to apply them


    Sensitivity labels allow you to manage, organise, and protect sensitive emails, files, and documents as part of the Microsoft 365 suite. Read on. [...]

    Read article

  • MFA vs 2FA: What’s the Difference?

    MFA vs 2FA: What’s the Difference?


    Features like user facial recognition that are difficult to replicate means multi-factor authentication offers more cybersecurity layers than two-factor authentication. Find out more. [...]

    Read article

Quiz yourself

Are you more cyber savvy than an 11 year old?

11-14 year olds get asked these questions in school. Could you get these right?