The insider threat: understanding human behavior that impacts cyber-resilience
When a cyberattack occurs, it’s easy to point fingers at users who may have caused it, albeit inadvertently, but these accusations are toxic and counterproductive.
Instead, it is better to delve into what are the human behaviors that cause that cybersecurity incident. In fact, according to the latest studies, systems would not necessarily be safer without users: people can be an important ally, especially with proper training.
How to account for human behavior
If one reads research on electronic fraud (phishing), one finds that approximately 10% of users will be victims of this type of attack. This is a good example of a case where people’s behavior needs to be taken into account. If your strategy hinges on trusting employees not to follow links or open attachments, even though the latter is crucial in areas like recruiting, then you realize how important it is to have a resiliency strategy.
The strategy should therefore ensure that if a user becomes a security vulnerability, you can prevent, detect, or at least mitigate malicious activity.
Design of user-centered security systems
Users are generally not cybersecurity experts, so asking them to make decisions between ‘everything is fine’ or ‘the company is on fire’ simply by clicking on one or two options is probably not going to work at all. well.
That’s when user-centric security design becomes effective. Simply put, this is where process flow, user experience, and day-to-day operations need to be considered.
New insider threat management models
Managing the risk of an insider threat depends, above all, on how robust Identity and Access Management (IAM) is, along with behavioral monitoring to identify suspicious or outright malicious behavior.
However, this management should not focus only on the people who use the system. With more and more interactions between machines, and therefore between applications, it is equally essential to consider them part of the overall solution.
That is why we no longer only talk about User Behavior Analysis (UBA), but User and Entity Behavior Analysis (UEBA).