It isn’t often mentioned, but most computer security will admit it when asked. Network security failures are often the result of human error — rather than a malicious attack from a hacker somewhere in Novosibirsk. The technology is in place and so are the security procedures that all employees are meant to follow, but still something goes wrong.
“I would estimate that half or more of security breaches are not highly organized criminals trying to steal your corporate information,” says Laura Koetzle, principal computing and security analyst at Forrester Research in Cambridge, Mass. “They are stupid things that happen. Most of these things are committed in ignorance.”
With ever-increasing external threats compounded by unpredictable computer users, a CIO’s challenge can be daunting. That’s one reason why CIOs should seek out new security products that anticipate computer-user mistakes as a given.
Along with new technologies that account for human error, experts also recommend clear communication of desktop security procedures along with security audits to help to put a spotlight on human errors, procedural slips or equipment misconfiguration.
“Make your rules easy to follow,” Koetzle suggests. “You need a one-pager in plain English. Tell them what to do and what not to do.”
But, she cautions: “The process only works if you motivate people.”
Improper Configuration
Of course, it’s not always the IT department’s customers who are causing the trouble. Sometimes human error means that security tools aren’t configured properly or have not been maintained or updated on schedule. According to Deloitte Touche Tohmatsu’s 2004 Global Security Survey, one third of senior information technology executives said security technologies acquired by their organizations were not being utilized effectively.
Auditing products can help. Preventsys, for example, points out that while many firms have strong security policies, their networks aren’t audited often enough to see if the policies are being honored. Firms such as Preventsys offer a variety of auditing tools while KaVaDo Inc.’s ScanDo performs Web application scanning to identify security loopholes in Web applications and recommends solutions. Outside consultants also be hired to perform audits, said Koetzle.