Cybersecurity
Rethink cybersecurity from the human element point of view
Vision
July 16, 2024
Over simplifying, IT security means defending IT systems from threats procured by cyber criminals. Their targets are, for example, the manipulation of systems, the extorsion or exfiltration of data, and the interruption or alteration of services. However, what happens if we have humans instead of IT systems? Given that the scope of an attacker is always the same, as aforementioned, attacking a human is an entirely different process, and the attack tactics must change. This well-known fact involves social engineering and human sciences (e.g., psychologists or behavioural sciences instead of informatics). However, from the cyber security side of the coin, what does it imply to deal with humans? What does it mean, for example, to perform convincing penetration testing or vulnerability scanning to deeply test human weaknesses: it is not merely a problem of sending a phishing email and waiting for clicks. How can be done a threat analysis or threat intelligence on humans? Moreover, how can a company calculate the cyber risk that a human represents and how many effective ways to reduce it? If we fully put humans (either as employees or IT security operators) at the centre of cybersecurity, the questions become several.
Risk and perception: what are the links and implications in cybersecurity?
In the book The Black Swan, Nassim Taleb describes the links between the concepts of risks and perception: if a person has not experienced a certain event, he will probably tend to underestimate the possibility that the event will touch him directly. As hypothesised by the sociologist Ulrich Beck , a theorist of the risk society, it is possible to anticipate dangers and overcome fears only if we understand that risk is at the centre of the life of each of us. This lesson applies to risk in its most general and broadest sense, but it can also be applied to cyber risk and IT/OT security incident teams. Understanding risk (including digital risk) is fundamental to knowing how to orient oneself in a period of crisis never experienced before, above all, to understand in which direction to move.
Since risk cannot be eliminated, it must therefore be understood and anticipated. Anticipating the risk serves to consider that the worst may happen but also question one’s certainties, beliefs, prejudices, ideologies, etc. Cyber risks provoked by humans are affecting employees and security operators differently. Employees usually are hit today by social engineering enabled threats, which drive them to perform risky actions .
This is a common pitfall in IT companies but is also becoming problematic in OT implants. Like healthcare, the motivation lies, besides the increased exposition of OT implants on the internet, behind the different security cultures of OT operators.
However, there are also humans in the security defence teams. Another human-related source of cyber risks, not often considered, lies in the SOC operators or, in general, in humans involved in defence teams. Let us concentrate on this second aspect: inconsistencies or misunderstandings among IT/OT SOC operators lead to underestimations of crisis and ultimately to increased cyber risk. Fink et al. report that “helping IT and OT operators to collaborate” reduces cyber risks. However, this area of research is still in its infancy, given the low number of relevant publications.
Since risk cannot be eliminated, it must therefore be understood and anticipated. Anticipating the risk serves to consider that the worst may happen but also question one’s certainties, beliefs, prejudices, ideologies, etc. Cyber risks provoked by humans are affecting employees and security operators differently. Employees usually are hit today by social engineering enabled threats, which drive them to perform risky actions .
This is a common pitfall in IT companies but is also becoming problematic in OT implants. Like healthcare, the motivation lies, besides the increased exposition of OT implants on the internet, behind the different security cultures of OT operators.
However, there are also humans in the security defence teams. Another human-related source of cyber risks, not often considered, lies in the SOC operators or, in general, in humans involved in defence teams. Let us concentrate on this second aspect: inconsistencies or misunderstandings among IT/OT SOC operators lead to underestimations of crisis and ultimately to increased cyber risk. Fink et al. report that “helping IT and OT operators to collaborate” reduces cyber risks. However, this area of research is still in its infancy, given the low number of relevant publications.
The value of cyber-risk-driven co-design
To do a complete cyber risk management lifecycle in cybersecurity, we, therefore, need to handle the twofold problem: extend the cyber risk modelling to include the consequences of the human-related threats discussed (i.e., building on the results of the EU project DOGANA www.dogana-project.eu) and with a Cyber-risk-driven co-design of the human element to optimise IT and OT security teams’ communications.
Cyber-risk-driven co-design of the human element aims to solve the communication problems between IT and OT teams to reduce human-related cyber risks arising from inconsistencies in the teams’ interactions. From a general point of view, IT and OT security teams have different mindsets and cultures. The most crucial point in communication lies in the difficulty of coordinating users with different experiences and languages.
Cyber-risk-driven co-design of the human element aims to solve the communication problems between IT and OT teams to reduce human-related cyber risks arising from inconsistencies in the teams’ interactions. From a general point of view, IT and OT security teams have different mindsets and cultures. The most crucial point in communication lies in the difficulty of coordinating users with different experiences and languages.
Enrico Frumento
Cybersecurity Domain Expert, Cefriel