creative soul - Fotolia

News

DerbyCon panel discusses IT mistakes that need to stop

Common security risks can be mitigated or prevented, according to a panel at DerbyCon. But users need to feel empowered to speak up, and education needs to be better.

Michael Heller
By
Published: 12 Sep 2019

A panel of experts at DerbyCon discussed common IT mistakes that they don't want to see happen anymore and offered some suggestions on how to avoid risks.

The talk broke down the IT mistakes the panelists thought needed to stop, ranging from basic security issues to more technical problems. The panelists included Lesley Carhart, principal threat analyst at Dragos Inc.; Chelle Clements, web content developer at Online Marketing and Publishing; April Wright, an application security architect; and Amanda Berlin, senior security architect at Blumira and CEO of Mental Health Hackers.

As the discussion went on, themes began to surface around education, communication and empowering users. Wright and Clements were advocates for not just better educating users, but finding ways to make that education more personal.

Wright focused on IT mistakes like oversharing on social media. She said oversharing can easily become a problem for enterprises, because all of that data can be used to spear-phish users and potentially gain access to a company network. 

"One thing that can be done to curb oversharing is to train users how to protect their families and themselves outside of work. Users need to understand what they're doing and how it impacts others," Wright said. "Learning to protect themselves will make them more aware and better advocates. If security isn't personal to them, they won't care, because they don't care about your data; they care about their data."

Clements agreed and cautioned users against oversharing on social media, as it "eventually comes back to bite them in the ass."

She also added that basic security concerns are still an issue, including using bad passwords, visiting shady websites, opening email messages from unknown senders and clicking links within those messages.

Clements said finding better training methods is a must. She described security training that she set up over the years, including one-on-one sessions when possible, because "you may need a unique language to explain something. The way you explain something to a physicist will be different than a chemist."

Wright added that there needs to be better training around the limitations of security products, because IT mistakes can come from users trusting products too much.

"A lot of people feel like they're more protected than they really are. We [need to] teach them about the failings of what the technology is that's designed to protect them," Wright said. "The blinky boxes are great, but it's really education that's going to solve the problems of the users. It's not putting in a bunch of things to protect them, like putting them in a rubber room. It's teaching them that things are sharp and things are hot, and they shouldn't touch them."

Berlin added that these types of IT mistakes can happen with administrators, as well, who might not understand that a security product is "not a magic solution that you can just install and you're done," including not configuring products after installing them.

"It's an ongoing process that you have to keep revisiting. If you have an MSSP [managed security services provider] or you're doing it internally, that's going to be someone's full-time job. It's something that you need to treat less of a project and more of an ongoing thing," Berlin said. "Work closer with your security vendors and all your other vendors. They're usually there to help you, and you are paying them. Keep them accountable. Actually work through the implementation, and make sure they're continuously working on it and they don't install it and forget it, as well."

Beyond educating users, Carhart said IT staff needs to stop expecting security products to be perfect, because they are all just deterrents and, "ultimately, everybody is going to be vulnerable to phishing or a breach."

"If you have a house, you put a door on that house, and that deters neighborhood kids from walking in. You put on a deadbolt, and that deters the casual thief. Then, maybe you put in an alarm system, and that deters the more dedicated [thieves]. But if someone is paying $10,000 to hire a hit man to kill you? Guess what that hit man is doing? He's coming in and killing you. You're going to die. I'm sorry," Carhart said. "Security is like that. We add defense in depth, and we deter and deter, but people have to understand that you have to plan for that worst-case scenario."

Empowering users

Carhart noted that many IT mistakes stem from users not feeling empowered to speak up, especially if they feel embarrassed after making a mistake. She said users need to be comfortable demanding better security and privacy from vendors, and be sure to speak up when the IT staff is asking for too much.

"We have all these tropes that we keep using over and over again, like, 'Use a strong password, use a password manager,' and stuff. And, sometimes, those are really tricky things to do," Carhart said. "Have you ever tried to convert all of your passwords saved in a bunch of browsers to a password manager? That's not an intuitive process. That's really, really hard to do. So, I would like to see more end users tell their security people to go F themselves. Tell us when something is too hard."

One reason users might not speak up, according to Wright, comes from social norms and users trying to be polite. This can lead to IT mistakes, because users aren't willing to put themselves "in an uncomfortable situation" and ask questions regarding potential security incidents. 

"This is a very hard thing to fix. It's a culture thing; it's an education thing; it's a training thing, where you have to make sure that people understand they have the power to make or break the security controls that you have in place," Wright said.

She added later that this can happen because users don't listen to their instincts. "If you don't listen to that voice [in your head] ... you might notice things, but you're not going to pay attention them."

Carhart added that even those with no security expertise should feel empowered to speak up and "realize that security isn't magic. It's something they can learn about."

"I'm in industrial control systems now, and I'm dealing with a lot of eclectic legacy systems from the '70s and '80s. The people who know those systems the best are the guys or girls who have been there for 30 years. They might not know everything about security, but they could be very interested in it," Carhart said. "I'd like, as a solution to that problem, to have users remember that they can contribute to security, and there are elements of knowledge that they bring to the table that we don't have."

Berlin noted that communication issues can also be a problem with red and blue teams, especially if those teams aren't paired up.

"It's a really big problem when it comes to doing defensive stuff, because we can't fix what we don't know is broken, especially when you're a contractor or an MSSP, because you don't know the networks and everything that they have internally, as well as the red teamer that broke in or their internal team," Berlin said.

Next Steps

9 common risk management failures and how to avoid them

Dig Deeper on Risk management