Recent stories of hacking, FBI investigations and foreign influence on our elections will undoubtedly result in new legislation and vigor enforcing compliance with information security regulation and best practice. The organizations "hacked" had the best security money can buy -- Firewalls, secure facilities, encryption and still sensitive information ended up in the hands of bad actors due to the most common and simple method of attack. The take away? The most vulnerable aspect of any security program is people -- Me, you, us!
The majority of "security spend" by business is on devices and technology designed to fluxom super-nerd hackers probing hardened systems for weakness. Little time and money is spent addressing the most vulnerable and frequently exploited aspect of the security equation. A colleague recently said to me, "If I had a security budget I'd spend 75% of it training our faculty and staff. I have an equipment budget, so I buy security equipment because it's necessary, we know how to do it, and I don't need the cooperation of others to get it done." The comment was offered with the wry grin and chuckle that only the truly frustrated can muster.
There is a certain wisdom in this statement that we all need to acknowledge, embrace, own and act upon. Does anyone build a wicker safe and then purchase the best safe door money can buy to make it better? Sadly, yes and it's common practice. Recent events should be interpreted as a call to action to secure ourselves and Knox by strengthening the most vulnerable aspect of our program. How can we turn wicker into steel? Read on...
