Human Error: The 'Oops' Factor

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

Training, audits and a new breed of technology solutions can help protect corporate networks from a common (and dangerous) adversary: humans.

It isn’t often mentioned, but most computer security will admit it when asked. Network security failures are often the result of human error — rather than a malicious attack from a hacker somewhere in Novosibirsk. The technology is in place and so are the security procedures that all employees are meant to follow, but still something goes wrong.

”I would estimate that half or more of security breaches are not highly organized criminals trying to steal your corporate information,” says Laura Koetzle, principal computing and security analyst at Forrester Research in Cambridge, Mass. ”They are stupid things that happen. Most of these things are committed in ignorance.”

With ever-increasing external threats compounded by unpredictable computer users, a CIO’s challenge can be daunting. That’s one reason why CIOs should seek out new security products that anticipate computer-user mistakes as a given.

Along with new technologies that account for human error, experts also recommend clear communication of desktop security procedures along with security audits to help to put a spotlight on human errors, procedural slips or equipment misconfiguration.

”Make your rules easy to follow,” Koetzle suggests. ”You need a one-pager in plain English. Tell them what to do and what not to do.”

But, she cautions: ”The process only works if you motivate people.”

Improper Configuration

Of course, it’s not always the IT department’s customers who are causing the trouble. Sometimes human error means that security tools aren’t configured properly or have not been maintained or updated on schedule. According to Deloitte Touche Tohmatsu’s 2004 Global Security Survey, one third of senior information technology executives said security technologies acquired by their organizations were not being utilized effectively.

Auditing products can help. Preventsys, for example, points out that while many firms have strong security policies, their networks aren’t audited often enough to see if the policies are being honored. Firms such as Preventsys offer a variety of auditing tools while KaVaDo Inc.’s ScanDo performs Web application scanning to identify security loopholes in Web applications and recommends solutions. Outside consultants also be hired to perform audits, said Koetzle.

Still, Koetzle stresses that network security is a three-legged stool supported by people, process and technology. All three legs must be in place for the stool to stand. Even when good technology is in place and security processes have been outlined, it’s generally people who topple the stool.

Consider Trojan horses. No matter how many times employees are told not to download e-mail attachments, it’s usually just a matter of time before someone succumbs to curiosity and opens a file that, unbeknownst to them, is actually a snooping application.

Corporate PC users probably know they are not supposed to download unauthorized applications but the lure of a cute holiday greeting, a revealing video of the tabloid celebrity du jour — or even just a seemingly useful application — is often too great to resist.

This article was first published on CIOupdate.com. To read the full article, click here.