Human Error: The 'Oops' Factor

By Jeanette James

(Back to article)

It isn't often mentioned, but most computer security will admit it when asked. Network security failures are often the result of human error -- rather than a malicious attack from a hacker somewhere in Novosibirsk. The technology is in place and so are the security procedures that all employees are meant to follow, but still something goes wrong.

"I would estimate that half or more of security breaches are not highly organized criminals trying to steal your corporate information," says Laura Koetzle, principal computing and security analyst at Forrester Research in Cambridge, Mass. "They are stupid things that happen. Most of these things are committed in ignorance."

With ever-increasing external threats compounded by unpredictable computer users, a CIO's challenge can be daunting. That's one reason why CIOs should seek out new security products that anticipate computer-user mistakes as a given.

Along with new technologies that account for human error, experts also recommend clear communication of desktop security procedures along with security audits to help to put a spotlight on human errors, procedural slips or equipment misconfiguration.

"Make your rules easy to follow," Koetzle suggests. "You need a one-pager in plain English. Tell them what to do and what not to do."

But, she cautions: "The process only works if you motivate people."

Improper Configuration

Of course, it's not always the IT department's customers who are causing the trouble. Sometimes human error means that security tools aren't configured properly or have not been maintained or updated on schedule. According to Deloitte Touche Tohmatsu's 2004 Global Security Survey, one third of senior information technology executives said security technologies acquired by their organizations were not being utilized effectively.

Auditing products can help. Preventsys, for example, points out that while many firms have strong security policies, their networks aren't audited often enough to see if the policies are being honored. Firms such as Preventsys offer a variety of auditing tools while KaVaDo Inc.'s ScanDo performs Web application scanning to identify security loopholes in Web applications and recommends solutions. Outside consultants also be hired to perform audits, said Koetzle.Still, Koetzle stresses that network security is a three-legged stool supported by people, process and technology. All three legs must be in place for the stool to stand. Even when good technology is in place and security processes have been outlined, it's generally people who topple the stool.

Consider Trojan horses. No matter how many times employees are told not to download e-mail attachments, it's usually just a matter of time before someone succumbs to curiosity and opens a file that, unbeknownst to them, is actually a snooping application.

Corporate PC users probably know they are not supposed to download unauthorized applications but the lure of a cute holiday greeting, a revealing video of the tabloid celebrity du jour -- or even just a seemingly useful application -- is often too great to resist.

New Products

In such situations, new technology solutions that seek to protect networks from human error may be the best solution. Such programs won't stop corporate PC users from making mistakes, but they will help to keep those mistakes from taking down the network.

For example, Confidence Online from WholeSecurity of Austin helps prevent password theft even when an employee makes the mistake of downloading a Trojan, keystroke logger or other remote control devices.

Unlike computer security products that continually update lists of known e-mail threats, Confidence Online analyzes software activity and network connectivity for threats. If suspicious activity is detected -- say, an application taking screen captures or setting up a new user ID -- Confidence Online terminates that program before personal or corporate information can be stolen.

"WholeSecurity is a good example of protecting yourself when an employee shows up with an infected laptop and tries to log on to the network," Koetzle says.

More New Products

Another example comes from Sana Security of San Mateo, Calif. It's Primary Response product doesn't wait for updates from virus companies in order to stop a network virus. Instead, Primary Response monitors an application's normal behavior and then watches for anything that breaks away from the norm. This way, even when an employee mistakenly sets a virus in motion, it can be caught and stopped.

Gartner put Sana Security and WholeSecurity both on its "Cool Vendors in Security and Privacy" list in March this year, naming the two firms among 11 vendors that "offer innovative technologies and products that address wide-ranging security issues."

WholeSecurity's Confidence Online "does not rely on signatures such as anti-virus products," writes John Girard, vice president and research director at Gartner. "Instead, it uses heuristics to identify software and shuts it down before damage can be done. WholeSecurity is particularly effective as a 'day zero' defense against new or undocumented worms."

Commenting on Sana's product, Richard Stiennon, a research vice president at Gartner, writes "Primary Response rapidly learns what is normal, then, in block mode, prevents abnormal system calls from working. This is proven technology and is a new variation on approaches taken by Okena and Entercept."

For other examples of new and upcoming products that account for human mistakes, Forrester's Koetzle points to a group of hardware products -- from firms such as Check Point Software, Perfigo, Vernier Networks and Enterasys Networks -- that quarantine viruses before they can take a network down.