How Endpoint Security Can Help Secure the Human

Pete Burke is a security and borderless networks technical consultant at Force 3. 

Humans: We’re impulsive, we’re fallible, we make bad decisions, and sometimes we do so on purpose. And yet, when it comes to cybersecurity, we too often focus on securing the network, without fully considering the role of the actual network user.

It’s a misstep long-overdue for change. Securing the human is critical. Here’s why—and how we can achieve it.

Users Cause the Most Damage

Hackers use a wide array of methods to infiltrate networks. But there’s almost always one common denominator: human vulnerability.

Hackers rely on users to succumb to network threats. The most common form is users downloading infected files or tricked by phishing scams. The riskiest threat comes from those with complete access, such as IT and network administrators—a hack here can spread throughout the entire network.

The Importance of User Awareness

User awareness is the first line of defense against this. Organizations should train users to identify phishing scams, malicious website redirects and invalid certificates. Lacking awareness, any security systems are rendered useless if users continue to make security errors.

Organizations should create a security culture that prioritizes awareness. Users need thorough IT education and actionable advice so that their knowledge can be measured. One way to do this is implementing security scenarios to test and evaluate users. Organizations can use the results from these scenarios to adjust awareness programs based on users’ needs.

Going Beyond the User

Unfortunately, sometimes even the best awareness programs don’t always work. Hackers rapidly grow savvier, and now develop attacks that are almost impossible for users to recognize until after the fact.

Take, for example, someone sharing files with a colleague—an everyday activity from a trusted source to a trusted recipient. However, in this case, the sender’s computer had a virus that attaches itself to benign files, such as images and documents.

Another example is spoofing, a practice in which a hacker impersonates a trusted website or device to compromise the user. As user awareness grows, this technique grows increasingly popular.

Traditional security measures aren’t set up to deal with this behavior. Current generation software, such as anti-virus and anti-malware, are signature-based. They rely on a database of threats to identify whether files are infected. As such, they often lack the ability to detect this behavior. To stop this, organizations need solutions that can scan files based on behavior in real time, no matter how benign it looks.

Traditional Fixes are Just the First Step

That’s not to say that anti-virus isn’t useful. It has merits but isn’t the be all and end all. Why? Because organizations often buy into hype of one solution or another as the ultimate form of cyber protection. Realistically, however, many of these quick fixes are half-baked or only part of a full solution.

Agencies need to consider other technologies that can fill the gaps left by firewalls and anti-virus software. These gaps include new threats not yet indexed by antivirus databases, behavior-based threats, spoofing and others. As long as human error remains a limiting factor—and it likely always will—organizations need to incorporate security solutions based on machine learning and behavioral analytics.

The easiest way to do this is to protect the endpoint. Look beyond signatures, and focus on shutting down threats by identifying anomalies in memory behavior, processor activities, etc. Along with providing more effective security, this strategy decreases the potential for human error by eliminating the manual work required by traditional antivirus, such as initiating scans, hunting down patient zero and mapping out who else has been hit.

The adage of defense in depth remains valid in the 21st century. But instead of just multiple lines of fortifications, you need multiple solutions and obstacles standing between your network and would-be cyber threats. This secures the human and keeps networks safe and beyond malicious reach.