During a job interview several years ago, I was asked a question that has stuck with me ever since. The question was along the lines of:
“If you could offer one piece of security advice to your customer, what would it be?”
At the time, my immediate answer was “Education, education, education. Teach your employees about security as they are the weakest link in the chain.” Over the years since that interview (disclosure: I got the job), I have often thought whether I could have provided a better answer. In fact, when I interview candidates for jobs today I often ask them that same question to see what their response it. I receive a variety of answers, usually technical.
So far, I haven’t come up with a better answer. Sure, we need to enforce perimeter security as well as standard security best practice, such as “Least Privilege” etc, but I can’t think of a single more important security lesson that my lesson above. You can have a very mature Information Security Management System will all the right controls in place but if you have a compromised user, or even worse a compromised, privileged user, then many of those controls are ineffective.
It is commonly recognised that security controls are a combination of people, processes, and technology. I think, too often we pay too little attention to the people aspect. Security controls have to be looked at holistically, taking into account all three of these facets. That will ensure that you can minimise the potential loss when you are hacked.
Yes, I use the term “when” as opposed to “if”. Every day almost, we see reports of data breaches, many from companies with good security controls in-place. Therefore, I believe it is naive to think that your organisation is un-hackable. That is why it is so important to make sure you have the right security controls and training in place, before this happens, not after.