A human-centric approach to better cybersecurity

A recent risk report from the Office of Management and Budget delivered sobering cybersecurity news to federal agencies. According to the OMB, a majority of agencies with cybersecurity programs in place remain at significant risk of attack. As noted in the report, “Agencies cannot detect when large amounts of information leave their networks.”

That is a startling observation, but perhaps it should not be entirely surprising. Today’s government workers rely on a mass of cloud services, mobile devices and interagency connection points to do their jobs. Traditional security perimeters have dissolved, creating a wide attack surface that can be difficult to defend and tough to monitor.

Traditional security measures are inadequate in this amorphous environment because they simply block all events that look like exfiltration, no matter how innocuous. Blockages occur without any understanding of the context of the event in question. As a result, the simple act of copying a file for agency use may create unwanted friction between IT and agency employees. Users will want to find ways around the security measures, and IT will want enforce the restrictions, perhaps even forcing users to obtain manual permissions. This set up is time consuming for IT staff and effectively handcuffs workers trying to do their jobs.

Therefore, it is important to understand the context behind a user’s actions. For example, an agency might have a policy restricting use of USB flash drives, but some staff may routinely need to rely on portable storage devices to do their jobs. The policy inhibits their work and leads them to look for a workaround, which creates additional alerts and headaches for security administrators. This situation undermines an agency’s security protocols and makes it difficult to distinguish between real threats and staff attempting to work.

The intersection of an agency’s two most important resources

The key to devising a better information security program lies at the intersection of government agencies’ two most important assets: people and data. Specifically, agencies should consider developing human-centric, automated and adaptive security responses based on how individual users interact with data. This approach -- risk-adaptive protection -- focuses on how, when and why people use and access information, placing users' actions into a larger context based on their normal activities.

The process creates a baseline “normal” understanding of users’ typical behavioral patterns and as a result can identify, in real-time, anomalies that manifest in different ways. For example, a person may follow the same daily pattern of accessing certain types of information, and a deviation from that pattern could raise a red flag. A worker who has suddenly begun attempting to access sensitive files or uploading government information to a personal Google Drive or Dropbox accounts could indicate in real time that the employee's credentials have been compromised and someone else is using that identity to access the network.

Establishing a baseline risk score

Unique user “risk scores” are developed to establish normal behaviors and proportionally automate security responses when abnormalities occur. Everyone in the agency can be assigned a baseline risk score, some potentially higher than others. The CIO, for example, may have a higher score than someone who does not routinely work with a lot of data. A high score does not necessarily indicate a vulnerability; it simply means the user has access to a wealth of information, raising the potential risk level.

Scores can change over time based on fluctuating patterns. As this occurs, the system can automatically implement data enforcement policies that are proportionate to an individual’s risk score and institute appropriate countermeasures as necessary. For example, sudden or large spikes outside the user’s baseline or peer group could trigger the security system to closely observe the user or even block some activities. This dynamic approach to data protection helps delineate normal versus abnormal behavior, helping security teams better differentiate truly compromised or malicious users from insiders' accidental threats.

Better security without compromising efficiency

Focusing on individual users’ data interactions allows security managers to see, organize, manage and mitigate risk as it occurs. They can customize security responses and protocols according to the level of risk that an agency is willing to accept, and the system can automatically apply the necessary measures to relevant users on the network based on anomalous patterns and risk scores. In doing so, security managers can prevent the accidental or malicious use of agency data and better combat external threats from phishing attacks, compromised credentials and other potential vulnerabilities.

Better yet, all of this can be done without restricting staff members’ ability to do their jobs effectively and stifling productivity across the agency. Risk-adaptive protection results in more meaningful, intelligent and effective security without friction between IT staff and agency workers.