How can you secure your information systems while keeping them user-friendly?

CISOs and their teams need to shift their mindsets to better align cybersecurity with UX and deliver maximum impact for the enterprise. A recent Gartner survey found that 69% of employees have bypassed their organization’s cybersecurity guidance in the past 12 months, and 74% of employees would be willing to bypass cybersecurity guidance if it helped them or their team achieve a business objective. Cybersecurity organizations are well-aware of the pervasive non-secure behavior of the workforce, but the typical response of adding more controls is backfiring. Employees report a huge amount of friction involved with secure behavior, which is driving unsecure behavior. Controls that are circumvented are worse than no controls at all.

If you assess the threats and vulnerabilities at or before the design stage, you can then include security requirements in the functional and non functional requirements. The controls and mitigations are then designed and built in as part of the overall system. You wouldn’t design and build a Ferrari and then ask the safety team to bolt on some seatbelts and airbags as an afterthought. Imagine the UX that would create

You can secure your information systems while maintaining user-friendliness by implementing strong authentication methods, user education, clear communication, and continuous monitoring, all while prioritizing a user-centric design approach that minimizes friction and inconvenience for users.

Assessing risk includes identifying Probability / Likelihood and impact. While impact can be derived from Business Criticality, Likelihood would need much more refined information on Vulnerability based on - Ease of exploitability - Exploitability in Wild - Exposure Factor of Asset ( level of controls in place to reach the asset) By doing so, will help in optimizing the efforts through prioritizing the remediation based on such risk assessments.

Securing any information system starts from the design, you should plan for it in your architecture phase itself. Nowadays security should be the first consideration immediately after the requirement. Classifying your system and assets such as private, confidential, restricted, Public, etc. will help you greatly during the design phase.

I would consider the concepts of Role Based Access Control (RBAC) and the Principal of Least Privilege separately. I have found myself moving away from RBAC as a viable architecture for modern IAM programs. It is an incredibly difficult thing to pull off and do properly. It requires coordination across an entire organization, starting with well-defined corporate roles that need to be broad enough to establish manageable roles, but granular enough to carve out inter departmental responsibilities. Some alternatives to consider that allow for more granularity, Attribute based Access Control (ABAC) and Policy Based Access Control (PBAC). When all else fails, manage to an individual’s responsibilities, and focus on least privilege.

Define what least privilege means for YOUR organization through policy/ies and a standard(s). Refer to applicable standards and RISK. Make it clear, succinct, understandable for the whole business and complete. Perform an inventory, a risk assessment, learn, improve, evolve!

Regarding SMS, I wanted to share more information. The signaling that is used in cellular networks is very aged and it's name is SS7. This protocol has flaws by design because at the time it was design, they were not thinking about security measures. As a result it led to not encrypted and later on weakly encrypted traffic like A5.1 and so on. In fact in dark web, you can find providers of SS7 gateways which allows your fake BTS to be connected to Telecommunication Network and this will lead to a huge threat. It not only gives the attacker access to sniff you sms ot voice traffic, but also they can access your location via LAC and CEL.

"Use MFA" is the often repeated panacea, but it is worth knowing that individual methods have widely different security robustness. For example, the commonly used SMS message is vulnerable to SIM-swapping attacks. Additionally, because they are unencrypted they may be intercepted by a fake base station, also known as an IMSI catcher. The method of passwordless authentication uses private key stored in your mobile, if the device is already compromised then it is possible to harvest the key and so be able to make clones. Usual in this method is self-provisioning which might be just dependent on email or standard user credentials. There are most robust solutions that use separate high-grade secure chips and CASQUE technology is a good example.

spot on! this is a common behavior everywhere. I think one thing that helps to tackle this is to create awareness and directions from top to align with CS+Org objectives.

Things to consider as first steps: know where your data is, and have a clear definition of what is more/less sensitive via a well defined classification policy/standard/guidance. With these in hand, you can start applying /enhance controls over data such as stronger encryption, where more critical. Also: do you know which data you're sharing with 3rd parties and how it's being protected by them? Are you sure? Did they test it? Did you test it? Consider clearly describing the types of services the vendor performs as this is one of the best leads you have in determining what data is shared.

Encryption can get expensive. Encrypt information based on the results of your Risk Assessment. If something doesn't need to be encrypted, don't.

There are a lot of SaaS services available to encrypt and decrypt data. And you also have to make sure that you save the encryption keys in the vault. It could be a cloud native vault, or it could be a third-party vault, which is available from the cloud environments.

Securing your data through encryption is like putting it in a safe box with a special code only you know. Imagine your data as a secret message, and encryption scrambles it into a secret code only you can decode. It's like turning 'Hello' into 'Jkxk&2!'. This way, even if someone tries to peek, they'll only see a jumble of letters and numbers! Remember to use strong encryption methods, like a super complex secret code, and change it regularly for extra safety. Whether your data is sitting quietly or traveling online, this special code keeps it safe and sound.

I like to contribute to this paper by adding the following points based on real world scenario that I came across : 1. Always encrypt your sensitive data no matter where you store it, even in databases. Because nowadays we see lots of leaks with loads of sensitive information like personal info and credit card informations, which not only violates GDPR, but also may lead to harmful actions. 2. Always use encryption for your traffic on the network because in case of compromise, you don't know for how long and which traffics will be sniffed by hackers. This may lead again to sensitive information and password leakages. 3. You should always have some kind of tools and measures for deep visibility in your networks.

Assume breach - and that users will fail you either unintentionally or otherwise. That would be the correct posture to start with and every positive behavior in cybersecurity is a bonus.

Phishing Awareness: Scrutinize emails and messages for authenticity. Don't click on suspicious links or download attachments from unknown sources. Software Updates: Keep your devices and apps updated to fix security gaps. Enable automatic updates where possible. Wi-Fi Security: Use secure, password-protected Wi-Fi networks, especially for sensitive transactions. Avoid conducting confidential activities on public Wi-Fi. Mobile Protection: Secure your smartphone with a passcode, fingerprint, or face ID. Only download apps from trusted sources. Social Media Caution: Be mindful of what you share and adjust privacy settings to control who can access your information

Beyond rehashing the same material over and over, training and education needs to be regularly updated as new threats emerge. This should not simply be the "Do and Don't" briefings that make users' eyes roll. Consider explaining some of the "Why" as well. Including real-world examples of relevant cyberattacks can to help reinforce information.

Trust but verify user training and do it programmatically, "Safety rails" should be used when ever possible; ensure that all accounts have an expiration that requires a review action with a privilege level sensitive time scale. Users often don't understand the importance of exit processing and "left over" or un - evaluated accounts often cause years of issues paired with vulnerabilities.

Training should come with enticing rewards for achieving learning goals. That way users don't see it as a mandatory chore, will be less likely to click-through and actually be interested. Ensure that at the end of each segment there's a small quizz to assess the user's understanding of the concepts discussed. Training materials should not allow for skipping or forwarding and should be kept short and to the point. Users should only pass if they have answered all questions correctly. This reduces the risk of having a gap in knowledge. Training materials should be updated at least quarterly. Technology moves fast and the types of attacks evolve faster. The material should be tailored to the type of user based on the user's work role.

Have a Plan and test it often. Change the Plan based on the results of your testing. Ensure your test team involves the appropriate Business Owners from the areas you're testing. Your Plan is an Asset, a living document that should be classified and secured accordingly. Whilst testing twice a year is recommended for most organizations, testing quarterly for organizations that involve Critical Infrastructure is recommended.

In IBM's 2022 data security report, it was reported that it took an average of 277 days from the incidence of a data breach to its discovery with consequential potential for exfiltration of critical data. One measure that is most useful is to exploit software packages that allow you to monitor critical modifications to your Group Policy settings, such as Password policy, Account lockout policy, User rights assignment settings in real time by generating alerts.

Regularly test your system's security with simulated cyber-attacks and vulnerability scans. Monitor network traffic, employing anomaly detection for unusual activities. Conduct incident response drills and periodic audits. Educate your team on the latest threats to enhance overall awareness. A secure system is a strong fortress!

This is important, but how is this connected with user friendliness? Monitoring back-end systems is not influencing your employees behaviour or their opinion about a certain security policy.

Simplicity is Key: Keep it clean, uncluttered, and easy to navigate. Less is more! Intuitive Design: Ensure actions and features are logical and predictable. Users shouldn't struggle to find what they need. Consistency Matters: Maintain uniform design elements for a cohesive look and feel throughout the interface. Mobile-Friendly Design: Adapt your UI for various devices and screen sizes. Accessibility is key! Feedback and Alerts: Provide clear feedback for user actions and alerts. Let them know when something's happened. User Testing: Gather feedback from real users to understand what works and what needs improvement.

Constraint interfaces (despite what the name may suggest) can provide better UX while enhancing security. The reason is in one of its flavors, a constraint interface hides the elements the users should not have access to, which can increase simplicity.

To keep your systems user friendly, try to implement as much of your security "behind the scenes" as possible. The less the user needs to be aware of the processes, the better. In other words, things should "just work." The best example of this would be implementing Single Sign On(SSO) so that users don't have to worry about logging in to every single application they use and don't have to try and remember too many sets of login credentials.

There is a common misconception regarding the resilience of Identity Access Management (IAM) that needs to be addressed. While vendors are responsible for a significant part of the service, customers also play a crucial role in ensuring the platform's security and continuity. This is where the Shared Responsibility Model comes into play. Customers must take responsibility for their data's security, compliance, and recoverability. To achieve this, it's imperative that they use BC/DR tools to safeguard against various threats, including ransomware, insider risks, misconfiguration, and human error.

A risk based access control approach can increase security while enhancing user-friendliness. For example, you don't need to always and repeatedly ask all the users to authenticate with all the factors from an MFA system. You can do this when a privileged user/action is involved or a risky situation (for instance logging in from an unknown location/device) is detected.