The impact of human error on cyber securityIn this episode of The Indian Express weekly tech podcast – Our Own Devices, host Nandagopal Rajan is joined by Anshuman Sharma, Associate Director CSIRT & Investigative Response, APJ, Verizon Business to discuss the human factor in cybersecurity, exploring how human errors can significantly weaken cybersecurity measures and the various ways to safeguard against bad actors. Edited by Abhishek Kumar ------ Introducing Anshuman Sharma (00:00)
Human error in cyber security (00:51)
Social engineering (01:32)
Error in misconfiguration (04:41)
Privilege misuse (07:18)
Ensuring cyber hygiene (08:18)
Customized training (09:56)
Threat actors leveraging AI (13:14)
Explaining operational technology (OT) (14:34)
Difficulties in training workforce (15:18)
Using AI to ensure cyber security (18:13)

In this episode of The Indian Express weekly tech podcast - Our Own Devices, host Nandagopal Rajan is joined by Anshuman Sharma, Associate Director CSIRT & Investigative Response, APJ, Verizon Business. They discuss the impact of human error on cybersecurity and explore how these errors can weaken cybersecurity measures. They also provide various ways to safeguard against bad actors.

The conversation covers several important topics. Anshuman Sharma introduces himself at the beginning of the episode. He then delves into the concept of human error in cybersecurity, explaining how it can pose a significant threat. Social engineering is also discussed, highlighting how attackers manipulate individuals to gain unauthorized access to systems.

Misconfiguration errors are another area of concern. Sharma explains how mistakes in system configuration can lead to vulnerabilities that can be exploited by cybercriminals. Privilege misuse, where individuals abuse their authorized access to systems, is also addressed.

To ensure strong cybersecurity, Sharma emphasizes the importance of maintaining cyber hygiene. This involves implementing best practices and regularly updating security measures. Customized training programs are also recommended to educate employees about potential threats and how to mitigate them.

The conversation then shifts to the use of artificial intelligence (AI) by threat actors. Sharma explains how AI can be leveraged by cybercriminals to enhance their attacks and why it is crucial for organizations to stay updated on these advancements.

Operational technology (OT) is another topic covered in the discussion. Sharma provides an explanation of OT and its significance in the context of cybersecurity.

The difficulties in training the workforce to effectively combat cyber threats are also acknowledged. Sharma discusses the challenges organizations face in keeping their employees well-informed and prepared to tackle evolving cybersecurity risks.

Finally, the conversation concludes with a discussion on using AI to ensure cybersecurity. Sharma highlights the potential of AI in strengthening security measures and emphasizes the need for organizations to adopt AI-driven solutions.

Overall, this episode provides valuable insights into the human factor in cybersecurity and offers practical strategies to safeguard against cyber threats.

The impact of human error on cyber securityIn this episode of The Indian Express weekly tech podcast – Our Own Devices, host Nandagopal Rajan is joined by Anshuman Sharma, Associate Director CSIRT & Investigative Response, APJ, Verizon Business to discuss the human factor in cybersecurity, exploring how human errors can significantly weaken cybersecurity measures and the various ways to safeguard against bad actors. Edited by Abhishek Kumar ------ Introducing Anshuman Sharma (00:00)
Human error in cyber security (00:51)
Social engineering (01:32)
Error in misconfiguration (04:41)
Privilege misuse (07:18)
Ensuring cyber hygiene (08:18)
Customized training (09:56)
Threat actors leveraging AI (13:14)
Explaining operational technology (OT) (14:34)
Difficulties in training workforce (15:18)
Using AI to ensure cyber security (18:13)

In this episode of The Indian Express weekly tech podcast - Our Own Devices, Nandagopal Rajan is joined by Anshuman Sharma, Associate Director CSIRT & Investigative Response, APJ, Verizon Business, to discuss the impact of human error on cybersecurity. They explore how human errors can weaken cybersecurity measures and discuss various ways to safeguard against bad actors.

The conversation covers several important topics related to cybersecurity. Anshuman Sharma introduces himself at the beginning of the episode. He then delves into the issue of human error in cybersecurity, highlighting its significance and potential consequences.

Social engineering is another topic discussed in the podcast. The hosts explain how attackers exploit human vulnerabilities to gain unauthorized access to systems and data. They emphasize the need for awareness and vigilance to prevent falling victim to social engineering attacks.

Misconfiguration errors are also addressed in the conversation. The hosts discuss how simple mistakes in configuring systems can lead to security vulnerabilities. They stress the importance of proper configuration practices to mitigate these risks.

The podcast moves on to discuss privilege misuse, where individuals with authorized access abuse their privileges for malicious purposes. The hosts emphasize the need for strict access controls and monitoring to prevent such misuse.

Ensuring cyber hygiene is highlighted as a crucial aspect of maintaining strong cybersecurity. The hosts discuss best practices for maintaining good cyber hygiene, such as regularly updating software, using strong passwords, and implementing multi-factor authentication.

Customized training is also mentioned as an effective way to enhance cybersecurity awareness and skills among employees. The hosts discuss the importance of tailored training programs that address specific organizational needs and challenges.

The conversation then shifts to the topic of threat actors leveraging artificial intelligence (AI) for cyber attacks. The hosts explain how AI can be used by attackers to automate and enhance their malicious activities. They emphasize the need for organizations to stay updated on AI advancements and develop countermeasures accordingly.

Operational technology (OT) is explained as a critical component of many industries, including manufacturing and infrastructure. The hosts discuss the unique cybersecurity challenges associated with OT systems and the need for specialized training and expertise in securing them.

The podcast concludes with a discussion on the difficulties organizations face in training their workforce on cybersecurity. The hosts highlight the need for continuous training and education to keep up with evolving threats and technologies.

Lastly, the hosts touch upon the use of AI in ensuring cybersecurity. They discuss how AI can be leveraged to detect and respond to threats in real-time, enhancing overall security measures.

Overall, this episode provides valuable insights into the human factor in cybersecurity and offers practical advice on safeguarding against cyber threats.

The Biden administration’s 2023 National Cybersecurity Strategy identified structural shortcomings in the state of cybersecurity, calling out the failure of market forces to adequately distribute responsibility for the security of data and digital systems. Most prominently, the strategy seeks to “rebalance responsibility [for security] to those best positioned.”

Shortly after the strategy’s launch in March of this year, the Cybersecurity and Infrastructure Security Agency (CISA) kicked off an effort to “shift the balance of cybersecurity risk” by pushing firms to adopt security-by-design (SbD) practices, improving the safety and security of their products at the design phase and throughout their life cycle.

CISA director Jen Easterly’s announcement of these efforts appears to put CISA at the forefront of this rebalancing, addressing technology vendors’ incentives to underinvest in security through changes in how those firms design and deploy the products they sell. As the first substantive proposal from President Biden’s administration to effectuate this rebalancing since the launch of the strategy, the success or failure of the SbD initiative could be a bellwether for one of the strategy’s two fundamental ideas.

Success with SbD is at risk, however, both from the political challenges of implementing SbD practices and the threat of unrealistic expectations. This piece addresses both and highlights a path forward.

Political and structural headwinds

The politics of SbD implementation — which implicitly require a capacity to compel change in vendor practices, as well as the insight to design them — are treacherous ground for CISA, as the fast-growing agency is not a regulator. In time, it might become one, but current and past leadership insist that such responsibilities would be at odds with agency culture and its operational responsibilities.

The agency’s ability to support, build capacity, train, coordinate, and plan together with state, local, tribal and territorial entities, and industry stakeholders is rooted in its disposition as a trusted partner and neutral convener.

Story continues

This means CISA should be only one of several federal agencies working to implement SbD, with cooperation from regulators like the Federal Trade Commission (FTC), a sharp and pointy complement to CISA’s open-handed approach. Otherwise, the SbD initiative could place CISA in a bind, trying to fix entrenched market incentive problems but without the ability to compel companies to act differently. CISA efforts to create accountability might undermine its attempts to generate goodwill.

Developing and defining a set of SbD practices that vendors can attest to, and that the U.S. government and other parties can verify or enforce, is a tremendous undertaking in and of itself. CISA must build SbD practices alongside an architecture for enforcement that sets clear roles for entities like the FTC, the Department of Defense, the Securities and Exchange Commission, and the General Services Administration.

The White House has responsibility here, too, and specifically the Office of the National Cyber Director, to guide this multi-agency effort within a strategy to manage the industry politics of shifting the incentives in this market — precisely what the office was designed, staffed, and organized to do. CISA’s focus must remain on enumerating and updating the essential SbD practices.

Just one piece of the puzzle

As we have argued before, “no strategy can address all sources of risk at once, but . . . silver bullets often trade rhetorical clarity for crippling internal compromises.” The SbD program could achieve deep, meaningful changes in how some of the largest technology vendors build services and products. Those changes would have material benefits for the security of every technology user.

However, cajoling all firms toward a comprehensive and uniform set of best practices is a fundamentally incompletable task.

Malicious actors perpetually seek new means of exploit; different sectors and system classes face different and unique challenges; and new technologies are prone to modes of failure, both new and unforeseen. Adopting certain new processes, rigorously enforcing them, and fixing existing incentives would still be a much-needed improvement over the current status quo.

However, adopting memory-safe languages or pushing large actors toward better risk management would not necessarily have prevented many significant vulnerabilities in recent memory, such as Log4Shell. To succeed, CISA will also need to understand how large technology companies build products and services — current industry practice is far from complete or perfect, but it is the baseline from which SbD hopes to drive change. Understanding that baseline is critical.

There is danger when rhetoric around shifting responsibility in cyberspace suggests that cybersecurity problems and challenges exist only because technology vendors cut corners or that all cybersecurity risk can be avoided by following a simple set of straightforward practices. The increasingly interconnected, dependent nature of software systems, as well as the variety of organizations and systems they connect to, creates risks all its own.

SbD is an important piece of managing this — the status quo of responsibility deferred to the user is broken — but describing SbD as a panacea risks creating backlash when insecurity inevitably persists.

It is clear CISA recognizes that success in SbD could be one of the most impactful policy interventions in cybersecurity in the last decade. It is also clear that the program, even in its most successful incarnation, will leave some problems unsolved. Specificity about the scope and goals of the program will help prevent its inevitable critics from distorting the debate into all-or-nothing terms.

Risk and opportunity

SbD — the first policy manifestation of the National Cybersecurity Strategy’s effort to shift responsibility — will not come about by sheer goodwill alone. CISA is not a regulator, and it must define a path for federal agencies that are regulators so that the implementation of SbD leverages the broader standards setting, enforcement, and regulatory powers of the federal government.

Shying away from direct government enforcement of these security practices risks consigning the effort to history, alongside many other “voluntary” and “industry-led” programs.

The growing and talented team at CISA have 18 months until January 2025, which will bring either the paralyzing tumult of transition or the still-chaotic maturation of a first-term administration into a second. The largest vendors that would participate in this program are not going anywhere and can afford to wait.

In this sense, CISA and the wider U.S. government’s cyber policy apparatus is on the clock. CISA must focus on the essential elements of SbD and organize, build, and engage with a clear deadline in mind. The clock is ticking.

The Biden administration's 2023 National Cybersecurity Strategy has identified flaws in the current state of cybersecurity, particularly the lack of responsibility for data and digital system security. The strategy aims to redistribute responsibility to those best equipped to handle it. In line with this strategy, the Cybersecurity and Infrastructure Security Agency (CISA) has launched an initiative to promote security-by-design (SbD) practices among firms. This initiative seeks to improve the safety and security of products from the design phase to their entire life cycle.

CISA director Jen Easterly's announcement of this initiative positions CISA as a leader in rebalancing cybersecurity incentives for technology vendors. By changing how these firms design and deploy their products, CISA aims to address the problem of underinvestment in security. The success or failure of the SbD initiative will serve as a test for the effectiveness of the overall strategy.

However, there are political and structural challenges that could hinder the implementation of SbD practices. CISA is not a regulator, and its ability to enforce change in vendor practices is limited. Cooperation with regulatory agencies like the Federal Trade Commission (FTC) is crucial to ensure effective implementation. Additionally, developing a set of SbD practices and establishing an enforcement architecture is a complex task that requires collaboration among multiple agencies.

It is important to note that SbD is just one piece of the puzzle in addressing cybersecurity risks. While it can bring significant improvements, it cannot eliminate all vulnerabilities. Malicious actors constantly find new ways to exploit systems, and different sectors face unique challenges. Understanding the current industry practices is essential for driving meaningful change through SbD.

Describing SbD as a panacea for cybersecurity risks can create unrealistic expectations and backlash when vulnerabilities persist. It is crucial to be specific about the scope and goals of the program to prevent distortion in the debate.

Implementing SbD will require more than goodwill. CISA must define a path for regulatory agencies to leverage their enforcement powers. Shying away from government enforcement risks rendering the effort ineffective, similar to previous voluntary and industry-led programs.

CISA and the wider U.S. government's cyber policy apparatus have a limited timeframe to make progress. The clock is ticking, and CISA must prioritize essential elements of SbD and work towards a clear deadline.

The SEC on Wednesday voted three-to-two to approve rules requiring companies to disclose material cyber-security incidents that affect them. They will also have to report each year material information about their cyber-security risk management, strategy and governance – although the commission has dropped a controversial proposal that companies report on board-level cyber-security expertise.

Under the new rules, firms will have to report on a new Item 1.05 of Form 8K any cyber-security incident they believe to be material and to describe the material aspects of its nature, scope and timing, in addition to its material impact – or reasonably likely material impact – on the company.

In most cases such reports will be due four business days after the company decides that an incident is material. The company will be able to delay making the disclosure if the US Attorney General determines that revealing the incident would pose a substantial risk to national security or public safety.

The new rules also add Item 106 to Regulation SK. This will require companies to describe in their Form 10K the board’s oversight of cyber-security risks and management’s role and expertise in assessing and managing material cyber-security risks. They will also have to describe their processes for assessing, identifying and managing material risks from cyber-security threats and the material impact of cyber-security risks.

The Form 8K disclosures will be due beginning the later of 90 days after the rule is published in the Federal Register or December 18, 2023. The Form 10K disclosures will be due beginning with annual reports for fiscal years ending on or after December 15, 2023.

Board experts?

The SEC initially proposed adding Item 407(j) to require disclosures about the cyber-security expertise, if any, of a company’s board members. The measure attracted a lot of feedback and was ultimately dropped.

The agency writes in the final rule: ‘After considering the comments, we are not adopting proposed Item 407(j). We are persuaded that effective cyber-security processes are designed and administered largely at the management level, and that directors with broad-based skills in risk management and strategy often effectively oversee management’s efforts without specific subject matter expertise, as they do with other sophisticated technical matters.’

There are different schools of thought about the need for specific board expertise to address topics such as cyber-security, artificial intelligence, climate change and human capital management. Many governance professionals favor directors having more general expertise and focusing on their role of risk oversight.

The National Association of Corporate Directors (NACD) welcomed the rule changes overall, saying in a statement that a more formalized disclosure on cyber-security risk management, strategy, governance and incident disclosure will ‘create efficiencies and clarity around cyber-risk oversight expectations.’

NACD also welcomed the SEC’s decision to drop the board expertise requirement. The group had written in its comment letter to the agency: ‘The presence of a cyber-security expert on a board cannot make up for poor oversight processes and does not excuse the full board from its oversight duties in this matter.’ It expressed approval that the final rule ‘focuses disclosure of expertise at the correct tier of responsibility for mitigating this risk: management.’

Divided commission

The changes have – as in many cases in recent years – divided opinion among the commissioners. SEC chair Gary Gensler said in a statement: ‘Whether a company loses a factory in a fire — or millions of files in a cyber-security incident — it may be material to investors. Currently, many public companies provide cyber-security disclosure to investors. I think companies and investors alike, however, would benefit if this disclosure were made in a more consistent, comparable and decision-useful way.

‘Through helping to ensure that companies disclose material cyber-security information, today’s rules will benefit investors, companies and the markets connecting them.’

Commissioner Caroline Crenshaw, who voted in favor of the reforms, said: ‘[A]s the comment file substantiated, knowledge of cyber-security threats and breaches are essential to understanding a firm. Among other reasons, breaches can (and do) result in loss of revenue, customers and business opportunities. Those harms may be realized or they may be ongoing in the form of lost sensitive information, remediation costs and losses in shareholder value.

‘Despite the consensus on the harmful nature of cyber-incidences, commenters highlighted that existing disclosure practices vary in substance, organization and presentation, thus establishing a need for, and benefit of, comparable, reliable and decision-useful disclosures to investors.’

Hester Peirce, who voted against the changes, complained that they ignore the limits of the agency’s disclosure authority and investors’ best interests while not establishing why they are needed. ‘The release prescribes granular disclosures, which seem designed to better meet the needs of would-be hackers rather than investors’ need for financially material information,’ she said.

‘The new rule, for example, requires disclosure of detailed information about issuers’ cyber risk management processes and governance and relevant personnel… The strategy and governance disclosures risk handing them a roadmap on which companies to target and how to attack them.’

She also commented: ‘[T]he SEC’s potentially non-material risk management and governance disclosures veer into managing companies’ cyber-defenses; the new rule looks like a compliance checklist for handling cyber risk, a checklist the SEC is not qualified to write.’

Despite approving of the changes overall, NACD also said it remains concerned that the four-day reporting window ‘may not allow companies the time to put in place adequate patches and protections before being forced to make it known that they have been compromised digitally.’

The Securities and Exchange Commission (SEC) has approved new rules that require companies to disclose material cyber-security incidents and provide annual reports on their cyber-security risk management, strategy, and governance. However, the controversial proposal to report on board-level cyber-security expertise has been dropped. Under the new rules, companies must report any material cyber-security incident on Form 8K and describe its nature, scope, timing, and impact. Reports are due within four business days of determining the incident is material, unless the US Attorney General determines that disclosure would pose a risk to national security or public safety. The rules also add Item 106 to Regulation SK, requiring companies to describe the board's oversight of cyber-security risks and management's role in assessing and managing such risks. The disclosures will be due starting December 18, 2023. The SEC decided not to adopt the proposed requirement for board members to have cyber-security expertise, stating that effective cyber-security processes are primarily managed at the management level. The National Association of Corporate Directors (NACD) supports the rule changes and believes that disclosure of expertise should focus on management rather than the board. The SEC's decision has divided opinion among the commissioners, with Chair Gary Gensler emphasizing the importance of consistent and comparable cyber-security disclosure for investors, while Commissioner Hester Peirce argues that the rules go beyond the agency's authority and may provide hackers with valuable information. NACD also expresses concern about the short reporting window for cyber-security incidents, as it may not allow companies enough time to address vulnerabilities before making them public.