The Cybersecurity Processes Most Vulnerable to Human Error

Christian Wiens Director of Marketing

Christian Wiens is Director of Marketing at MixMode. He has 10+ years of experience as a cybersecurity professional. He has his BA from The University of California, Berkeley and resides in Austin, TX.

The world’s reliance on fast, reliable, secure networks has likely never been as apparent as it became in early 2020, when the world responded to the Coronavirus pandemic. Suddenly, vast swaths of the global workforce needed to access and send enormous stores of data from home. In some ways, it couldn’t have happened at a worse time.

Even before the pandemic sent the world’s workforce to their home offices, the cybersecurity sector was frantically working to find more reliable ways to secure networked data. The challenge was, is, and will be, a daunting one: how to protect the endless stream of data flowing between IoT devices, cloud environments, on-prem servers, and everywhere in between.

One natural solution is to hire additional SecOps professionals. This common-sense approach fails for two main reasons:

1. There is an ever-growing gap between open IT positions and professionals to fill them all around the globe.

2. Human error accounts for an extraordinary percentage of data breaches each year.

So, even when companies can attract enough talent, networks are still rife with vulnerabilities. Hackers are standing by, all too eager to exploit them. With the average cost of a data breach surpassing $4 million apiece, organizations must develop plans for mitigating human error-related breaches and hacks.

Enter SIEM.

The next logical step for organizations is often to transfer some of the workload to a Security Information Event Management, or SIEM, solution. These platforms add automation to the threat detection and analysis process. However, SIEM platforms rely on stored historical data that has to be trained, managed, and constantly updated by humans which leads to massive inefficiencies in the security process.

SecOps analysts set firewall configurations and access controls. Additionally, while the SIEM can reduce some of their workload, these workers will ultimately be tasked with determining threat severity.

Human Error Impacts Security Outcomes

When humans interact with technology, there is an inherent increase in errors and missed details. When it comes to security, human error correlates directly with network vulnerability from a few angles:

Incorrect or Outdated Security Platform Configurations

Security platform effectiveness depends on keeping current with the latest security threats. Unfortunately, IT teams don’t always manage to apply security patches as they are released. The Ponemon Institute reported that almost 60 percent of companies polled in 2018 said they experienced a network breach due to unpatched vulnerabilities.

Inaccurate Analysis of SIEM Threat Alarms: Missing True Positives

“Alert fatigue” describes the decreasing effectiveness of security analysis caused by the insurmountable number of SIEM-triggered false positive alarms. SecOps teams divert enormous resources to sifting through all the alarms, hoping to spot true positives. It’s no surprise that this monotonous, meticulous work negatively impacts security outcomes.

The Ponemon Institute estimated that security analysts spent at least 25 percent of their work hours on threat hunting in 2019. That’s time SecOps could have been spending on configuration management and vulnerability patching.

Misconfigured Access Controls Across the Network

Human error around access controls plays an outsize role in data breaches. A 2019 Kroll report attributed misconfigured cloud servers as the root cause of most of the data breaches reported over the previous two years.

One prominent example affects Amazon Web Services (AWS). McAfee identified a list of misconfigurations affecting AWS in its “Cloud Native: The Infrastructure-as-a-Service (IaaS) Adoption and Risk Report“:

· EBS data encryption not turned on

· Unrestricted outbound access

· Misconfigured EC2 inbound access and group port

· Publicly-exposed cloud resources

· Unencrypted Amazon Machine Image (AMI)

· Disabled Amazon Virtual Private Cloud (VPC) flow logs

When humans alone are in charge of maintaining access control settings and changes, misconfigurations are a fact of life.

Download the MixMode Whitepaper, “How Predictive AI is Disrupting the Cybersecurity Industry”

The truth is that it is the behavior of a network in response to human interaction that can give organizations clearer insight into how best to secure their environments. A third-wave AI solution like MixMode, which develops an accurate baseline of network behavior and then responds smartly to aberrations and unexpected events, can elevate your network security to meet the unique challenges of today.

MixMode is helping organizations overcome the unavoidable impact of human error on network security. Download our new whitepaper to learn how.