Can security's human side stop data breaches?

Shira Rubinoff was a practicing psychologist in 2004. When it came to technology, her experience was simply as a tech user, certainly not a tech guru. Then one day she was phished.

"After it happened, I was like: "There's got to be a better solution out there. Because once you put security in people's hands, so much can happen."

Rubinoff decided to take her background in human behavior and turn it into a security software firm that taps into how the mind works in order to prevent phishing attacks. Her US-based company, Green Armor, provides a product that uses a visual cue on the Web log-in page that is unique to each user of the site. The cue is generated using a mathematical formula based on the user id. It uses a colored box and a short word, a method she developed after extensive research and experimentation about how users memorize and retain information.

The idea, according to Rubinoff, is that users will know if something is amiss much easier than with the usual authentication techniques currently used by many online banking and other secure sites.

"This approach deals specifically with the humanistic factors of technology," said Rubinoff, who was recently named a "Women of Influence" award winner at the Executive Women's Forum because of her work on the software. "I think other technology out there look for technology problems. They forget there is a person sitting behind the computer that is very easily manipulated."

Human behavior is increasingly becoming a hot area of focus in security. In fact, a new study from networking giant Cisco says risky behavior tops the list of reasons for security breach. The study, which surveyed 1,000 employees and 1,000 IT professionals from various industries and company sizes in 10 countries, was conducted to examine security and data leakage at a time when employee lifestyles and work environments are changing dramatically.

"We conducted this research in order to understand behavior, not technology per se," said John N. Stewart, chief security officer of Cisco. "Security is ultimately rooted in users behavior, so businesses of all sizes and employees in all professions need to understand how behavior affects the risk and reality of data loss - and what that ultimately means for both the individual and enterprise."

The research found one in five surveyed admit to altering security settings on computers. Additionally, one of four employees admitted verbally sharing sensitive information to non-employees. And a whopping seven in ten surveyed said they regularly use unauthorized applications at work.

Similar findings from consulting firm Deloitte earlier this year back up the Cisco research. A Deloitte survey of more than 100 companies found 75 percent cited human error as the leading cause of security failures.

Page Break

Green Armor is one of several companies with a product that is based on human behavior. A quick Google search turns up many antivirus and malware solutions that utilize behavior analysis. Most of the major antivirus software makers, such as Symantec and McAfee, have implemented some kind of behavior-based defense into products.

A US-based consultancy called Security Mentor, which only launched in April, is hoping to find business in an approach that goes right to the source: the user. Security Mentor offers training that, according to founder and President Marie White, takes on a brief, frequent and focused approach. Employees take part in weekly, seven-minute-long informational Web sessions that teach and reinforce good security habits and practices.

"There is wide spread information at this point that employees are one of the greatest threats to an organization," said White. "But the question is: Why do they remain the greatest threat? One can assume they are either intentionally or unintentionally engaging in risky behavior. Most people agree it's unintentional. This training addresses that."

Security Mentor, which launched at the RSA conference, is still in the start-up phase, according to White. While the firm is not working with any customers yet, there is interest from a wide-swath of commercial and government organizations, she said.

White said in developing the sessions, she also took into account how the typical employee works today. The sessions are short to fit the attention-span criteria of a busy person. They are regular so that retention of information will be more effective.

"We consider how employees multi-task and the training fits in that attention span window," said White. "Also, how often people get interrupted coupled with how they remember. And the frequency of having training weekly makes it a lifestyle difference for employees."