Welcome!

Security Authors: Lori MacVittie, Pat Romanski, Michael Shaulov, Liz McMillan, Gilad Parann-Nissany

Related Topics: Security, Cloud Expo

Security: Blog Feed Post

Scott McNealy's Wayin...for Enterprise Security

This is just one of the possible use cases for WayIn

Study after study refutes the myth that cybersecurity is compromised by malicious, brilliant hackers. Advanced persistent threats, state-sponsored hackers, and foreign intelligence agencies are serious threats, especially to major targets, but the vast majority of breaches and leaks result from the cyber equivalent of forgetting to lock your door or losing your wallet.

Two recent, prominent studies show how negligence is the greatest cybersecurity threat. A study by Verizon this month discovered that in 97% of data breaches, hackers only had to use simple methods, and that in 80% of attacks hackers hit websites with weak security rather than targeting a specific firm. Last month, a study by the Ponemon Institute found that negligent insiders were the most common cause of data breaches, causing leaks 39% of the time. Breaches caused by negligent security policies or employees are the most important to protect against, not only because they are the most common, but also because they are the simplest to prevent. It takes little effort to keep your PDF reader updated, for example, but it’s nearly impossible to protect against many 0-day or undiscovered vulnerabilities exploited by advanced and well-funded attackers.

Education and transparency are two keys to making sure your enterprise has the basics covered and your employees don’t leave any glaring gaps in your security. These should go beyond the cybersecurity staff or the IT department to include all employees, as anyone with access to a computer can download an infected file from an email or accidentally reveal their passwords. In the Security Development Lifecycle, which reversed Microsoft’s once-struggling security culture over 10 years to be an industry leader and was later adopted by other tech titans, all employees get some form of training and auditing regularly. This is, unfortunately, very difficult for many companies to implement across many employees on many devices, especially when an organization has a Bring Your Own Device Policy. Surveys of organizations and employees show that while most companies and agencies try to educate users on mobile device best practices, it isn’t reaching employees, as most don’t remember getting any training.

Scott McNealy, the founder of Sun Microsystems, has a new start up called Wayin that may be able to help. Wayin’s instant and anonymous polling can be used to augment cybersecurity education and help IT get a better view of the security practices within their organization. Wayin allows users to vote on polls attached to media for real-time, anonymous surveys. Thus far, it’s been used mostly for entertainment, but there has been some corporate interest in using it to poll employees. A similar method can be used to assess the cybersecurity practices of a workforce and to better target education initiatives.

Employees can get quick, attention-grabbing daily questions on their security practices, such as “When did you last update your Internet browser?” of “Do you open attachments on emails from users you don’t recognize?” The questions will take seconds to answer and employees can be truthful because their responses are anonymous. The results would then be sent to the CISO who can then get an idea of what employees really do and think about security. After answering, the employees can be routed to a quick reminder or informative message about security best-practices or current risks to the company related to the question so that they get a little cybersecurity training every day. Aggregated weekly or monthly, poll results can help IT recognize where the threats to the organization lie, whether negligence is increasing or decreasing, and what areas to target with countermeasures or education.

This is just one of the possible use cases for Wayin. If you haven’t checked it out, try it here: http://www.wayin.com/#!/home

Related articles

More Stories By Bob Gourley

Bob Gourley, former CTO of the Defense Intelligence Agency (DIA), is Founder and CTO of Crucial Point LLC, a technology research and advisory firm providing fact based technology reviews in support of venture capital, private equity and emerging technology firms. He has extensive industry experience in intelligence and security and was awarded an intelligence community meritorious achievement award by AFCEA in 2008, and has also been recognized as an Infoworld Top 25 CTO and as one of the most fascinating communicators in Government IT by GovFresh.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.