CMU5XX-INFOSEC

Information Security for Industry

Session 6: Organizational & Human Security

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Differentiate between Malicious and Negligent Insider Threats.
  • Apply the principles of Least Privilege and Separation of Duties (SoD).
  • Analyze the psychological factors contributing to security bypasses.
  • Design effective Security Awareness Training (SAT) programs.
  • Evaluate the metrics for determining security culture maturity.

Seminar Structure (3 Hours)

Part 1: The Insider Threat (1.5 hrs)
  • Malicious vs Negligent Actors
  • Separation of Duties (SoD) & Least Privilege
  • Task 1: Designing SoD Controls
Part 2: Security Culture & Training (1.5 hrs)
  • Security Awareness Training (SAT)
  • Phishing Simulations and Metrics
  • Task 2: Evaluating SAT Effectiveness

Part 1: The Insider Threat

Duration: 1.5 Hours

The Enemy Within

An organization's greatest vulnerability is its own workforce.

  • The Malicious Insider: A disgruntled employee stealing intellectual property to sell to a competitor, or planting logic bombs prior to termination. Hard to detect because they have legitimate access.
  • The Negligent Insider: An employee who accidentally emails a spreadsheet of customer PII to the wrong client, or leaves their laptop unlocked at a coffee shop. This accounts for 80% of all insider incidents.

Principle of Least Privilege (PoLP)

Users should only have the minimum access necessary to perform their job duties, and only for the duration required.

  • If an accountant only needs to read financial reports, they should not have "Write" or "Delete" permissions on the financial database.
  • The Threat Mitigation: If the accountant's account is compromised by a hacker, the hacker also only has "Read" access, preventing them from deleting the database.
  • Privilege Creep: When an employee changes roles within a company and gains new permissions, but their old permissions are never revoked.

Separation of Duties (SoD)

No single individual should have total control over a critical process.

  • Requires collusion (two or more people conspiring together) to commit fraud.
  • Example: The person who authorizes a payment cannot be the same person who issues the check.
  • IT Example: The developer who writes the code cannot be the person who deploys the code to the live production server. This prevents a rogue developer from inserting a backdoor.

Introduction to Task 1

Implementing SoD is a complex organizational challenge because it intentionally introduces friction and slows down business processes.

We will design an SoD matrix to prevent financial fraud within a corporate procurement system.

Task 1: Designing SoD Controls

Timing: 45 minutes

A manufacturing company is restructuring its IT Procurement process after an incident where an IT Manager bought £50,000 of servers from a fake vendor company they owned.

  1. Identify the three distinct roles needed to establish Separation of Duties for the procurement lifecycle (from requesting hardware to paying the invoice).
  2. Map out the exact permissions (Create, Read, Approve, Pay) each of the three roles should have within the ERP software.
  3. What technical control could you implement to prevent the roles from bypassing the system (e.g., sharing passwords)?

15 Minute Break

Please return promptly for Part 2.

Part 2: Security Culture & Training

Duration: 1.5 Hours

Building a Security Culture

Culture is what people do when the security team isn't looking.

  • If employees view security as the "Department of No" that only slows them down, they will actively find ways to bypass controls (e.g., emailing files to their personal Gmail to work from home).
  • Psychological Safety: Employees must feel safe reporting a security mistake. If they are terrified of being fired for clicking a phishing link, they will hide the mistake, turning a minor incident into a massive breach.

Security Awareness Training (SAT)

Once-a-year, 60-minute PowerPoint presentations do not work.

  • Micro-Learning: Delivering 3-minute, highly targeted training modules monthly.
  • Role-Based Training: The HR team needs training on handling fake resumes containing malware. The Development team needs training on secure coding (OWASP). Generic training is ignored.
  • Phishing Simulations: Sending fake phishing emails to the company to test awareness.

Phishing Simulation Metrics

How do we measure success?

  • Click Rate: The percentage of employees who clicked the malicious link. (A common but flawed metric).
  • Reporting Rate: The percentage of employees who used the "Report Phishing" button. This is the most important metric. A 5% click rate is fine if accompanied by an 80% reporting rate, as the security team is immediately alerted.
  • Repeat Offenders: Employees who fail 3+ simulations require direct intervention and potentially restricted network access.

Introduction to Task 2

Evaluating the ROI of a security awareness program requires analyzing behavioral data, not just completion certificates.

We will analyze the results of a corporate phishing simulation and propose strategic interventions.

Task 2: Evaluating SAT Effectiveness

Timing: 50 minutes

You ran a simulated phishing campaign disguised as an "Urgent Payroll Update" across three departments.

  • Engineering: 15% Click Rate, 85% Reporting Rate.
  • Sales: 40% Click Rate, 10% Reporting Rate.
  • Executive Team: 25% Click Rate, 0% Reporting Rate.
  1. Which department poses the highest absolute risk to the organization and why?
  2. Propose a specific, tailored remediation strategy for the Sales department. (Consider their daily workflows and motivations).
  3. How should you handle the Executive Team's failure to report? (Consider organizational politics).

Summary & Next Steps

  • Humans are the ultimate attack vector. Technology can only mitigate human error, not eliminate it.
  • A positive, non-punitive security culture is the most effective defense against the negligent insider threat.
Next Week: Cyber Security Management Concepts (Metrics & Third-Party Risk)