Users: Greatest Asset or Weakest Link?

Recent events at very large and very important institutions, such as the Veterans Administration, have highlighted the importance of having an informed, security minded user-base.  Many, if not all, organizations, that electronically processes client or customer information, have begun to recognize the importance of having a comprehensive Information Security Policy in place.  While every well-prepared Information Security Policy includes provisions that speak directly to the roles and responsibilities of the common user base, it is becoming apparent that few organizations actually provide the training and awareness programs, which have proven effective, in creating that sought after, informed user-base. 


As cyber-criminals realize that organizations’ perimeter defenses have become increasingly more difficult to circumvent, attackers have begun focusing their attention on the individual user, as a means for compromise, instead of the organization as a whole.  Cyber attacks such as Phishing attacks and E-Mail scams attempt to trick a user into providing some sort of personal or confidential information to an attacker, without the user knowing.  With the advent of the slew of different removable “Destructive Technology” devices (i.e.…Laptops, USB Thumb Drives, Smart Phones, PDA’s, etc…) that are available to the layperson, it is quite possible for a common user to contract some sort of malware, while outside of the organization, only to inadvertently introduce the malware to the organization’s “squishy underbelly” that is the internal network. 


It is incredibly important, often mandated by law, for an organization to have a comprehensive Information Security Policy in place.  Even more important, is the requirement that the Information Security Policy includes provisions that explicitly detail the roles and responsibilities of the user-base, in the organization’s overall security posture.  Every organization should include a comprehensive Information Security Awareness Program that speaks directly to how a user should interact with the onslaught of cyber attacks that they are certainly going to encounter.  It should be the ultimate responsibility of the user-base to ensure that they are doing their part in defending their organization’s client/customer information.  It should be the responsibility of the organization to ensure that the policies that detail the responsibilities of the user-base are in place.  But, it ultimately comes down to the user to make sure that they are practicing their due-diligence and adhering to those guidelines.

Does your organization have a Security Awareness Program?  Better yet…do you follow it?

This entry was posted in General InfoSec by Troy Vennon. Bookmark the permalink.

About Troy Vennon

I recently separated from the U.S. Marine Corps after 8 years. I spent the first 3 1/2 years building classified and unclassified networks all over the world. There was a natural progression from building those networks to securing those networks. My last 4 1/2 years in the Marine Corps took me to Quantico, Va where I was stationed with the Marine Corps Network Operations and Security Command (MCNOSC). While with the MCNOSC, I was a member of the Security section, which was responsible for the installation and daily maintainance of the 34 Points-of-Presence that made up the Marine Corps 270,000+ user network. After a period of time with Security, I moved over to the Marine Corps Computer Emergency Response Team (MARCERT). There I was the Staff Non-Commissioned Officer of the MARCERT, which was responsible for the 24x7 monitoring of network traffic across the Marine Corps. Specifically, we monitored network traffic for malicious intent and investigated any network incidents as they occurred. While with the MCNOSC, I attained my CISSP, CCNA, and OPST (OSSTMM Professional Security Tester). I have been with MicroSolved for the past 4 months as the Senior Security Engineer, Technical Lead, and Project Manager.

Leave a Reply