WayIn for Enterprise Security

Study after study refutes the myth that cybersecurity is compromised by malicious, brilliant hackers. Advanced persistent threats, state-sponsored hackers, and foreign intelligence agencies are serious threats, especially to major targets, but the vast majority of breaches and leaks result from the cyber equivalent of forgetting to lock your door or losing your wallet.

Two recent, prominent studies show how negligence is the greatest cybersecurity threat. A study by Verizon this month discovered that in 97% of data breaches, hackers only had to use simple methods, and that in 80% of attacks hackers hit websites with weak security rather than targeting a specific firm. Last month, a study by the Ponemon Institute found that negligent insiders were the most common cause of data breaches, causing leaks 39% of the time. Breaches caused by negligent security policies or employees are the most important to protect against, not only because they are the most common, but also because they are the simplest to prevent. It takes little effort to keep your PDF reader updated, for example, but it’s nearly impossible to protect against many 0-day or undiscovered vulnerabilities exploited by advanced and well-funded attackers.

Education and transparency are two keys to making sure your enterprise has the basics covered and your employees don’t leave any glaring gaps in your security. These should go beyond the cybersecurity staff or the IT department to include all employees, as anyone with access to a computer can download an infected file from an email or accidentally reveal their passwords. In the Security Development Lifecycle, which reversed Microsoft’s once-struggling security culture over 10 years to be an industry leader and was later adopted by other tech titans, all employees get some form of training and auditing regularly. This is, unfortunately, very difficult for many companies to implement across many employees on many devices, especially when an organization has a Bring Your Own Device Policy. Surveys of organizations and employees show that while most companies and agencies try to educate users on mobile device best practices, it isn’t reaching employees, as most don’t remember getting any training.

Scott McNealy, the founder of Sun Microsystems, has a new start up called WayIn that may be able to help. WayIn’s instant and anonymous poling can be used to augment cybersecurity education and help IT get a better view of the security practices within their organization. WayIn allows users to vote on polls attached to media for real-time, anonymous surveys. Thus far, it’s been used mostly for entertainment, but there has been some corporate interest in using it to poll employees. A similar method can be used to assess the cybersecurity practices of a workforce and to better target education initiatives.

Employees can get quick, attention-grabbing daily questions on their security practices, such as “When did you last update your Internet browser?” of “Do you open attachments on emails from users you don’t recognize?” The questions will take seconds to answer and employees can be truthful because their responses are anonymous. The results would then be sent to the CISO who can then get an idea of what employees really do and think about security. After answering, the employees can be routed to a quick reminder or informative message about security best-practices or current risks to the company related to the question so that they get a little cybersecurity training every day. Aggregated weekly or monthly, poll results can help IT recognize where the threats to the organization lie, whether negligence is increasing or decreasing, and what areas to target with countermeasures or education.

This is just one of the possible use cases for WayIn. If you haven’t checked it out, try it here: http://www.wayin.com/#!/home