In Depth

Can Security's Human Side Stop Data Breaches?

As human error increasingly becomes the top reason for security breaches, behavior-based strategies are making their way into the workplace to supplement technology

By Joan Goodchild, Senior Editor

Page 2

Similar findings from consulting firm Deloitte earlier this year back up the Cisco research. A Deloitte survey of more than 100 companies found 75 percent cited human error as the leading cause of security failures.

Green Armor is one of several companies with a product that is based on human behavior. A quick Google search turns up many antivirus and malware solutions that utilize behavior analysis. Most of the major antivirus software makers, such as Symantec and McAfee, have implemented some kind of behavior-based defense into products.

A California-based consultancy called Security Mentor, which only launched in April, is hoping to find business in an approach that goes right to the source: the user. Security Mentor offers training that, according to founder and President Marie White, takes on a brief, frequent and focused approach. Employees take part in weekly, seven-minute-long informational Web sessions that teach and reinforce good security habits and practices.

"There is wide spread information at this point that employees are one of the greatest threats to an organization," said White. "But the question is: Why do they remain the greatest threat? One can assume they are either intentionally or unintentionally engaging in risky behavior. Most people agree it's unintentional. This training addresses that."

Security Mentor, which launched at the RSA conference, is still in the start-up phase, according to White. While the firm is not working with any customers yet, there is interest from a wide-swath of commercial and government organizations, she said.

White said in developing the sessions, she also took into account how the typical employee works today. The sessions are short to fit the attention-span criteria of a busy person. They are regular so that retention of information will be more effective.

"We consider how employees multi-task and the training fits in that attention span window," said White. "Also, how often people get interrupted coupled with how they remember. And the frequency of having training weekly makes it a lifestyle difference for employees."