Using The Human Perimeter To Detect Outside Attacks

While automated technology, network sensors, and behavioral analysis are crucial to helping security professionals detect attacks against their network resources, sometimes nothing can beat good old-fashioned human observation. Security team members can only do so much to personally observe aberrant behavior, but fortunately, they may have a ready source of eyes and ears in what some jaded pros might consider an unlikely pool of candidates: end users.

The fact is that end users are at the front lines of attacks—most outside incursions to the network usually involve some form of social networking or another. Instead of simply putting up posters and sending out multiple-choice questions once a year about how to avoid phishing dangers altogether, social engineering experts say organizations should seek a more realistic and robust training goal. They should be teaching employees to spot suspicious activity and report it without fear of recrimination, whether they fell for a ploy or not. Ultimately, the goal is to turn employees into a sort of human perimeter to help the security team detect attacks more quickly.

"There are many more human sensors on a network than any intrusion detection system can ever hope to have, because every employee can be one," says Rohyt Belani, CEO of PhishMe. "If you look at the way security responders work today, they're picking leads off of either their IDS systems or their network logs and then they are going through a similar process to find suspicious behavior. Given the right mechanisms or right sorts of tools, the humans who are resilient to these attacks actually become great reporters."

The fact is that security has always been a game of reducing the odds of exposure rather than eliminating it. And yet, when it comes to the human element of security too many security pros are quick to disparage all end users as stupid because attacks continue to get through, says Mike Murray, managing partner for MAD Security. But that's like saying any other piece of detection technology is worthless because it doesn't work 100 percent of the time.

"A really motivated attacker is always going to get in—if you've got a skilled person, they're going to find a way into the network. The key is quick detection and good response capabilities at that point," Murray says. "Your IPS doesn't stop everything, but it should tell us something that gives the SOC operator an idea about where to follow up on something. If we can get our users doing that as well, that detective capability will allow us to respond much more quickly that we can naturally."

In many cases, human intuition may not kick in fast enough to prevent someone from falling for a phishing ploy or a malicious link altogether, but it usually happens pretty soon after the first strike, says Lance Spitzner, training director for SANS Securing The Human Program.

"When somebody gets hacked, they usually figure it out. Either their system crashes or a document looks a little weird or a particular website makes the browser act funny," he says. "When they report it, they improve organizational resilience."

Unfortunately, many organizations have a difficult time developing that resilience through a human perimeter because they simply don't have the mechanisms in place to support it. According to Chris Hadnagy, chief human hacker for Social-Engineer, Inc., one of the biggest impediments to the process is a fear by employees that telling someone about a problem may get them fired. The other is not having any procedure for properly reporting it.

"One of the things we find all too often when working with companies is that they don't have reporting agencies within their organizations," he says. "When something bad occurs, there's no place for the employee to say, 'Hey, I think I just clicked a link that was bad.'"

[Apple, General Motors, Home Depot, Johnson & Johnson, Chevron, Boeing, and other major corporations easily fall to social engineers in recent contest, a new report shows. See Social Engineers Pwn The 'Human Network' In Major Firms .]

On the back end, the organization needs to have enough manpower to handle these reports, Hadnagy says, explaining that for a Fortune 500 company with thousands of employees, "this is not a one-person job."

Not only should this team be working to sift through these reports and triangulating them with logs and other detection technology output, but it also needs to establish solid and positive communication with the employees that send the reports to encourage future cooperation.

"If they feel like they're going to be chewed out or punished, we create an atmosphere of fear," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.