If there\u2019s a true constant in our industry, it\u2019s a brutal rate of change. Attack techniques come and go, and my inbox is stuffed with new Indicators of Compromise (IoCs) that lure defenders into a never-ending game of chasing their own tails.<\/p>\n\n\n\n
Whenever one is caught in a vortex like this, it\u2019s a good idea to try to change the game. As threats evolve, so must we. But that evolution must be thoughtful. Ten years ago, our approach was to try to move faster. If we just could speed up our threat responses, we\u2019d catch up — or so we told ourselves. Next, we decided to detect threats at the speed of the computer. Vendors jumped on the machine learning (or even better, the artificial intelligence) bandwagon, and everything algorithmic was suddenly hot. That\u2019s not to say that AI doesn\u2019t have an important place in the cybersecurity defender\u2019s playbook, but it\u2019s also not going to be reserved solely for benign purposes. As defenders shift, so will the attacker, and we\u2019re already seeing some adoption of adversarial AI in the field. Just as IoCs are a necessary, but insufficient, approach, the AI bubble will likely follow a similar arc.<\/p>\n\n\n\n
We\u2019re still midway through this hype cycle, but already I\u2019m sensing another shift: a focus on human behavior. By understanding the human, we can manage risk, abstract away much of the technology, and focus on what matters: how people interact with data. The show floor at this year\u2019s RSA conference was full of marketing materials that claimed humans were at the center of that company\u2019s offering. Images of larger-than-life people adorned the vendor booths, indicating that they really mean it: it\u2019s all about the human.<\/p>\n\n\n\n
By way of transparency, I firmly believe that humans do represent a fixed point in the ever-rippling fabric of cyberspace, and I\u2019m a fan of getting away from the tail-chasing and focusing on approaches that have a longer shelf life. So, in some respects, I came back from RSA encouraged. At another level, though, understanding humans is harder than one might think.<\/p>\n\n\n\n
To date, the security industry hasn\u2019t spent much time thinking about security through a human-focused lens. I could give you example after example of security solutions that ask the person to adapt to them, not vice versa. Given that we typically use computers as a means to an end (no user sits down and tells themselves \u201cSecurity is Job 1!\u201d, unless they actually work in the security team), the topic becomes a constant source of friction that, from the perspective of the user, stops real work from getting done.<\/p>\n\n\n\n
Understanding the human-in-the-loop is a multidisciplinary game, and so security teams must reorganize to support that outcome. The overall experience of the end user is paramount and knowing how to help the user make the right decision \u2013 or why they might make the wrong one \u2013 requires a deep knowledge of people, not just technology. Then, we must understand how those systems and users work together for a particular outcome.<\/p>\n\n\n\n
I am a firm believer in the promise that user- and data-centric security can help us find a place of relative calm amid the constant IoC churn. However, those of us who venture into these waters must do so with a full understanding of just how different they. As a security researcher, I need to be wise about what I don\u2019t know. Understanding how typical users perceive security decisions and interactions falls into that latter category.<\/p>\n\n\n\n
For the CISO, investing in a more user-centric approach to security is time and money well spent. Picking the right partner is a much longer conversation. The CISO should probe vendors to get beneath the marketing veneer that covers the product line. Does the development team have experts in human behavior deeply embedded? Is the solution just anomaly detection under a thin \u2018user-centric\u2019 veil? (What\u2019s anomalous is interesting but it\u2019s not the whole story.) How can the claims made by the vendor be validated \u2013 and how does the vendor do that for themselves, in house?<\/p>\n\n\n\n