How To Derive Cyber Threat Intelligence From the Inside

Some organizations assume that cybersecurity is exclusively an external game. Thr actors attack your company from the outside—targeting your network like a cannonball launched at your brick fortress of security—and that it’s your technical defenses alone (like firewalls and antivirus) that keep the cybercriminals from getting in.

But many overlook the risks right inside your organization, like your cybersecurity-uneducated employees. Without proper knowledge about what they should and shouldn’t do to protect your network, your team can unintentionally perform risky behavior that leaves your organization vulnerable to a breach.

On the bright side, your team holds great power to strengthen your security posture! All they need is some threat intelligence education so they can act as advocates for your security. But before you can develop a proper cybersecurity awareness training program to teach your employees important best practices, you need to understand the behaviors they’re exhibiting that put your organization at risk.

Here’s how you can identify, observe, and change your employee’s security behaviors to reduce your (unintentional) insider threat landscape: 

1. Identify your organization’s risky behaviors 

How can you educate your employees on their risky security behaviors if you aren’t sure what they are? That’s why your first step is to identify these behaviors and determine where your team is doing them and how often. Only then can you understand your true security risk landscape from the inside and plug the holes from attacks.

You can begin by gathering all pre-existing resources about how your cybersecurity awareness program was previously handled. If you’re coming on board as a new Chief Information Security Officer (CISO), see what your team’s done in the past to identify and remediate these potential insider threats. Review any important awareness training campaign metrics that were previously tracked. Here you may discover, for instance, that simulated phishing clicks are still quite high within a specific department, which helps you know where to focus your security nurturing. 

Next, chat with your team at large. Consider sending out a survey to gauge where their weaknesses and strengths lie, being careful to create a trusting, shame-free environment for them to honestly share their experiences without fear of repercussions or punishment. Here you may discover, for example, that there’s no formal policy for reporting security threats or that team members have been bypassing multi-factor authentication measures because they were perceived as “too difficult” or weren’t properly enforced. 

2. Measure and quantify risk levels

With the right contextualized human behavior data analytics, you can weed through the good and the ugly to get a lay of the land for your team’s risky and positive security behaviors.

This is an opportunity for you to begin measuring areas of your security that were previously untracked. For example, maybe your organization had focused heavily on the standard security behaviors, like password strength and VPN usage, but wasn’t tracking your remote risk threshold with employees switching to work-from-home infrastructures—or other "out of the box” metrics like prizes given out during awareness training, questions asked outside of training, who shows up to lunch-and-learns, awareness video sharing, and more. It’s important to think critically about all the areas you are observing security behavior to cover all grounds. 

3. Monitor a dashboard or scorecard

After investing valuable time in quantifying everything you’re tracking and adding previously overlooked metrics to your radar, it’s time to create a plan for holding yourself accountable for their improvements. In order to see all your efforts moving the needle, it’s important to establish a centralized dashboard or scorecard for monitoring all your security behaviors and your greater influence on threat intelligence education.

Many organizations do this by establishing their own personalized “risk rating” to assess their overall security score. Others rely on comprehensive security risk software to take much of the legwork out of calculating and ensure greater accuracy. Here at Living Security, we are developing a solution to do just that.

4. Measure and improve on a routine basis

After determining the security behaviors you would like to change, there’s only one way you’ll be able to track your team’s improvements: by continually measuring your awareness program’s success. This way, you’ll know if your efforts are actually impacting the actions of your employees and be able to prove the true return on investment—something the C-suite needs to see the value of your hard work.

After quantifying and observing your current influence on your team’s inside threat intelligence awareness, you’ll have the data you need to drive further improvements to your security awareness training program and greater security infrastructure at large. It’s crucial to frequently visit your dashboard or scorecard and to leverage the insights to bolster your security posture every chance you get.

Know Your True Human Risk

Making your employees aware of cyber threat intelligence and how they can better secure your network takes time and persistence—and it’s just one way you can improve your organizational security posture.

Discover other ways you can reduce your human security risk by downloading 7 Essential Trends Of Human Risk Management for 2021 ebook today.