Using Human Vulnerability to Strengthen Security

Introduction

As security professionals, it's important to recognize not only the technical risks to our organizations but also the risks that arise from human behavior and actions. Human vulnerability management addresses these risks by focusing on how individuals can be uniquely susceptible to social engineering and other threats.

What is Human Vulnerability Management?

Human vulnerability management is about understanding and addressing the unique ways individuals are vulnerable to social engineering. Key points include:

1. 1.Humans struggle to recognize their own vulnerabilities to social engineering.
2. 2.Security awareness programs are necessary but often used as a checkbox exercise, failing to remediate real risks.
3. 3.What's missing is an accurate picture of individual behavior and vulnerability, which can be used to deliver personalized training and assessments.
4. 4.Applying the framework of assess, validate, prioritize, remediate, and verify—commonly used in penetration testing—to human vulnerabilities.

The goal is to create a program that identifies individual vulnerabilities and crafts an educational experience tailored to each person, combining tests, videos, and content to ensure understanding.

Why Individualized Training Matters

Traditional training often fails to address specific vulnerabilities. For example, if an employee repeatedly receives the same training video after failing a phishing assessment, they may ignore it, gaining no new knowledge or behavioral change. Instead, training should:

• ​Identify specific vulnerabilities (e.g., susceptibility to authority, urgency, FOMO).
• ​Deliver targeted content that addresses these vulnerabilities.
• ​Engage employees in a way that helps them recognize and overcome their unique weaknesses.

The Importance of Human Vulnerability Management

Including human vulnerability management in your security program is crucial because:

• ​Human error is a leading cause of security breaches. According to Verizon's Data Breach Investigations Report, around 82% of breaches involve the human element.
• ​Reducing human risk can significantly lower the likelihood and cost of breaches. This includes savings on cyber insurance, business continuity, and employee productivity.

Practical Steps to Implement Human Vulnerability Management

1. 1.

   Measure Correctly:

   • ​Collect data that shows what employees are vulnerable to and how their vulnerabilities change over time.
   • ​Interpret this data to get a full picture of risk.
2. 2.

   Simulate Real-World Threats:

   • ​Deliver phishing assessments and social engineering attempts that reflect the actual threats employees may face (e.g., business email compromise, voicemail scams, USB drops).
   • ​The goal is to expose employees to realistic scenarios so they can learn to recognize and respond appropriately.
3. 3.

   Gauge and Improve Employee Sentiment:

   • ​Measure how employees feel about the awareness training program.
   • ​Address any disconnect or friction between IT/security teams and other employees.
   • ​Use HR surveys to gather feedback and ensure stakeholders communicate the importance of security awareness to all staff.

Conclusion

Human vulnerability management is essential for reducing the risk of breaches caused by human error. By measuring vulnerabilities accurately, simulating real-world threats, and fostering positive sentiment toward security programs, organizations can better protect themselves. For further guidance or questions, you can reach out to the presenter or the company for support in applying these principles.

Thank you for tuning in to Gone Phishing. For more information on high-quality security awareness training campaigns and how to engage employees effectively, visit Phin Security at phinsec.io.