Jacob Ramus

What technological innovations can the new U. S. Cyber Command bring to the fight? If you ask me, it should be a brand new information security training program. Between the National Institute of Standards and Technology (NIST) and the technology we are using in the Cyber world, our weakest link has now become the user. I know talking about cutting edge technology is a bit more exciting, but let’s fix the basics first. All the latest and most advanced artificial intelligence monitoring and prevention systems cannot stop some of the simplest actions of the end-user.

In the Department of Defense (DoD) new people get checked into the command. They make their rounds to all the departments and sign dozens upon dozens of forms, with each one being “important”. They get to the Security Manager’s office, they read and sign a single page, and then move onto the next office. This single page they signed says that they understand the acceptable use policy. This acceptable use policy is built from more pages of the NIST publication than I can probably count.

This is not to throw the current Security Managers under the bus. They are already buried with paperwork, password resets, badge issuing, clearance work, etc. The amount of new policy they have been having to enforce has been exponential. You walk into the security manager’s office and you would think the rest of the building was on fire and everyone was running to the safety of the security office! They just do not have the bandwidth to provide good quality training outside of an all-hands email.

So now our exposure to Cybersecurity and information security has been a skimmed-over ‘acceptable use’ policy and an all-hands email where the reader probably didn’t make it past the first dry sentence. At least DoD employees get their annual automated online course on the subject. The course does do a good job at engaging individuals in regards to the subject. However, I feel that it severely lacks the depth of the education necessary to really get an understanding of why our policies are in-place.

The end-user might learn that we should not use USB drives, but do they know why? Do they know how large the repercussions might be? Do they know there could be a malicious piece of code embedded in the firmware that is undetectable? Or do they think the policy is to protect data theft? If it is the latter, then in their mind they may see no danger from USB drives because they are not planning on stealing data. See the problem here?

At the end of the day the failure is us as security professionals, not the user... It is no secret that NIST has done an amazing job of setting standards in information security. In fact, most large corporations usually adopt many publications of NIST. NIST already has a standardization on training and awareness in publication 800-50. That’s why I don’t think we need a new standard, but a new program within the DoD. A program that is based upon the 800-50 publication, funding, and personnel that takes over the training responsibility from Security Managers.

We have gotten to the point that if additional policies or tightened security is the answer, we will be taking too many steps back in our ability to actually operate. Most importantly, we need to stop blaming the user when an incident happens. Unless their intent was malicious, the failure was not providing them proper education on the subject.

- Jacob Ramus, MScs, PMP, CISSP, CRISC, CISA, CCSP - info@jacobramus.com

Jacob Ramus

Greater Colorado Springs Area

9K followers 500+ connections

View mutual connections with Jacob

Welcome back

Email or phone

Password

Forgot password?

or

New to LinkedIn? Join now

or

New to LinkedIn? Join now

Experience

Verizon

-

View Jacob’s full profile

Explore collaborative articles

Others named Jacob Ramus

Jacob Ramus

Jacob Ramus

Jake Ramus

Jacob Ramus

Greater Colorado Springs Area 9K followers 500+ connections

See your mutual connections View mutual connections with Jacob Sign in Welcome back Email or phone Password Show Forgot password? Sign in or New to LinkedIn? Join now or New to LinkedIn? Join now

Experience

Verizon

-

View Jacob’s full profile

Explore collaborative articles

Others named Jacob Ramus

Jacob Ramus

Jacob Ramus

Jake Ramus

Greater Colorado Springs Area

9K followers 500+ connections

View mutual connections with Jacob

Welcome back

Email or phone

Password

Forgot password?

or

New to LinkedIn? Join now

or

New to LinkedIn? Join now