Tölvumál - 01.01.2018, Blaðsíða 14

14
SECURITY TRAINING AT
YOUR OWN PACE
THE CHALLENGE
Companies today face enormous cybersecurity challenges, losing
hundreds of billions of euros collectively every year due to data breaches
exploited by hackers. Cybersecurity is famously hard, and attackers are
increasingly adept at circumventing our cyber defenses. Cyberattacks
have caused significant damage for individuals and companies in Iceland
and abroad. The exponential growth of cybercrime worldwide has been
a stark, consistent and alarming trend as can be seen clearly from this
infographic bit.ly/30kDataBreaches
Across the financial, ICT, transportation, critical infrastructure and services
(healthcare, government and energy) sectors, the loss from cyber-attacks
ranges from €1.6 - 10.8 million/year per organization or €208 billion/year
(1.6% of GDP) in the European Union alone [1].
In trying to minimize loss, companies spend significantly more resources
on attempting to hinder software vulnerabilities from being exploited
(reactive security) than to prevent software vulnerabilities from existing
in the first place (proactive security), although proactive security is the
only realistic strategy to get ahead in the arms race against cybercriminals.
According to a recent Gartner report, 90% of companies consider
cybersecurity to be an afterthought, and their control strategies are
focused on ‘firefighting’ when attacks occur, rather than preventing them
[2]. This suboptimal strategy causes enormous loss derived from
cyberattacks, since remediating a defect when software is already
deployed in production can cost 95× more than in previous stages [3],
involving system downtime, damage to brand, loss of customer trust
and even liability costs.
LACK OF UNDERSTANDING
An obstacle for adopting a more proactive approach for software security
is the lack of adequate training of IT personnel. As a chilling illustration,
the most common kinds of software vulnerabilities in 2007 and 2017
compiled by OWASP are largely the same, suggesting a significant lack
of understanding of security issues among software developers and an
overall failure of education. Since security is defined as the absence of
vulnerability, an abstract notion, developers must understand vulnerabilities
to avoid making the underlying mistakes.
Furthermore, there is a lack of training both for security-specialized
personnel as well as for general users. Companies and administrations
are aware of the importance of having an effective security policy and
well-trained staff, but how to apply them to improve the security level is
an unanswered question, that has been addressed as one of the main
challenges in cybersecurity by the European Commission [4]. This
inconsistency has formed a gap between security policy and their proper
implementation within companies.
CONVENTIONAL TRAINING
The best strategy to counter cybercrime lies not in technological security
solutions but rather well-trained individuals who understand security
threats as well as their adversary’s mindset and can adapt to new attacks.
Unfortunately, proper training has been lax, owing to inappropriate and
ineffective training methods, a lack of follow-up, and a dearth of qualified
mentors. The availability of application security training is scarce, even
in universities teaching computer science, security is at best an optional
course.
Within companies, developers are typically trained in writing secure code
through an annual or semi-annual presentation covering the OWASP
Top 10. Yet such presentations have limited impact since people are
unable to fully internalize and understand the security issues and to avoid
the problems in practice. Research has shown that with passive learning
(reading, hearing, watching) you only remember 10 - 30% of the content
2 weeks later, while with active learning (doing yourself) you remember
close to 90% [5].
Barring proper training, developers will continue to write insecure code,
which can be costly for a business when vulnerable code is exploited
resulting in a massive data breach.
Companies have the option of organising an internal seminar with the
caveat that it has to be held multiple times to get full participation as
projects, vacations, travelling and other priorities override peoples
attendance. This has such cost and planning overhead that in effect,
Steindór S. Guðmundsson, Chief Product Officer at Syndis