The Root Causes of Cybersecurity Risk and How Automation Can Help

Key Points:

• Human mistakes continue to be the root cause of data breaches. Habit, bias, and the status-quo interfere with our ability to realistically assess cybersecurity risks.

• The U.S. government is escalating efforts to address both workforce shortages and sophisticated cyberthreats by spearheading organizational change that prioritizes collaboration, inclusion, transparency, and crowdsourcing of innovation.

• With exponentially increasing data and a shift to Zero Trust, automation is a necessity to reduce human stress and mistakes from data overload, while also improving decision-making and increasing job satisfaction.

The recent hacking of Uber by a teenager, reported to be affiliated with the notorious Lapsus$ teen hacker gang, demonstrates once again how a single employee’s distracted decision, when targeted by a psychological attack, is a major risk factor. The hacker broke in by compromising a contractor’s multifactor authentication (MFA) using MFA bombing to fatigue the contractor until the victim approved the request. Breaches exploiting weak security tools and social engineering continually play out in the news spawned by nation-state threat actors, ransomware gangs, and teen hackers like Lapsus$.

Psychologists ask their patients to look beyond external negative symptoms and become aware of internal root causes. This process uncovers fixed and inaccurate mental rules (biases) that are being relied on that can lead to detrimental outcomes. However, complacency can be changed through communication, education, and awareness – from the leadership level all the way down to the user level.

Human mistakes are a major cause of data breaches. Yet many organizations continue to assume (despite evidence to the contrary) that staff:

• are well-educated about cyber risks
• know how to prioritize cybersecurity alongside completing job tasks
• feel their efforts are valued and can safely give feedback
• optimize security tools that may not be user-friendly, even when distracted by people and daily tasks

Human decisions are often made quickly based on habits and bias from past experiences due to pressures from:

• social conformity (two-way feedback is not encouraged)
• social norms and time constraints (get your job done)
• apathy over the status-quo (we’re stuck using tools and processes that don’t work well)
• “accepted wisdom” (such as multifactor authentication is secure and prevents breach)

Unless leadership takes an honest look at the internal rules, tools, and policies that create apathy, confusion, stress, and mistakes, employees will continue to default to habit in order to get their job done. Enterprise cybersecurity risk is a different animal than other kinds of risks. For example, weather can be a risk but it doesn’t psychologically target your staff with persistence and ever-evolving sophisticated tactics.

How do you increase adaptation and compliance, dispel complacence, and support user-friendly Zero Trust policies and tools that actually engage and empower employees, rather than relying on punitive, aggravating measures?

Cognitive bias, power hierarchies, and lack of clear communication, collaboration, and feedback are underlying root causes of human mistakes that create serious cybersecurity risks. Check out our recent articles on the important topics of cyber resilience, human bias, collaboration, and innovation:

• Cyber resilience requires managing human risks and leveraging innovation and automation
• Three ways to reduce cybersecurity risk: bias education, collaboration, and intelligent automation

When it comes to change, leadership must set the example, promote honest feedback, and be accessible. Teri Green, a former CISSP Chief Information Officer at Normandy Schools Collaborative and founder of her own cybersecurity firm, said that to help her team cope with difficulties she began leading daily mindfulness sessions, according to the article “Using Mindfulness and Authenticity to Lead Tech Teams.“

Green said she believes we have to push ourselves and, “I’m a firm believer that life begins at the end of your comfort zone.” She emphasized:

“When considering how people decide to do one thing or another, it all comes down to seeing and believing. When leaders show up, they need to show up as the individual they wish to see.” 

If cybersecurity is a top concern of your organization, then your employees must see it and feel it by the inclusive actions of your leadership. These actions may include cross-departmental collaborations and feedback, funding user-friendly automation that reduces tedious work, stress, and mistakes, or by making cyber awareness an ongoing and meaningful part of your culture and personally relevant in daily decision-making.

For example, Washington, D.C.-based Children’s National Hospital implemented a code that signals staff to unplug or turn off internet-connected devices to mitigate cyberattacks. Nurses, physicians, and staff members are educated and empowered to look for suspicious activity on technology devices and then report it to the hospital security staff, who would would then send the “code dark” signal to all staff. All hospital staff members carry cards with “code dark” steps on lanyards.

A National Need to Change Organizational Dynamics

The serious nature of cyberthreats has brought our nation to the point of recognizing there have been systemic and mental biases hindering information and idea flow between individuals, organizations, and hierarchies.

The newly released Cybersecurity and Infrastructure Security Agency’s (CISA) 2023-2025 Strategic Plan is working to break down barriers and hierarchies in order to promote a new model for innovative collaborations. A few of the stated key areas of focus include:

• “CISA must lean forward in our cyber defense mission toward collaborative, proactive risk reduction. Working with our many partners, it is CISA’s responsibility to help mitigate the most significant cyber risks to the country’s National Critical Functions, both as these risks emerge and before a major incident occurs.

• We will strengthen whole-of-nation operational collaboration and information sharing. At the heart of CISA’s mission is partnership and collaboration … We will succeed because of our people. We are building a culture of excellence based on core values and core principles that prize teamwork and collaboration, innovation and inclusion, ownership and empowerment, and transparency and trust.”

The White House also released the Strategic Intent Statement for the Office of the National Cyber Director (ONCD), focusing on collaboration and innovation between the public and private sector, which states:

• “Individual cyber hygiene is important and personally laudable, but systemically inadequate … [The ONCD] will improve public-private collaboration to tackle cyber challenges across sectoral lines. It will align resources to aspirations by ensuring U.S. departments and agencies are resourcing and accounting for the execution of cyber initiatives, assets, and talent entrusted to their care, and considering all possible future such requirements … 

• We must “crowdsource” our ability to identify and stop transgressors in much the same way they crowdsource their exploitation of us.”

Key phrases from the two plans above are “innovation and inclusion, ownership and empowerment” and “crowdsource” for innovation. For too long there has been implicit bias around a belief that good ideas come from having the “right” educational background, experience, or titles. Now with the Great Resignation, looking outside normal hiring channels is critical to fill the cybersecurity workforce shortage.

Young hackers have become a force to be reckoned with and it’s worth considering how their abilities can be proactively mentored and validated in positive ways. The Lapsus$ teen gang has been behind many major breaches like Uber. On the flipside, former teen hacker Marcus Hutchins turned from the dark side to become a Jedi-like white hat hacker and personally stopped the 2017 global WannaCry ransomware attack in just hours.

Maybe we need people like Marcus Hutchins performing outreach on the dark web to help lead misguided, attention-seeking hackers into the light (hackers and their families need critical infrastructure like utilities, water, and hospitals too). It’s time we consider new ways to crowdsource talent and innovation by looking beyond college graduates, long resumes, and organizational hierarchy. Our world may depend on it.