Cyberattacks proceed just as they did in the analog world over 100 years ago. They are based on communication and knowledge of confidential information. While applications, networks and other technical details are always the subject of intense discussion in the Internet age, people forget about the parts of information security that have little or no protection: The interactions between people. These happen regardless of any security measures, because every company receives e‑mails and phone calls all the time. How do you deal with this interpersonal flow of information? More specifically: How do you help sensitive departments like Human Resources — HR make secure decisions?
Attacks past IT technology?
When it comes to communications and information security, many think of anti-virus or spam filters. These are basic components of basic security. But neither policies nor configurations answer the really important questions for implementation. What content in what language does your company process? Do you have to answer all letters in every form? As soon as it comes to the digital world, however, not everything becomes different. Of course you receive business letters every day. What looks like advertising or paper on printed paper usually looks like it digitally. The security problems that arise from communication are just unfortunately passed on to the IT department. Of course, the HR department wants to accept new applications from all possible input sources because talent could be missed. Potential attackers also know this and will use exactly the channel that makes an attack the easiest.
Spying via the personnel department / human resource / HR
In addition to the technical level, there is also the social engineering level. Incoming documents such as the CV or references are checked. However, even with the latest technology, it is not possible to decide in minutes whether it is a genuine applicant or an applicant for the purpose of spying. Clearly, you can’t suspect all new hires equally, but that’s not the point. It’s about how you present yourself to the outside world and how you handle the risk that every potential business letter carries. Especially when penetration testing without knowledge of the internal structure, an application is a great way to gain insight into a company.
The findings can be summarized:
IT lacks the information to implement measures.
Certain departments will always need to be filterless/publicly accessible.
Attackers will always exploit these circumstances.
Security from head to toe — or the other way around?
Policies and compliance alone won’t help with this problem. You need clear processes that the technology and the affected departments, e.g. HR, are aware of. If it’s clear what languages documents are allowed to have that are processed, then that helps the IT department configure filters, to give one example.
Unfortunately, some start securing at the endpoint and implement measures without starting at the business processes. In security consultancies, you should use consultants who have both the organization and the technical implementation in mind when conducting their research. Ultimately, implementing information security is just finding and filling gaps that everyone has somewhere. You can’t forget the human factor and its role in the company.
Further information:
Caution! Social Engineering
Der Unsinn von Social Engineering
Seminar IEC 62443
Seminar: IT-Security / Information Security
