Cyber security 101: How to combat the threats that exist among your own personnel

Justin Dolly, Chief Security Officer of SecureAuth, examines how data leaks from personnel represent the biggest cyber security danger to defence and military organisations. 

When it comes to military and defence organisations today, one of the largest cyber security concerns is not actual attacks – although those are still important and prevalent – but rather data leaks.  

Insider threats and personal devices are two of the biggest causes of data leakage and one of the fastest threats to defences today as more and more devices are making it into sensitive areas. Last year, the fitness app Strava inadvertently exposed sensitive data about exercise routes shared online by soldiers, which could be extrapolated to pinpoint overseas facilities. With this information out in the open and out of the military’s control, defence organisations began clamping down on troops’ use of fitness trackers and apps, and further prohibited the use of GPS features on any government or private gear. 

This exemplifies how the rapid development of new and innovative information technologies bring new challenges to operational security and force protection. It’s crucial for military defence teams to stay on top of these challenges and continue to refine policies and procedures; otherwise, this could put individual members of the military at risk, even when they are not in combat zones. 


Identifying the weakest link 

As with most things in life, you’re only as strong as your weakest link – and in any organisation, it’s people. The best firewalls can be defeated by a simple phishing email and flat networks enable intruders to perform lateral movement across an environment with relative ease. New devices and applications can be difficult to keep off the corporate network, introducing a slew of new threat vectors all the while causing frustration among the IT teams that support these networks.  

Therefore, it’s vital for military officials to control access and develop enhanced policies for use or access to their data and networks. So how do you achieve this? Through the implementation of multiple pre-authentication or adaptive authentication techniques without introducing unnecessary friction for the users. Combining strong security with adaptive authentication allows authorised parties to access what they need quickly and easily, while simultaneously keeping malicious and suspicious actors out of the network and systems.  


Education, education, education, and secure access control 

A critical component of improving any security programme is education. As demonstrated by the Strava example, a data breach occurs when one or more individuals can read data they are not authorised to access. And it is often because of human errors like this that cyber criminals are allowed to gain access to sensitive material.  

Internal user training can help educate employees and personnel on how to enable secure access control, what threats to look out for and how to report anything suspicious. Therefore, security awareness training should be acknowledged as one of the critical components of a robust security programme. Being armed with the knowledge and skills to protect themselves and their organisations will help prepare employees for the range of security threats they are bound to face; whether from an external cyber attack or from their own misuse of technology or access to data. 

Military organisations shouldn’t neglect their own responsibility to deploy the most secure authentication strategies to mitigate their exposure to cyber attacksThey need to carefully examine how they manage their identity security and address how to differentiate legitimate users from illegitimate ones. Rather than handing over the keys to the very lucrative kingdom, a comprehensive strategy should work to determine if a login attempt is from a legitimate user or from an attacker using stolen credentials. 


Prevention is better than breach 

With identity and credential exposure accounting for many high-profile data breaches, prevention is the best protection. Internal training and awareness, and deploying secure access controls, dramatically improves organisations’ defences and helps prevent future cyber attacks.   

The best approach ensures the desired level of security without hindering the user experience. Care should be taken to avoid putting users though complex security measures which can cause user frustrationhave a negative impact on productivity and result in a financial burden to the organisation. The most efficient approaches to security and usability leverage modern techniques that fit both the culture and the needs of the organisation and bring together identity and security.  

When dealing with critical and highly sensitive information, as defence organisations undoubtedly do, the right security approach is to focus on the programmes that will help secure their weakest link: people.  

If you would like to join our community and read more articles like this then please click here.

The post Cyber security 101: How to combat the threats that exist among your own personnel appeared first on Defence Online.


Who are we?

From publishing the first national directory of public sector contracts, to being the first to market with our online Tracker solution, we have been the true pioneers of technology and innovation in the public sector marketplace. Throughout our 39 years, we have continued to evolve and chart new territory – placing our customers at the heart of everything we do. Take your business to the next level with Tracker now.

If you request a demo today!

Download your Free UK Defence Industry Report

Start Your Free Trial Today

Download your Free UK Defence Industry Report

Download your Free UK Defence Industry Report

When you sign up for a 3 day free trial or demo.

Limited time only

    BiP Solutions owns DCI and we look after your details carefully. We offer a range of products, services and events (some of which are free) that help buyers tender more efficiently and suppliers find, bid for and win public and private sector contracts. Only tick this box if you wish to receive information about these. We will never share your details with third parties and you will have the opportunity of opting out of communications every time we contact you. For further details, please see our Privacy Policy