Broken communication
The fire triangle anology
Introducing the AVA=RISK Security Model
It’s time to expand our scope of how to educate on security and treat risk. First, we should clearly separate information security risks from technology. Unfortunately, security is regarded as an IT or engineering responsibility in most organisations. The AVA=RISK Security Model sheds a light on the illusion of total security through technology. It provides us with a lens to treat risk, by focusing on Actors, Vulnerabilities and Assets. Explore each aspect for any risk, and mitigation measures can be selected. Usually, addressing only one aspect will not suffice. Let’s take the phishing problem as our example. The ease by which hackers can impersonate others through email is the vulnerability. And as we have seen, we do not have enough tools to adequately protect ourselves. But water isn’t the only solution to stop a fire. Luckily, we can also fight the fire by taking away actors or assets.
The first element: Actor
There are two active actors in the phishing game: hackers and victims. We can’t magically block or cure hackers, so let’s collaborate with our colleagues. Security awareness is a fast-growing practice, yet it remains largely ineffective Gamification, repetition and simulations should improve education programs. But how can we really engage our colleagues? At the core of the problem there is the accountability perception that spam filters should do the job. And if it’s the security team believing it, how can we expect the controller or sales representatives to take responsibility? We need to train anyone with an email address to build security hygiene habits. Reducing mistakes through better judgement skills results in fewer victims. And if victims are removed from the equation, there are fewer actors engaged in the phishing game, lowering the risk of a data breach.
The second element: Vulnerability
Improving security by resolving vulnerabilities sounds easier than it is. If email is a fundamentally flawed system, what can one do? To some extent, organisations can decide on alternative means of communication. Slack is essential to millions of businesses, as are collaborative platforms like Microsoft Teams. Their closed and centralised nature is a strength for security, and it will drastically lower chances of responding to an impersonated colleague asking for that payment or permission. For external reach though, email still has merit. When it is combined with encrypted file sharing, such as the brand new Firefox sand, the vulnerability can be managed.
The third element: Asset
The third side of the triangle, the asset aspect, requires us to consider what information assets are available and accessible. The “principle of least privilege” should be the golden rule. Its application tends to fade over time as convenience takes over, therefore data governance is important. The GDPR also provides advice in this regard. Both data minimisation and data retention are guiding principles to decide on what data to process, and for how long. If any person has access to only few data sources, a hacker will be limited in the same way, even if a phishing scam succeeds in stealing credentials. The famous criminal Willie Sutton was once asked why he robbed banks. He supposedly stated: “Because that’s where the money is.” Data is the new gold, and providing access to it must be thought of accordingly.
Technology is a tool
I’m inspired by how technology, society and policy interact. My professional career started with a decade in web development and a fascination for application security. Later roles in product and management allowed me to reassess our dependence on technology. Now, digital transformation allows us to transform our economy. We can scale our services and optimise our workforce. But technology can also take us hostage if it is not bounded. Security is like the brakes on our car. It may slow us down, but it also enables us to move faster. We should regard technology as just one of the tools in the security toolbox. If security is subject to technology, we are blind to see the risks. And worse, we would miss out on great opportunities to combat risk. With AVA=Risk in mind, we can find better solutions and further raise security awareness.
