How to create a human firewall: Top 7 elements required for success

October 11, 2018 by

Stephen Moramarco

A robust security system contains more than just hardware or software; there must always be a “wetware” (aka human) defense element as well. A so-called “human firewall” is a concept in security awareness that empowers a team to fight against hackers in a proactive as well as reactive fashion.

In this article, we will discuss how to create a human firewall that will serve as your first (and last) line of defense against breaches.

Two year's worth of NIST-aligned training

Deliver a comprehensive security awareness program using this series' 1- or 2-year program plans.

Book a Demo

What is a human firewall?

The definition of a human firewall is fairly straightforward. It is essentially a commitment of a group of employees to follow best practices to prevent as well as report any data breaches or suspicious activity. The more employees you have committed to being a part of the firewall, the stronger it gets.

Remember that a human firewall is different from a Security Champion in that Security Champions are more about education and awareness. However, a human firewall can include Security Champions.

The importance of this added human layer of protection lies in the fact that many breaches are due to employee error. The latest report from the Ponemon Institute shows that 25% of successful hacks are caused by carelessness or simple mistakes. Software, too, makes mistakes, sometimes allowing phishing messages through or red-flagging real communications.

Therefore, it is felt that the vigilant human can see potential hazards software misses and can prevent errors from being made. However, to have your firewall be as successful as possible, it’s important that these seven elements are included.

7 Elements required for a successful human firewall

1. Make it easy

It’s important to have long, detailed security policies that cover everything from password creation to mobile devices. But instead of overwhelming them, have your human firewall focus on strengthening a few weaknesses at a time.

2. Keep education ongoing

Many companies only have security awareness training once or twice a year, but this is clearly not enough. Human firewall education should be continuous, receiving updates and briefs as new threats arise. Others should be educated whenever they change job titles as well as on a quarterly basis.

3. Give incentives

Encouraging participation in the human firewall can be as simple as giving each member special recognition for doing things like catching phishing emails. You can sweeten the pot with prizes or other awards. A recent study by the University of Oklahoma indicated that public attribution and validation were strong motivating factors in participation.

4. Include all departments

People shouldn’t feel intimidated or that they aren’t tech-savvy enough to be a part of the human firewall. In fact, it’s essential they are encouraged to join. This particularly includes C-level executives who are often a target for spearphishing scams that steal identities.

5. Keep it human

Those that participate should do their best to help others with cybersecurity concerns, thereby helping change culture and behavior. Avoid treating people like cogs in a machine.

6. Monitor vigilance

This is an ongoing war, so you must make sure all defenses are on high alert at all times. To check, use a phishing simulation program that can send phony emails to unsuspecting employees and see if any links are clicked. If someone does fall for the phony phishing scam, send a member of the human firewall to talk to the person in more detail.

7. Always be evolving

The human firewall should be on constant alert for new threats, reporting any suspicious activity. As their tactics change, so must the team incorporate new best practices into their system.

Phishing simulations & training

Build the knowledge and skills to stay cyber secure at work and home with 2,000+ security awareness resources. Unlock the right subscription plan for you.

VIEW PRICING

Conclusion

A human firewall is an important layer in the fortress defense against cyberattacks or insidious invaders of any type. Working together, they can identify threats as well as prevent data breaches or mitigate damage. Start building your human firewall today!

Sources

• 2018 Cost of a Data Breach Study, Ponemon Institute
• The ‘Human Firewall’ Is Dead - Long Live the People, Tripwire
• Building the Human Firewall, Center for Applied Social Research, University of Oklahoma
• Creating a Human Firewall, Infosecurity Magazine