Featured Article: Hurrah for the Human Firewall!

In this article we are taking a look at the concept of IT Security through the deployment of the Human Firewall. What are Human Firewalls? And why are they needed now more than ever before?

Information security and physical security go hand in hand these days. There are technological security solutions to help us (e.g. firewalls, door access systems, anti-virus software, etc), but these tend to be developed and refined reactively, in response to cyber-criminal activity. Updates and upgrades are released in response to new and already emerging threats, rather than being developed proactively before a threat emerges.

New threats can still, and will always, slip through the nets we erect. We need another layer of protection!

To stay safe we must all be proactive about information security and physical security, rather than trusting technology will block every threat. Organisations need people to form the last line of defence against security threats.

What’s a Firewall?

A firewall is something, usually computer network hardware or software, which controls the flow of data, blocking dangerous activity, filtering out dangerous content to stop it reaching you. Sounds great, until you realise technology isn’t perfect and cyber-criminals are always developing new ways of getting around security.

Sometimes security threats, such as dangerous email or software, can slip past a hardware or software firewall (particularly if it’s a new threat which technological firewalls haven’t been configured to block yet). There can be other, more direct, threats to physical security too, which can’t be spotted by technological solutions (yet), which may also lead to criminals gaining physical access to a network in order to be able to initiate and attack or information security breach.

Stick to the Policy!

Adhering to your organisation’s information and physical security policies is always the best way to protect your organisation. Not following policy puts the organisation (and its finances and data) at risk, as well as its employees, customers and suppliers. Not sticking to policy could also violate compliance regulations. This may lead to loss of certification, legal action and loss of reputation. It could even lead to closure of the business.

So what’s a Human Firewall and why do we need them?

A human firewall is a person able to spot and report breaches of policy. They also notice and report attempts to harvest personal or confidential info or attempts to steal money, such as via the various types of phishing. A human firewall will always act in ways which protect the organisation, its finances and its business data; a bit like an internal superhero!

We are all targets for phishing attempts these days, so, this is exactly why we need more people to become human firewalls! The good news is that you certainly don’t need to be a techie to be a human firewall. We all have the power within us!

How to be a Human Firewall

Becoming a human firewall is almost all down to having and using good old-fashioned common sense.

Here’s some clear pointers to get you thinking and get you started:

1. Always follow your employer’s security policy to protect you, your colleagues, your employer and their customers and suppliers. Don’t be afraid to raise it if you see or hear of anyone not adhering to policy (they may not be as aware or vigilant as you).
2. Hone your skills at spotting all the red flags we’ve listed in our previous article about the different types of phishing, which you can find here. The key skills needed to spot red flags are:-
3. Be a habitual detective – always inspect the sender’s address or phone number (look for subtle differences, such as extra or changed characters in the mailbox name or domain name – fred.fl1ntstone@company.co is not the same as fred.flintstone@company.com. If you’re in a rush you may not spot obvious red flags like this.
4. Never assume anything is genuine
5. Master the Mouseover – Stop and think before you click on anything! Hover over links to see where they really point to first. If in doubt, don’t click and seek advice from your IT support provider.
6. Think critically and err on the side of caution. Be very careful about what you share on social media. Better still, lock down your social accounts so they remain private. Never share any personal info there, because that info could help criminals extract other info from you via other means.
7. STOP – THINK – GET CONFIRMATION before acting upon requests (to click on links, to download files or make payments) received via email, SMS or phone call. Don’t be afraid to ask a colleague to take a look if you receive something suspicious.
8. Be aware – there are apps available on the dark web which work to bypass MFA. You would need to give your approval to this type of app though (you may be urged to download it unknowingly via a dodgy link in an email). Always be careful you aren’t approving such activity as you would be inadvertently handing over control of your account to a criminal.
9. If your multi-factor authentication (2FA/MFA) method (e.g. Authenticator app, mobile phone etc) prompts you to approve a login, do make sure it’s you who is attempting to log in first! It could be someone who’s already stolen your credentials and just needs you to wave them through, so they can hijack your account!
10. Hone your situational awareness –
    • Always be on the lookout. Is anyone looking over your shoulder when you are entering a PIN, a password or door code?Be aware of who is around you. Should they be here?Protect the physical access to your home and your work premises (keep doors and windows locked unless they absolutely need to be open).Never hold security doors and gates open for others to pass through; they might not have authorisation to be there (more on this in a future article).Keep your workspace tidy and free of clutter. This helps avoid misplacing keys, security passes, bank security fobs, access tokens etc. A clear desk policy is best. Lock confidential documents away.Lock your screen when you are moving away from your desk, even if only for a moment.
    • Don’t leave your mobile phone lying around
11. Your User IDs are your responsibility.
    • Never share your passwords with anyone (not even your manager, your supervisor or your IT support provider).Never write them down.Never use the same password for more than one system.Change passwords regularly.Use strong passwords
    • If you have too many passwords to remember, use a password manager. Ask your support provider for their recommendations.
12. Never plug a USB stick into your computer unless it’s definitely yours. If you’re even slightly unsure, or don’t know where it came from it could have been planted there deliberately and may contain malware or spyware (more on this in a future article).
13. Report all phishing attempts immediately to your IT support provider or department, your mobile phone provider and ActionFraud as appropriate. The more we report these attempts, the more opportunities there are to tighten security and even track down and stop criminals. The longer an attack, or attempted attack, goes unreported the more harm can be done
14. Report suspicious people, activity or unexpected deliveries immediately to your organisation’s security personnel (if you have them) or the Police. If criminals can get inside your building they could get on your organisation’s internal network.

Remember – Cyber-criminals don’t just target big corporations (although those are certainly the attacks which hit the headlines).

Small to medium sized businesses are perceived by cyber-criminals as easier targets, because they are less likely to be as hot on IT security as the big corporations. And of course there’s a lot more smaller businesses to go at than there are massive corporations!

Ultimately, we are all targets for cyber-criminals looking to extract personal data and extort money from us, so flex those Human Firewall muscles! You do have the power to stop cyber-criminals in their tracks!

Did you know?

Give us a call today to find out more!

You can also find more information about cyber security in general from the National Cyber Security Centre here

If you’ve been targeted by phishing or other online fraud contact ActionFraud to report the incident.

Note – Our cute little Human Firewall Crew pic was generated using OpenArt AI just to add a little bit of fun to the Cosurica marketing team’s day :-).

OpenArt-generated images can be used commercially, such as on company blogs and we credit our source because it is considered good practice (and definitely the right thing to do), even though it’s not mandatory to do so.

Other AI-generated images appearing in our news items and newsletters are sometimes provided by IT-related content creators we work with from time to time, however they don’t always confirm their sources, so that makes it tricky for us to, but you can pretty safely bet it’s probably OpenArt ;-), (and we don’t encourage gambling just in case you’re wondering!).

We recognise the extensive use of AI-generated images on blogs and websites these days does raise questions about whether or not it’s right for AI models to be trained on real artists’ work without compensating them. We would welcome the UK government implementing regulations to protect the intellectual property and rights of all creative humans, although how it would work in practice remains to be seen.