How we imagine living in a castle to understand cyber security and explain it to others
One of the things Holly and I have been grappling with as we talk to more people about cyber security is how to make it meaningful to them.
They get that it is important, but they don’t really understand what it is. They have nothing to visualise or compare it with, especially if, like most of us, they don’t have a technical background.
We were in the same boat ourselves, trying to fit together all the different threats, vulnerabilities and solutions into a meaningful framework.
So we’ve been playing with analogies and have been having success with a castle model.
It’s based on the fact that, for all the techno talk and jargon, there’s nothing fundamentally different to protecting our data than anything else we’ve ever cared about.
Traditionally we protected our possessions and loved ones in a castle and the principles behind why it worked are the same as the ones we need to use for our cyber security.
1) Have a strong perimeter
A castle works first of all by having a strong wall and/or moat to prevent unwanted people getting in. In the modern era we might add CCTV to monitor our perimeter at all times, With the perimeter in place, and well maintained, we can start to feel safe inside.
In cyber security, we need a strong perimeter to prevent access to our data and systems too. This is the most technical element of our model and, at it’s simplest, means making sure we update all our software, have an appropriately configured firewall and use anti-malware software.
The perimeter is the aspect of your cyber security that will most likely have oversight by IT specialists.
2) Keep the gates locked
No matter how strong your castle wall, it is not enough to keep us safe because we are trading and need to interact with people outside the walls. We need to be able to allow movement in and out through the castle gates and this introduces a huge element of vulnerability: we need to be really careful we keep the gates locked unless authorised people or goods are moving through them.
In cyber security, there are all sorts of things that can inadvertently unlock our gates, no matter how carefully we constructed our perimeter. This might mean using weak passwords, letting the wrong people have access to the wrong parts of our system, or allowing a secret tunnel to bypass our perimeter and go straight to our treasure through the way we use our laptops or mobiles when on our travels.
In order to keep our gates locked, we need meaningful and carefully thought out policies and procedures.
3) Don’t get tricked
With our strong wall and locked gates, we might start to relax, but we shouldn’t get complacent because, well, people. People can be tricked into letting the wrong outsiders through them or perhaps they might even be persuaded to take a bribe and leave them open in the middle of the night.
In cyber security as many as 90% of successful cyber attacks are the result of human error. After all, why bother trying to hack your way through a strong perimeter if you can just trick someone into giving you complete and unfettered access to their data or key accounts? Phishing attacks are currently the cyber criminals best option and grew at 30% in the last quarter alone.
If we want to make sure we aren’t tricked into giving away our treasure, we need to make sure they have both the knowledge and the motivation to do the right things. For us, that means regular awareness training along with the creation of a positive cyber security culture across the business.
4) Prepare for the worst
Hopefully then, we have a strong wall, our gates are locked and our people are doing the right things. We should be in decent shape and be able to get on living our best lives, keeping our guard up for new threats at all times. But sometimes the worst will happen and we need to do our best to be prepared.
In our castle, we might be subject to a siege where we have to keep attackers out, but are then unable to leave the castle. If we haven’t planned for such an eventuality in advance and put down sufficient stores of food, then it’s game over. We would have no choice but to open the doors and let the attackers do their worst.
With cyber security things will go wrong. It’s probably a question of when, not if, we will face a successful attack. But the better prepared we are, the less impact it is likely to have. This means, for example, having secure back ups. It also means having taken the time to think through what we would do it something went wrong and taken appropriate steps to ensure we have the information and processes ready to respond.
So there you have it.
- Have a strong perimeter
- Keep the gates locked
- Don’t get tricked
- Prepare for the worst
No analogy or model is perfect, but we find this one helpful and hope you do too.