Walmart Security Chief Criticizes Data Breach Prevention Strategies

When asked to identify the No. 1 source of data security and privacy breaches, many security professionals will point the finger at users and human error. The real culprit, however, is the environment that surrounds a user.

That was the message of Ira Winkler, chief security architect at Walmart, during his Interop Digital keynote on Thursday. According to various breach reports, 85% to 95% of data breaches result from some form of user action, Winkler said. Organizations try to confront this problem by providing security awareness training to their employees -- an effort that clearly isn’t enough. Instead, security professionals must treat users as a part of the overall technology system, just as integral as computers, and limit user actions.

“Remember: The users can only do things that you give them permission to do, that they only have access to do,” Winkler said.

Lessons drawn from safety science, which deals with human error on a regular basis, can help security professionals change their thinking about data breach prevention, he said. In general, safety scientists say that 90% of the blame for safety incidents tends to be the environment where a user was injured. Only about 10% is the user’s fault -- due to carelessness, blatant ignorance, lack of training, or even malice, for example.

Related:10 Tips for Recovery From Ransomware Attacks

Cybersecurity must adopt that view, Winkler said. “I would say 90% of all incidents we have in the cybersecurity field and in technology as a whole is the result of the environment -- giving people, for example, harmful phishing messages and so on,” he said. “A user can’t click on a phishing message if you don’t put it in their inbox. And if a user clicks on it, it’s [not because the user is] stupid … but the system was stupid enough to give the user a harmful email message.”

Winkler introduced the concept of human security engineering, which he described as “the realization that essentially there are layers of protection you put around a potential user action, where a user might initiate a data breach.”

interop_human_security_engineering_model_winkler_0

Awareness is just one layer of the human security engineering model:

“[Cybersecurity] awareness can be a good use of your money, but awareness has changed to showing people videos, showing people funny videos, empowering the user,” Winkler said. “You don’t see this in any other discipline. … In cybersecurity, I don’t know why we abdicated our power.”

interop_phishing_0