The credit card industry got it right, agencies should do the same

I recently read a report published by analyst firm Forrester about the top security threats we should expect to see in 2018. The document offers a detailed list of organizations that were breached this past year and the number of users whose sensitive information was compromised. Equifax (143 million), Kansas' Department of Commerce (5.5 million), America’s JobLink Alliance (4.8 million), DeepRoot Analytics and the Republican National Committee (198 million) are some on the list, which doesn’t even factor in significant breaches prior to 2017 like Yahoo! (3 billion accounts hacked).

Let’s face it: Criminals already have so much information about us, secret questions and login credentials are just about meaningless. And hackers are quickly realizing our private information has real value, enabling them to access the inner workings of public- and private-sector organizations, masquerading for months as legitimate employees.

Organizations, especially government agencies that hold our country’s biggest secrets and citizens’ most treasured data, must flip their strategies. Instead of focusing on preventing bad actors from stealing login credentials, they need to ask themselves, “What should we be doing once they are inside?” “How can we reduce the risk of a compromised user?” Agencies should assume workers are not really who they appear to be and put measures in place to verify when an intruder is pretending to be an employee.

The credit card industry has mastered this strategy. There is no safe credit card number, yet we still use cards to pay for just about everything. That’s because card companies have implemented an efficient process to minimize cardholder impact when fraud occurs. I recently received a text message from my card company asking if I bought gas in Connecticut. The company detected an unusual charge, something that was out of the norm of my typical purchases, and within minutes asked me to verify if I did indeed purchase the gas or not. I replied, “No,” and the company froze my account. On the other side, I also received a text message asking if I bought gas in Iowa. At that time, I was in Iowa visiting family, so I replied “Yes,” and didn’t hear from my card company again during the trip.

The entire process on both occasions was effortless and effective. I felt minimal impact and yet was protected. Credit card companies have demonstrated so much success with this model that we, as cardholders, expect to hear from them from time to time asking us to verify an unusual charge.

Government agencies must apply the same smarts to detecting and mitigating stolen credential threats. For example, if “Sam” attempts to send a classified document to someone on the outside, the unusual behavior should be flagged, and Sam should receive an email or text asking him to verify it’s really him sending it. If Sam does not provide verification within a certain timeframe, his user account would be shut down. If Sam responds, “Yes, I was given permission to send it,” then his behavior should be white-listed so the alert doesn’t pop up again and Sam is not bothered. If Sam responds, “No, I didn’t send anything,” it means a bad actor is most likely walking in Sam’s shoes, and therefore his account should be shut down before the document is released.

Behavior analytics working in concert with data loss prevention, tagging, multi-factor authentication and a light human touch enable this strategy to succeed. Tagging tools allow agency employees to label documents, such as “classified,” so that data loss prevention technologies know to stop classified documents from leaving the network. Behavior analytics detects the unusual behavior and uses machine learning to understand if the behavior is verified and thus must be whitelisted. Multi-factor authentication uses text, email or another form of communication to verify that the user is himself and received permission to send the document. The light human touch is the user responding to the text.

If my credit card is compromised, my company doesn’t blame me for the loss. Nor does the money stolen get charged to my account.  We need to get to that same point in the public and private sector. Employees should expect a text message or email asking them to verify an unusual behavior. At the same time, they should also expect to not be bothered again if they verify the behavior was business justified. If their login credentials are stolen and a criminal is walking in their shoes, compromised employees are not the ones responsible for detecting and mitigating the threat.

It’s up to employers to take cybersecurity by the reins, detect when something looks unusual, verify it’s indeed unusual and stop the perpetrator before it’s too late.