I was a spectator to a conversation between a law enforcement DFIRer and corporate computer user this week, and it got interesting when the name-calling started.
The point of the conversation was about corporate computer users being ‘lazy’ with computer systems (whether it be managing the organizations website content or just basic cyber health such as not falling for phishing emails). Then a point about law enforcement never calling victims back started another tangent of complaints. And then a few other little complaints. I felt like I was watching a tennis match being played on two separate courts.
The takeaway I got was that there is still a chasm of disconnect between the users and the examiners/investigators/responders. For the DFIRrs, we practice good Cyber Health. We would not think of leaving any building with any device that was not encrypted. Phishing emails? We love them because we want to learn from them, not fall for them. We care for our passwords as much as we care for our teeth by brushing and our hands by washing. It is our way of life and we assume everyone is like us. When we hear that a non-encrypted laptop containing tons of PII was stolen from the trunk of a car, we shake our heads at how that is even possible.
For the average home and corporate computer user….Cyber Health is inconvenient, unimportant, too much work, and not in their job description. There is no way they will want to learn anything about lateral movement or tracing IP addresses.
That is the chasm that needs a bridge. Until every computer user (home or corporate) is literate in the dangers of bad cyber health, we will always be inundated with work. If you don’t brush your teeth, eventually there will be lots of pain and maybe loss of a tooth. This is no different when your life is derailed from ID theft, ransomware, or the loss of business revenue due to compromised systems. User must learn more about the systems they use, just like they must know something about taking care of their physical health.
The chasm also includes law enforcement’s lack of understanding (or caring about) the frustrations of victims who (1) don’t know the extent of damage a computer compromise can be, and (2) what the response actually does. Most victims don’t know that their case may never be investigated. From the day it was reported by the victim, the case might be put into a file cabinet and marked ‘information only’ because it has no solvability factors. The case may not ever have an investigator assigned to it, simply because of a heavy caseload or have a suspect that cannot be identified. Other cases may take years before anything happens, due to delays in getting information back from service providers or worse, delays in someone actually working the case at all due to reasons I care not to say publicly.
Prevention is key, and so is education. As a personal example, there is a local government organization in my area that has been hit with some pretty good phishing emails lately. The response from IT has been to send generic emails to everyone in the organization about not clicking ‘suspicious’ emails. So far, every time a user falls for one of the phishing emails, IT sends out another reminder to not click any suspicious email links, and then another user falls for another phishing email, and then cycle repeats. There has been no education for the computer users, other than email from IT asking users to “stop falling for suspicious emails.” I’m waiting for the entire system to go down before they have to call someone…
We have always worked to be the translator of tech talk for the layman, but we still fail at it. Blaming the user isn’t going to help. Name calling makes it worse. But being patient and understanding the user’s perspective will help.
When we expect users to do what we would do, without telling them what we would do or how to do it, we frustrate them and us, because we will always get the same thing happening over and over. Most of use are Type A, driven, and have high personal expectations. We have to tone that down to help the organizations that ask us to help them. This includes those working in LE.
The amazing thing that users don't know is that a simple and innocent (ignorant) click of a single phishing email can cause a cascading amount of highly complex, extremely expensive, and mind-numbing work by a team of highly trained DFIRrs to fix over a period of days, weeks, or months. Users don’t get that because no one tells them. They just want their computer to work so they can email clients. Maybe Cyber Hygiene should be taught in schools in the same class where Personal Hygiene is taught?