Cybersecurity has dominated the news as of late and is considered a major pain point for both consumers and corporations. Black hat hackers have become the veritable villains of the cyber world, calling into question the integrity of digital infrastructures. Their altruistic counterparts – white hat hackers – are few and far between. This is only compounded by the fact that very few organizations had made solid investments in durable cyber security until after they were hit by cyber threats.

Women in cybersecurity professions are just as, if not more, tricky to find. Consider this: 77 percent of females claim that not a single high school teacher or counselor encouraged them to pursue cybersecurity. Moreover, a mere 33 percent of women understand what a cyber security job would entail, and 52 percent don’t even believe there are courses in cybersecurity for them.

As it stands today, women make up only 10 percent of the cyber security workforce. The reasons listed above are only a few of the roadblocks preventing more women workers in the field of cybersecurity. The workforce needs more women to pursue data protection jobs. In just one year, the world will need nearly 2 million more white hat hackers.

Women could potentially provide a valuable perspective to this profession considering to this point the field has been so male-dominated. The first step towards more female inclusion in cybersecurity will involve the restructuring of perceptions surrounding cybersecurity. These positions aren’t for isolated hackers; they are fit for educated professionals with an interest in policy and process training.

Data security leaders need to start treating professionals in cybersecurity as the valuable and capable employees they are. There need to be major improvements in workplace relations as well as the reinvention of job postings.

For women interested in cybersecurity, Excelsior College has an extensive database of female roles models. Check out the National Cybersecurity Institute’s Initiative for Women in Cybersecurity today for all your training and career guidance needs.

Countering cyber threats in not just a technical challenge, it is also a human challenge. A goal for organizations is to deter insider threat before it even happens, and understanding human behavior is essential for doing that. Organizations have to be able to deter employees from making bad decisions in the first place by first letting them know they are being watched and that they’re likely to be caught. That’s the detection part. And then letting employees know the organization cares if they’re having a rough time and has programs in place to assist them. That’s the mitigation part.
When I was a special agent for several government agencies I learned a lot about understanding human behavior and how I could use that to solve crimes. Now that I work in cybersecurity these same skills come in handy when trying to combat insider threat. If cybersecurity professionals have not been trained in human behavior they can take a few classes on the subject or they can engage behavioral scientist to advise them on defining normal, baseline user behavior, how to identify abnormal changes to that baseline and what those changes might mean.
One of the main things I was taught as an agent was how to look for what were known as fraud indicators, which basically is suspicious behavior. I was trained to recognize deviations from normal behavior, which are called “triggers.” Common triggers for insider threat might include employees’ use of removable media, their use of printers or copiers far from their office, or employees logging onto the computer system during hours when they are not assigned to work.
Cybersecurity engineers rely on triggers such as these when they design automated monitoring systems. Unfortunately, many monitoring systems are designed around single triggers which often leads to false alarms. Automated systems need to be able to base their decisions on multiple triggers, which is easier said than done.
For cybersecurity professionals mitigating insider threats often means fixing the damage done by an insider attack. However, for behavioral scientists, it also means examining the mitigating factors within an organization that can increase or decrease the chance of an insider threat in the first place, or preventing it from happening again.
The known triggers of disgruntlement and ego often play a role in motivating insider attacks. As examples, to mitigate disgruntlement, organizations can provide employees with avenues to vent concerns and frustration. To mitigate ego, organizations can implement employee recognition programs that offer more public praise.

Greed, another trigger that leads employees to such things as selling organizational secrets, can be another motivation for insider attacks. It will be difficult for cyber professionals to deter an employee who conducts and inside attack due to greed, but organizations can certainly address such things as grievances due to perceived inequities in compensation which may have led to the insider threat incident.
Insider threat detection programs need to include consultation with behavioral scientists when it comes to deterring insider threat issues. Technology always in some way involves human beings so you can’t tackle a technological challenge without taking into account human nature. And the experts in human nature are behavioral scientists.
Read about using Behavioral Analytics to help identify warning signs in employee behavior at http://www.nationalcybersecurityinstitute.org/hactivism-terrorism-crime-and-espionage/uncover-insider-threats-through-user-behavior-analytics/
Source: Mitre (2012, October).The Human Factor: Using Behavioral Science to Counter Insider Threats. http://www.mitre.org/publications/project-stories/the-human-factor-using-behavioral-science-to-counter-insider-threats