Psychological Security: Helping Your Team Think Like Cybercriminals

Chance favors the prepared mind. That’s what famous chemist Louis Pasteur once said, but it’s also an important principle that applies to psychological security. Remember back in middle school when name-calling was a way we expressed our emotions? You’ll likely recall the common response: “It takes one to know one!”

It Takes a Cybercriminal to Know One

This was immature behavior back then, but there’s actually a good bit of wisdom in that logic in terms of managing an information security program: If you want to truly understand your threats and identify the most critical vulnerabilities in your security testing, your team needs to be able to think like the bad guys. This requires employees to take up initiatives such as:

  • Seeking out Secure Sockets Layer (SSL), Transport Layer Security (TLS), Secure Shell (SSH) or other encrypted communications protocol to mask what they’re doing;
  • Using guest wireless and open web proxies belonging to someone else to launch mock attacks;
  • Creating an account on an enterprise web application and logging in to see what can be done and exploited;
  • Carrying out mock email phishing attacks against users, because even well-trained colleagues might fall for a cleverly crafted ploy;
  • Registering internet domains similar to their intended target’s domain to lure in unsuspecting users; and
  • Downloading a mobile app and analyzing it for security flaws to see how they can gain a leg up on their target environment from that angle.

The bad guys know that network visibility is minimal — and often nonexistent — in the average organization. They know that many enterprise systems go untested. They know that if they perform their own testing, odds are good that they won’t be detected. They gravitate toward exploiting user behaviors because they know what users are capable of and have access to. And finally, cybercriminals blend in and remain elusive on the network knowing that time is on their side. In other words, fraudsters have a leg up on security professionals, and they take every opportunity to use it to their advantage.

Promoting Psychological Security

Even information security leaders can benefit from thinking this way. It can be a bit negative in terms of seeing what’s wrong with the organization’s security culture, but that’s better than pretending things are all rosy and risks don’t exist.

Do what it takes to promote this way of thinking throughout your team. Send employees to the RSA Conference, Black Hat and DEF CON. Encourage them to get on the internet and find articles or videos on the subject. There are plenty of books on the cybercriminal mindset worth reading as well.

To run a successful security program, you have to do a handful of seemingly unimportant things exceptionally well, day after day. Instilling and utilizing a malicious mindset is one of those things.

In the words of Thomas J. Watson, former chairman and CEO of IBM, “All the problems of the world could be settled easily, if men were only willing to think.” In terms of finding and minimizing security risks, you can find all the important gaps and weaknesses in your security program if you step back and think about how they can be exploited and exposed by someone with malicious intent. Given the massive scope of the cyberthreat landscape, you need every advantage you can get.

Share this Article:
Kevin Beaver

Independent Information Security Consultant

Kevin Beaver is an information security consultant, writer, and professional speaker with Atlanta-based Principle Logic, LLC. With over 29 years of experience in IT and 23 years specializing in security, Kevin performs independent security assessments and consulting to help businesses uncheck the boxes that keep creating a false sense of security. He has authored/co-authored 12 books on information security, including the best-selling "Hacking For Dummies" and "The Practical Guide to HIPAA Privacy and Security Compliance." In addition, Kevin is the creator of the Security On Wheels information security audiobooks and blog providing security learning for IT professionals on the go. You can learn more and link to Kevin's articles, blog posts, videos and more at his website,