Chance favors the prepared mind. That’s what famous chemist Louis Pasteur once said, but it’s also an important principle that applies to psychological security. Remember back in middle school when name-calling was a way we expressed our emotions? You’ll likely recall the common response: “It takes one to know one!”

It Takes a Cybercriminal to Know One

This was immature behavior back then, but there’s actually a good bit of wisdom in that logic in terms of managing an information security program: If you want to truly understand your threats and identify the most critical vulnerabilities in your security testing, your team needs to be able to think like the bad guys. This requires employees to take up initiatives such as:

  • Seeking out Secure Sockets Layer (SSL), Transport Layer Security (TLS), Secure Shell (SSH) or other encrypted communications protocol to mask what they’re doing;
  • Using guest wireless and open web proxies belonging to someone else to launch mock attacks;
  • Creating an account on an enterprise web application and logging in to see what can be done and exploited;
  • Carrying out mock email phishing attacks against users, because even well-trained colleagues might fall for a cleverly crafted ploy;
  • Registering internet domains similar to their intended target’s domain to lure in unsuspecting users; and
  • Downloading a mobile app and analyzing it for security flaws to see how they can gain a leg up on their target environment from that angle.

The bad guys know that network visibility is minimal — and often nonexistent — in the average organization. They know that many enterprise systems go untested. They know that if they perform their own testing, odds are good that they won’t be detected. They gravitate toward exploiting user behaviors because they know what users are capable of and have access to. And finally, cybercriminals blend in and remain elusive on the network knowing that time is on their side. In other words, fraudsters have a leg up on security professionals, and they take every opportunity to use it to their advantage.

Promoting Psychological Security

Even information security leaders can benefit from thinking this way. It can be a bit negative in terms of seeing what’s wrong with the organization’s security culture, but that’s better than pretending things are all rosy and risks don’t exist.

Do what it takes to promote this way of thinking throughout your team. Send employees to the RSA Conference, Black Hat and DEF CON. Encourage them to get on the internet and find articles or videos on the subject. There are plenty of books on the cybercriminal mindset worth reading as well.

To run a successful security program, you have to do a handful of seemingly unimportant things exceptionally well, day after day. Instilling and utilizing a malicious mindset is one of those things.

In the words of Thomas J. Watson, former chairman and CEO of IBM, “All the problems of the world could be settled easily, if men were only willing to think.” In terms of finding and minimizing security risks, you can find all the important gaps and weaknesses in your security program if you step back and think about how they can be exploited and exposed by someone with malicious intent. Given the massive scope of the cyberthreat landscape, you need every advantage you can get.

More from CISO

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…

Moving at the Speed of Business — Challenging Our Assumptions About Cybersecurity

The traditional narrative for cybersecurity has been about limited visibility and operational constraints — not business opportunities. These conversations are grounded in various assumptions, such as limited budgets, scarce resources, skills being at a premium, the attack surface growing, and increased complexity. For years, conventional thinking has been that cybersecurity costs a lot, takes a long time, and is more of a cost center than an enabler of growth. In our upcoming paper, Prosper in the Cyber Economy, published by…

Reporting Healthcare Cyber Incidents Under New CIRCIA Rules

Numerous high-profile cybersecurity events in recent years, such as the Colonial Pipeline and SolarWinds attacks, spurred the US government to implement new legislation. In response to the growing threat, President Biden signed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) in March 2022.While the law has passed, many healthcare organizations remain uncertain about how it will directly affect them. If your organization has questions about what steps to take and what the law means for your processes,…

Charles Henderson’s Cybersecurity Awareness Month Content Roundup

In some parts of the world during October, we have Halloween, which conjures the specter of imagined monsters lurking in the dark. Simultaneously, October is Cybersecurity Awareness Month, which evokes the specter of threats lurking behind our screens. Bombarded with horror stories about data breaches, ransomware, and malware, everyone’s suddenly in the latest cybersecurity trends and data, and the intricacies of their organization’s incident response plan. What does all this fear and uncertainty stem from? It’s the unknowns. Who might…