Chance favors the prepared mind. That’s what famous chemist Louis Pasteur once said, but it’s also an important principle that applies to psychological security. Remember back in middle school when name-calling was a way we expressed our emotions? You’ll likely recall the common response: “It takes one to know one!”

It Takes a Cybercriminal to Know One

This was immature behavior back then, but there’s actually a good bit of wisdom in that logic in terms of managing an information security program: If you want to truly understand your threats and identify the most critical vulnerabilities in your security testing, your team needs to be able to think like the bad guys. This requires employees to take up initiatives such as:

  • Seeking out Secure Sockets Layer (SSL), Transport Layer Security (TLS), Secure Shell (SSH) or other encrypted communications protocol to mask what they’re doing;
  • Using guest wireless and open web proxies belonging to someone else to launch mock attacks;
  • Creating an account on an enterprise web application and logging in to see what can be done and exploited;
  • Carrying out mock email phishing attacks against users, because even well-trained colleagues might fall for a cleverly crafted ploy;
  • Registering internet domains similar to their intended target’s domain to lure in unsuspecting users; and
  • Downloading a mobile app and analyzing it for security flaws to see how they can gain a leg up on their target environment from that angle.

The bad guys know that network visibility is minimal — and often nonexistent — in the average organization. They know that many enterprise systems go untested. They know that if they perform their own testing, odds are good that they won’t be detected. They gravitate toward exploiting user behaviors because they know what users are capable of and have access to. And finally, cybercriminals blend in and remain elusive on the network knowing that time is on their side. In other words, fraudsters have a leg up on security professionals, and they take every opportunity to use it to their advantage.

Promoting Psychological Security

Even information security leaders can benefit from thinking this way. It can be a bit negative in terms of seeing what’s wrong with the organization’s security culture, but that’s better than pretending things are all rosy and risks don’t exist.

Do what it takes to promote this way of thinking throughout your team. Send employees to the RSA Conference, Black Hat and DEF CON. Encourage them to get on the internet and find articles or videos on the subject. There are plenty of books on the cybercriminal mindset worth reading as well.

To run a successful security program, you have to do a handful of seemingly unimportant things exceptionally well, day after day. Instilling and utilizing a malicious mindset is one of those things.

In the words of Thomas J. Watson, former chairman and CEO of IBM, “All the problems of the world could be settled easily, if men were only willing to think.” In terms of finding and minimizing security risks, you can find all the important gaps and weaknesses in your security program if you step back and think about how they can be exploited and exposed by someone with malicious intent. Given the massive scope of the cyberthreat landscape, you need every advantage you can get.

More from CISO

How to Solve the People Problem in Cybersecurity

You may think this article is going to discuss how users are one of the biggest challenges to cybersecurity. After all, employees are known to click on unverified links, download malicious files and neglect to change their passwords. And then there are those who use their personal devices for business purposes and put the network at risk. Yes, all those people can cause issues for cybersecurity. But the people who are usually blamed for cybersecurity issues wouldn’t have such an…

The Cyber Battle: Why We Need More Women to Win it

It is a well-known fact that the cybersecurity industry lacks people and is in need of more skilled cyber professionals every day. In 2022, the industry was short of more than 3 million people. This is in the context of workforce growth by almost half a million in 2021 year over year per recent research. Stemming from the lack of professionals, diversity — or as the UN says, “leaving nobody behind” — becomes difficult to realize. In 2021, women made…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Detecting the Undetected: The Risk to Your Info

IBM’s Advanced Threat Detection and Response Team (ATDR) has seen an increase in the malware family known as information stealers in the wild over the past year. Info stealers are malware with the capability of scanning for and exfiltrating data and credentials from your device. When executed, they begin scanning for and copying various directories that usually contain some sort of sensitive information or credentials including web and login data from Chrome, Firefox, and Microsoft Edge. In other instances, they…