Users Are Part of the System
Ira Winkler, Dr Tracy Celaya Brown · 2020
The security and technology teams must consider the users to be one more part of the system that needs to be facilitated and secured. However, without absolute authority, from a business perspective, we must never consider users to be a resource that can be consistently relied upon. Anticipating how people will behave helps to design better systems to capitalize on predictable behaviors, leading to better security. Even though people make mistakes, good systems should anticipate that and not break when they do. Cloud services and remote workers create additional concerns, where we potentially lose control over our information and users. Although the natural assumption is that user-initiated loss happens through ignorance or carelessness, a great deal of damage is caused by malicious users. When malice is involved, awareness efforts can sometimes even work against an organization.