# What Is End-User Security? User-Driven Cyber Risks and Security Awareness **URL:** https://securesys.com.tr/en/learning/end-user-security/what-is-end-user-security ![What Is End-User Security? User-Driven Cyber Risks and Security Awareness](/images/bilgi-merkezi/covers/cover-sonkullanici-01.webp) An organization's firewall infrastructure may be strong. EDR may be active on all endpoints. SIEM logs may be being collected centrally. MFA may be in use. However, if a user clicks the fake link in a phishing e-mail, enters their password into a fake login screen, runs a malicious file, uploads corporate data to a personal cloud account, or plugs an unauthorized USB device into the computer the technical security controls face an important test. For this reason, in the modern cyber security approach the user is not only the person who uses the systems. At the same time they can be: **a Security Control and a Security Risk** they can be these. This is the area defined as: #### End User Security as it is called. End user security; aims for users to develop secure behaviour, for credentials to be protected, for endpoint devices to be used securely, for phishing and social engineering attacks to be noticed, for corporate data to be processed correctly and for security incidents to be reported quickly it aims for these. In the modern threat environment the attacker does not always need to cross the firewall. Sometimes the shortest path is: **the user.** For this reason the fundamental goal of end user security is this: **To stop the human factor from being the attacker's easiest entry point.** ### What Is End User Security? End User Security is the technical and organizational security approach that provides protection against cyber threats for the employees, managers, consultants, suppliers or other users who use the organization's systems. Its English equivalent: #### End User Security is used as this. ### Who Is an End User? Anyone who uses corporate information systems can be an end user. For example: Employee Manager Contractor Vendor Remote Worker ### What Does End User Security Cover? The principal subjects: Security Awareness Phishing Social Engineering Password Security MFA Email Security Endpoint Security Safe Web Browsing USB Security Remote Work Security Data Protection ### Why Is the User Critical in Cyber Security? Because the user: opens e-mail, clicks links, downloads files, uses passwords, shares data, reaches applications. That is, many of the actions the attacker targets are directly related to user behaviour. ### What Is Human Risk? Human Risk is the cyber security risk created by user behaviour. ### Why Is the Human Factor Important? Because technology cannot always prevent the wrong decision. ### What Is Human Error? It is the security mistake the user makes unintentionally. ### Examples of Human Error Sending an e-mail to the wrong person Sharing a password Uploading the wrong file Clicking a suspicious link ### Are Human Error and Malicious Insider the Same? No. ### What Is an Insider Threat? It is the threat class created by a user or an authorized account inside the organization. ### Is an Insider Threat Always Deliberate? No. It can also be a negligent insider. ### What Is a Negligent Insider? It is the user who creates risk because of carelessness towards the security rules. ### What Is a Malicious Insider? It is the person from inside who knowingly tries to cause harm or misuses data. ### What Are the Biggest Risks in End User Security? Phishing Credential Theft Malware Ransomware Data Leakage Unsafe Browsing ### What Is Phishing? Phishing is the attack that tries to obtain information or an action by deceiving the user. ### Why Is Phishing Effective? Because it targets human psychology instead of a technical weakness. ### How Can a Phishing E-mail Look? For example: Password Expired Invoice Attached Urgent Payment MFA Verification ### What Is Spear Phishing? It is the personalized phishing attack that targets a particular person or organization. ### What Is Whaling? It is the phishing attack that targets high-value targets such as senior executives. ### What Is Smishing? It is the phishing attack carried out over SMS. ### What Is Vishing? It is the social engineering attack carried out over the telephone or voice communication. ### What Is QR Phishing? It is the phishing method that directs the user to a malicious site using a QR code. ### What Is Quishing? It is the term used for QR code based phishing attacks. ### What Is Credential Phishing? It is the phishing attack that aims to steal the user's username and password information. ### What Is a Fake Login Page? It is the malicious web page that imitates the authentication screen of a legitimate service. ### What Is Credential Theft? It is the capture of identity verification information. ### Why Is Credential Theft Critical? Because the attacker can log in like a legitimate user. ### Does MFA Completely Prevent Credential Theft? No. However, it can reduce the risk significantly. ### What Is MFA? MFA: #### Multi-Factor Authentication is the use of more than one authentication factor. ### What Are the Types of Authentication Factor? Something You Know Something You Have Something You Are ### What Is Something You Know? It is a knowledge-based factor such as a password or a PIN. ### What Is Something You Have? It is a possessed factor such as a telephone, a token or a hardware key. ### What Is Something You Are? It is a biometric factor such as a fingerprint or face recognition. ### What Is MFA Push Fatigue? It is the attacker continuously sending MFA notifications to the user to try to obtain approval by mistake. ### What Is MFA Bombing? It is one of the other names of the push fatigue attack. ### What Is Number Matching? It is the security mechanism that asks for the number seen on the screen to be verified during MFA approval. ### What Is Phishing-Resistant MFA? It is the authentication method that is stronger against phishing attacks. ### What Is FIDO2? It is the phishing-resistant authentication approach that uses public key cryptography. ### What Is a Security Key? It is the physical hardware token used for authentication. ### What Is Password Security? They are the controls for passwords being created, stored and used securely. ### What Is a Strong Password? It is a password that is difficult to guess and to break with brute force. ### Why Is Password Length Important? A long password generally increases brute-force resistance. ### Is Password Complexity Enough on Its Own? No. ### What Is Password Reuse? It is the same password being used on more than one system. ### Why Is Password Reuse Risky? If one platform is compromised the same password can be tried on the other systems. ### What Is Credential Stuffing? It is captured username-password combinations being tried on other services. ### What Is a Password Manager? It is the application that stores passwords securely and helps to manage them. ### Is Using a Password Manager Secure? A correctly chosen and securely configured password manager can generally reduce the password reuse risk. ### Should a Shared Password Be Used? As far as possible, no. ### Why Is a Shared Account Risky? Accountability and traceability are reduced. ### What Is Endpoint Security? Endpoint Security is the protection of laptops, desktops and other user devices against malware, exploits and unauthorized access. ### What Is an Endpoint? It is the end user or workload device that connects to the network. ### Examples of Endpoints Laptop Desktop Mobile Device Tablet ### What Is Antivirus? It is the endpoint security technology that tries to detect known malicious files or behaviours. ### What Is EDR? EDR: #### Endpoint Detection and Response is the security technology that monitors endpoint behaviour, detects suspicious activity and provides incident response capability. ### What Is the Difference Between Antivirus and EDR? Antivirus: It is weighted towards known malware detection. EDR: It provides behaviour monitoring and investigation capability. ### Which Behaviours Can EDR Monitor? Process Execution File Activity Registry Changes Network Connections ### What Is Endpoint Hardening? It is a secure configuration being applied that will reduce the endpoint attack surface. ### What Does Endpoint Hardening Contain? Patch Management Local Firewall Application Control Disk Encryption Least Privilege ### What Is Patch Management? It is operating system and application security updates being applied regularly. ### Why Is a Patch Important? It closes known vulnerabilities. ### What Is Zero-Day? It is a vulnerability for which there is not yet a vendor patch or which has been newly discovered. ### Does a Patch Prevent All Attacks? No. However, it reduces known vulnerability exposure. ### What Is a Local Administrator? It is the local account with high privileges on the endpoint. ### Should the User Be a Local Admin? For general users it must be limited as far as possible. ### What Does Least Privilege Mean on the Endpoint? It is the user being given only the necessary minimum privilege. ### What Is Application Control? It is the security mechanism that limits which applications or executables can run. ### What Is Allowlisting? It is only approved applications being permitted to run. ### What Is Blocklisting? It is known unwanted or malicious applications being blocked. ### What Is Disk Encryption? It is the content of the device storage being protected with encryption. ### Why Is Disk Encryption Important? If the device is lost it reduces the data exposure risk. ### Why Is Screen Lock Important? It makes it harder for people with physical access to reach an open session. ### What Is Auto-Lock? It is the device locking automatically after a certain period of inactivity. ### What Is Email Security? It is the prevention of the threats coming over corporate e-mail and the making of user behaviour secure. ### Why Is E-mail One of the Most Critical Attack Vectors? Because the attacker can communicate directly with the user. ### What Is a Malicious Attachment? It is the harmful e-mail attachment that contains malware or an exploit. ### What Is a Malicious Link? It is the link that directs the user to a phishing or malware site. ### What Is Display Name Spoofing? It is the attacker making the sender's visible name look like a legitimate person. ### What Is Email Spoofing? It is the imitation of the e-mail sender identity. ### What Is SPF? Sender Policy Framework defines which mail servers can send e-mail on behalf of the domain. ### What Is DKIM? DomainKeys Identified Mail adds a cryptographic signature to outgoing e-mails. ### What Is DMARC? It is the e-mail authentication standard that combines the SPF and DKIM results with domain policy. ### Do SPF, DKIM and DMARC Completely Prevent Phishing? No. A lookalike domain or a compromised legitimate account can still be used. ### What Is a Lookalike Domain? It is a fake domain that closely resembles the real domain. ### What Is Typosquatting? It is the method of deceiving the user by imitating domain spelling mistakes. ### What Is BEC? BEC: #### Business Email Compromise is the fraud attack in which the business process and e-mail identity are abused. ### What Is CEO Fraud? It is the attacker asking for a payment or information by behaving like a company executive. ### What Is Invoice Fraud? It is a payment being redirected through a fake or altered invoice. ### What Is Vendor Email Compromise? It is the existing business relationship being abused through the supplier's e-mail account being compromised. ### Why Is a Payment Change Request Risky? The bank account change may have been manipulated by the attacker. ### What Is Out-of-Band Verification? It is the request being verified through an independent communication channel outside e-mail. ### An Example Bank Account Change Mail ↓ Known Contact Verification by Telephone ↓ Payment Approval ### What Is Safe Web Use? It is internet sites being used consciously against malware, phishing and data theft risks. ### What Is Safe Browsing? It is the trusted site, secure browser and controlled download approach. ### What Is a Drive-by Download? It is malicious content being downloaded or executed through the browser without the user being aware. ### What Is Malvertising? It is malicious sites or malware being distributed through online advertisements. ### What Is a Fake Update? It is malware being downloaded with a fake browser or software update message. ### What Is Browser Notification Abuse? It is fake alerts or scam messages being sent through the user accepting the notification permissions of a malicious site. ### Can a Browser Extension Be Risky? Yes. An over-permissioned or malicious extension can provide data access. ### What Is a Browser Extension Policy? It is the corporate policy that controls which extensions can be installed. ### What Is Download Security? It is the files downloaded from the internet being checked securely. ### Should the User Open Every File? No. The source and the expected content must be verified. ### What Is a Macro? It is the code mechanism that provides automation inside an Office document. ### Why Is Macro Security Important? Malicious documents can use macros or embedded content. ### What Is Protected View? It is the security feature that helps Office applications open untrusted files in a restricted mode. ### What Is USB Security? It is the management of the malware and data leakage risks arising from USB and removable media devices. ### What Is Removable Media? They are portable storage devices such as USB flash drives and external disks. ### What Is the USB Malware Risk? A harmful file or executable can be carried to the endpoint over removable media. ### Should an Unknown USB Be Used? No. ### What Is USB Device Control? It is the security mechanism that determines which removable devices can be used on the endpoint. ### What Is a Read-Only USB Policy? It is the policy model that permits data to be read over USB but blocks writing. ### What Is DLP? DLP: #### Data Loss Prevention is the security technology that aims to prevent sensitive data from going outside in an unauthorized way. ### Why Is DLP Important in End User Security? The user can take sensitive data outside by mistake or knowingly. ### What Is Data Leakage? It is corporate data being exposed to unauthorized people or systems. ### What Is Data Exfiltration? It is data being taken outside the organization consciously or maliciously. ### Are Data Leakage and Data Exfiltration the Same? No. Leakage can be accidental. Exfiltration is mostly intentional malicious activity. ### What Is Shadow IT? It is the use of applications or services not approved by IT. ### Why Is Shadow IT Risky? Data visibility and control are reduced. ### Why Is Personal Cloud Storage Risky? Corporate data can be uploaded to a cloud account that is not approved. ### What Is File Sharing Security? It is the recipient, permission and data sensitivity being managed correctly in file sharing. ### What Is a Public Link? It is the sharing link that can be reached without authentication. ### Is Using a Public Link Risky? For sensitive data, yes. ### What Is Least Privilege File Sharing? It is the file being shared only with the necessary people. ### What Is Data Classification? It is data being classified according to its level of importance and sensitivity. ### Examples of Data Classification Public Internal Confidential Restricted ### Does the User Have to Know the Data Classification? Yes. Because it affects the correct handling decision. ### What Is Secure Data Handling? It is data being used, shared and stored in a way suitable for its classification level. ### What Is a Clean Desk Policy? It is the physical security policy that aims for sensitive documents and devices not to be left out in the open. ### What Is a Clear Screen Policy? It is the screen being locked when the user leaves the workstation. ### What Is Remote Work Security? It is secure access and device use being provided for users working from outside the organization. ### Why Does Working From Home Create Extra Risk? Home Wi-Fi, a shared device, the physical environment, remote access factors such as these come into play. ### What Is Home Wi-Fi Security? It is the home wireless network being protected with secure authentication and configuration. ### Should the Default Router Password Be Changed? Yes. ### Is Public Wi-Fi Risky? Yes. It is an untrusted network. ### Can Corporate Systems Be Used Over Public Wi-Fi? Secure remote access controls must be applied. ### What Is a VPN? VPN: #### Virtual Private Network provides an encrypted tunnel between the remote endpoint and the corporate network. ### Does a VPN Provide Secure Access on Its Own? No. MFA, device security and least privilege are needed. ### What Is ZTNA? ZTNA: #### Zero Trust Network Access focuses on providing the user with authorized application/resource access instead of the entire network. ### What Is BYOD? BYOD: #### Bring Your Own Device is the user using their personal device for work. ### What Are the Risks of BYOD? Unmanaged Device Data Mixing Malware Privacy ### What Is MDM? MDM: #### Mobile Device Management is mobile devices being managed centrally. ### What Is MAM? MAM: #### Mobile Application Management is corporate applications and data being managed. ### What Is Mobile Security? It is smartphones and tablets being protected with security policy. ### Should Mobile Device Encryption Be Used? Yes. ### What Is Jailbreak or Root? It is operating system security restrictions being removed. ### Is a Rooted Device Risky? Yes. Security controls can be bypassed. ### What Is Shoulder Surfing? It is the user's screen or keyboard information being watched physically. ### What Is Tailgating? It is an unauthorized person entering a secure area behind an authorized person. ### Is Physical Security Part of End User Security? Yes. ### What Is Social Engineering? It is the attack method aimed at obtaining information, access or an action by manipulating human psychology. ### Which Psychological Elements Does Social Engineering Use? Urgency Authority Fear Curiosity Trust ### What Is Urgency? It is the user being given the feeling that they need to make a quick decision. ### What Is Authority Abuse? It is an authority identity such as the CEO, IT, a bank or an official institution being imitated. ### What Is Fear-Based Social Engineering? They are messages that create fear such as the account will be closed, a penalty will come or access will be cut. ### What Is a Curiosity-Based Attack? It is the user being made to interact with a file or message that arouses curiosity. ### What Is Pretexting? It is the attacker gaining trust by creating a convincing story or role. ### What Is Baiting? It is the user being made to perform a malicious action by being offered something attractive. ### What Is USB Baiting? It is curiosity being exploited through a deliberately left USB device. ### What Is Security Awareness? It is users recognizing cyber risks and developing correct security behaviour. ### What Is Security Awareness Training? It is the training program that aims to give users secure behaviour. ### Is Training Once a Year Enough? It is generally not enough. ### What Is Continuous Awareness? It is security awareness being sustained with regular reinforcement throughout the year. ### What Is Microlearning? It is the training approach with short and frequent security awareness content. ### What Is Phishing Simulation? It is a controlled fake phishing campaign being applied to measure the phishing awareness level of users. ### Is the Aim of Phishing Simulation to Catch the User? No. The aim is to measure and improve risky behaviour. ### What Is Click Rate? It is the proportion of users who click the link in the simulation e-mail. ### What Is Credential Submission Rate? It is the proportion of users who enter credentials into the fake login form during the simulation. ### What Is Reporting Rate? It is the proportion of users who report the phishing message to the security team. ### Why Is Reporting Rate Very Important? It turns the user not only into someone who does not make a mistake but into: **a sensor that reports the threat** it turns them into this. ### What Is a Human Firewall? It is a widespread term that expresses a security-aware user community. ### Can the User Be a Security Sensor? Yes. The first person to see a suspicious event can be the user. ### What Is Suspicious Email Reporting? It is the user reporting a suspicious e-mail quickly to the SOC/security team. ### What Is a Phishing Report Button? It is the suspicious e-mail reporting button integrated into the mail client. ### Should the Reporting Process Be Easy? Definitely. ### What Is the Fundamental Goal of a Security Awareness Program? Not to create fear but: **to turn correct behaviour into a habit.** ### What Is Cyber Hygiene? It is the body of daily secure digital behaviour habits. ### Examples of Cyber Hygiene Using MFA Applying Patches Not Opening Suspicious Links Using Screen Lock ### Should the User Know the Security Policies? Yes. However, the policy must be understandable. ### Why Is a Very Long Security Policy a Problem? The user may not read it or may not remember it. ### What Is an Acceptable Use Policy? It is the policy that determines for which purposes and how corporate IT resources will be used. ### What Is AUP? It is the abbreviation of Acceptable Use Policy. ### Which Policies Should Be Explained to the User? Password Email Internet Remote Work Data Handling ### What Is Incident Reporting? It is the user reporting a suspicious or real security incident to the relevant team. ### Which Situations Should the User Report? A suspicious e-mail An incorrect file share Device loss A suspicious MFA request ### Is a Lost Device an Incident? Yes. Particularly if it contains corporate data. ### How Is a Compromised Password Understood? An unusual login, an unexpected MFA, a password reset there can be signs such as these. ### What Should the User Do If They Think Their Password Has Been Stolen? They must report it quickly to the security/IT team and follow the organization's procedure. ### Should the User Clean Up the Incident on Their Own? Generally, no. Evidence can be lost. ### What Is Security Culture? It is secure behaviour becoming a shared working culture inside the organization. ### How Is a Security Culture Formed? Leadership Training Communication Measurement ### Why Is Management Support Important? It directly affects user behaviour. ### What Happens If a Manager Does Not Follow the Security Policy? Users may not take the policy seriously. ### Should Security Awareness Be Punishment Focused? An approach based only on punishment can reduce reporting. ### What Is a Positive Security Culture? It is the security culture in which users are not afraid to report an incident. ### What Is a Security Champion? It is the volunteer or appointed person who supports security awareness inside a department. ### What Is Role-Based Security Awareness? It is the training being customized according to the user's role. ### Which Training Is More Critical for a Finance User? BEC Invoice Fraud Payment Change ### Which Training Is More Critical for an IT Admin? Privileged Access Credential Security Remote Administration ### Which Training Is More Critical for an Executive? Whaling BEC Sensitive Data Exposure ### Which Training Is More Critical for a Developer? Secrets Phishing Secure Development ### What Is Risk-Based Awareness? It is the training frequency and content being determined according to the user risk level. ### What Is a High-Risk User? It is the user who carries a higher cyber risk because of their role or behaviour. ### Who Can Be a High-Risk User? Finance Executive IT Administrator HR ### What Is a User Risk Score? It is the relative cyber risk value calculated according to the user's behaviour and role information. ### What Can a User Risk Score Contain? Phishing Result Privilege Level Incident History Device Risk ### What Is User Behavior Analytics? It is user behaviours being analyzed in terms of anomalies. ### What Is UEBA? UEBA: #### User and Entity Behavior Analytics is the security approach that analyzes user and device behaviour patterns. ### Does UEBA Declare the User Guilty? No. A behaviour anomaly is only an investigation signal. ### Is Privacy Important in End User Monitoring? Yes. Monitoring must be designed in accordance with legal and organizational requirements. ### What Is the Relationship Between End User Security and Zero Trust? Zero Trust is based on identity, device and continuous verification. For this reason user security is an important part of it. ### Does Zero Trust Not Trust the User? It is not a distrust directed at the person. It is the access decision being made with verification instead of automatic trust. ### What Is Identity Security? It is the protection of user accounts and authentication processes. ### What Is an Identity Attack? It is the attack that targets the compromise of the user identity. ### What Is Account Takeover? It is the attacker taking over the control of the user account. ### What Is ATO? It is the abbreviation of Account Takeover. ### What Is Session Hijacking? It is an authenticated user session being taken over by the attacker. ### What Is a Session Cookie? It is the browser cookie that can carry the authenticated session information. ### Does MFA Always Prevent Session Theft? No. If the session token is captured the session after MFA can be abused. ### What Is Token Theft? It is the capture of an authentication/session token. ### What Is an Infostealer? It is the malware class focused on stealing browser credentials, cookies and other sensitive data. ### Can Endpoint Security Reduce This Risk? EDR, browser hardening and application controls can help. ### **Why Are Safe Browsing + Endpoint Security + MFA Needed Together?** Because the attack chain can use different layers. ### Defense in Depth in End User Security Security Awareness ↓ Email Security ↓ MFA ↓ Endpoint Security ↓ Web Security ↓ DLP ↓ SOC Monitoring ### What Should Happen If the User Makes a Mistake? The other security layers must limit the attack. ### Should Human Error Not Be a Single Failure Point? Yes. This is one of the important principles of modern security architecture. ### What Is Secure-by-Default? It is the system working with as secure a configuration as possible even if the user takes no extra action. ### What Is Secure-by-Design? It is security being considered from the beginning of the system design. ### Why Is User-Friendly Security Important? Very difficult security controls can push the user to produce a workaround. ### What Is Security Friction? It is the extra difficulty that occurs in the user experience because of a security control. ### Why Is the Balance Between Security and Usability Important? If a control is not practicable it can be bypassed by the user. ### What Is a Shadow Workaround? It is the user developing an unauthorized alternative method because the official process is too difficult. ### Is End User Security Technical or Human Focused? Both. ### **The People + Process + Technology Model** People: Awareness Process: Policy Technology: EDR/MFA/DLP ### What Is an End User Security Assessment? It is the evaluation of the user security risks and the existing controls. ### What Does the Assessment Examine? Phishing Risk Password Security Endpoint Security Data Handling ### What Is a Security Awareness Assessment? It is the measurement of the current cyber awareness level of the users. ### Can Phishing Simulation Be Used for Assessment? Yes. ### What Is an Endpoint Compliance Assessment? It is the evaluation of the endpoints' conformity to the security policy. ### What Is a User Access Review? It is the regular review of the access rights users have. ### What Is Access Recertification? It is the manager/system owner verifying that the user access is still necessary. ### What Is Joiner-Mover-Leaver? It is the employee lifecycle access management model. ### What Is a Joiner? A new employee. ### What Is a Mover? An employee who changes role or department. ### What Is a Leaver? An employee who leaves the organization. ### Should a Leaver Account Be Closed Quickly? Yes. ### What Is a Dormant Account? It is an account that has not been used for a long time. ### Is a Dormant Account Risky? Yes. It can be used by an attacker without being noticed. ### What Is an Orphan Account? It is an account that no longer has an active owner. ### What Is Privileged User Security? It is administrators or highly privileged users being protected with stricter security controls. ### Is MFA Enough for a Privileged Account? Not on its own. PAM, logging and least privilege are needed too. ### What Is a Separate Admin Account? It is a privileged account separate from the daily user account being used. ### Should E-mail Be Used With an Admin Account? As far as possible, no. The attack surface is reduced. ### What Is PAW? PAW: #### Privileged Access Workstation is the hardened workstation used for privileged administration. ### What Is the Role of the SOC in End User Security? It is to monitor user-generated security events and to analyze incidents. ### Which User Security Events Does the SOC Monitor? Phishing Reports MFA Anomalies Malware Alerts Data Leakage ### Is the SIEM Used in End User Security? Yes. ### Which Logs Can the SIEM Combine? Identity Email Endpoint VPN DLP ### What Is User-Centric Correlation? It is different security events being combined around the same user identity. ### An Example Suspicious Email MFA Alert New Device Login ↓ High-Risk Incident ### Is SOAR Used in End User Incidents? Yes. ### An Automated Response Example Credential Compromise Detected ↓ Disable Session ↓ Reset Password ↓ Isolate Endpoint ↓ Open Incident ### Why Is Human-in-the-Loop Important? An incorrect automated action can create a business impact. ### What Is a Security Awareness KPI? It is the metric that measures the effectiveness of the awareness program. ### Important Security Awareness KPIs Phishing Click Rate Reporting Rate Training Completion Rate Repeat Failure Rate ### Is Phishing Click Rate Enough on Its Own? No. ### Why? Reporting behaviour must be measured as well. ### Why Is Security Reporting Rate a More Positive Metric? It shows the users' ability to recognize and report the threat. ### What Is a Repeat Clicker? It is the user who continuously shows risky behaviour in more than one simulation. ### Should a Repeat Clicker Be Punished? Risk-based coaching and targeted training can generally be a more useful approach. ### What Is Training Completion Rate? It is the proportion of users who complete the mandatory training. ### Does Completion Rate Prove Security Awareness? No. Behaviour measurement is also needed. ### What Is Behavior Change? It is the user's security behaviour changing in a positive direction after the training. ### What Is the Real Measure of Success of Security Awareness? Not knowledge but: **behaviour change.** ### Examples of End User Security KPIs Phishing Reporting Rate MFA Adoption Endpoint Compliance Incident Reporting Time ### Examples of End User Security KRIs Legacy Authentication High-Risk Users Unmanaged Devices Repeat Phishing Failures ### What Is Mean Time to Report? It is the average time between the user noticing suspicious activity and reporting it to the security team. ### Why Is Mean Time to Report Important? Early notification speeds up incident response. ### The Most Frequently Made Mistakes in End User Security The mistakes frequently encountered in organizations: - Giving awareness training once a year - Making the user responsible for all of security - Not using MFA - Using shared passwords - Not controlling password reuse - Giving local admin rights to everyone - Delaying endpoint patches - Not using EDR - Leaving the e-mail security controls weak - Not performing phishing simulation - Making it difficult for the user to report phishing - Not controlling USB use - Not controlling personal cloud use - Giving remote access full network access - Not creating a BYOD policy - Not creating an incident reporting culture - Making security awareness punishment focused - Not giving role-based training - Not measuring user risk - Not tracking the awareness KPIs ### End User Security Checklist - Is there a security awareness program? - Is phishing simulation being carried out? - Is a phishing report button available? - Is MFA mandatory? - Is password reuse being controlled? - Is a password manager being used? - Is EDR active on the endpoints? - Are the endpoint patches up to date? - Are local admin rights limited? - Is disk encryption active? - Is screen auto-lock active? - Is there an e-mail security gateway? - Have SPF/DKIM/DMARC been configured? - Is there malicious link protection? - Is USB device control being applied? - Is DLP being used? - Is there data classification? - Is personal cloud use under control? - Is remote access protected with MFA? - Is a BYOD policy available? - Is mobile device management being used? - Is there a lost device procedure? - Is a user access review being carried out? - Are leaver accounts closed quickly? - Is there special training for high-risk users? - Are the security awareness KPIs being measured? ### End User Security Maturity Model #### Level 1 - Basic Awareness Annual security awareness training is given. The technical controls are limited. #### Level 2 - Controlled User Security MFA, endpoint protection and e-mail security controls are applied. #### Level 3 - Measurable Human Risk Phishing simulation, user risk scoring and role-based training are applied. #### Level 4 - Integrated User Security Identity, EDR, e-mail, DLP, SIEM and SOC data are analyzed together. #### Level 5 - Adaptive Human Risk Management Security controls are applied dynamically according to user behaviour, device risk and identity context. ### Frequently Asked Questions #### What is end user security? End user security is the technical and awareness focused security approach that provides protection for the people who use the organization's systems against phishing, malware, credential theft, data leakage and other cyber risks. #### What is End User Security? End User Security is the user account, endpoint device, e-mail, internet use and data access being protected together. #### What is Security Awareness? It is users recognizing cyber threats and developing correct security behaviours. #### What is Human Risk? It is the cyber security risk that arises because of user behaviour or human error. #### What is phishing? It is the attack that aims to obtain credentials, data or a financial transaction by deceiving the user. #### What is social engineering? It is the attack method aimed at obtaining information or access by manipulating human psychology. #### Why is MFA important? Even if the password is compromised it makes it harder for the attacker to obtain account access. #### What is Endpoint Security? It is laptops, desktops and mobile devices being protected against malware, exploits and unauthorized activity. #### What is EDR? Endpoint Detection and Response is the security technology that monitors endpoint behaviour and provides investigation and response capability by detecting suspicious activities. #### Is a Password Manager secure? A trusted and correctly configured password manager can help to reduce the password reuse risk. #### How should a user recognize a phishing e-mail? Signs such as urgency, an unexpected attachment, an unusual sender, a credential request and a suspicious link must be checked. #### What is Phishing Simulation? It is controlled phishing tests being applied in order to measure the user awareness level. #### Is Security Awareness once a year enough? Generally no. Continuous awareness and behaviour reinforcement are stronger. #### Which is the most important control in end user security? There is no single control. Awareness, MFA, endpoint security, e-mail security, DLP and monitoring must be applied together. ### Conclusion: End User Security Is Not Blaming the User but Making Secure Behaviour Easier One of the most important mistakes made when end user security is discussed is: **"The user is the weakest link."** adopting this approach on its own. The user can make a mistake. But a modern security architecture must not be designed as if the user will never make a mistake. Because in the real world people: hurry, click on the wrong person, can think a message is real, can share the wrong file. For this reason the task of security is not only: **"User, be careful."** to say this. The security architecture must make it difficult for the attack to progress even when the user makes the wrong decision. For example, for a user who clicks a phishing link: The Secure Web Gateway can block the malicious site. Browser security can limit the download. MFA can make account takeover harder. EDR can detect the malicious process. NDR can see the C2 communication. The SIEM can correlate the events. The SOC can respond to the incident. That is, successful end user security is: **Awareness + Technical Controls + Detection + Response** the combination of these. Secure user behaviour is also not formed with a single training session. It continuously requires: training, phishing simulation, feedback, measurement, role-based awareness it requires these. For this reason the fundamental goal of the Human Risk Management approach is: **not to reduce user error to zero but to reduce the probability and the impact of that error turning into an attack.** The modern End User Security model can be thought of in this way: #### Educate ↓ #### Authenticate ↓ #### Protect ↓ #### Monitor ↓ #### Detect ↓ #### Respond The user; is not only the person who needs to be protected. At the same time they can be the first person to notice the attack. For this reason in a strong security culture the user: #### Potential Risk stops being this and #### Active Security Sensor becomes this. The fundamental equation of modern end user security: **Security Awareness + Identity Security + Endpoint Security + Data Protection + Continuous Monitoring** is in this form. And the fundamental principle is this: **Do not expect flawless behaviour from the user; design the security architecture to be resistant to human error.**