Chance favors the prepared mind. That’s what famous chemist Louis Pasteur once said, but it’s also an important principle that applies to psychological security. Remember back in middle school when name-calling was a way we expressed our emotions? You’ll likely recall the common response: “It takes one to know one!”

It Takes a Cybercriminal to Know One

This was immature behavior back then, but there’s actually a good bit of wisdom in that logic in terms of managing an information security program: If you want to truly understand your threats and identify the most critical vulnerabilities in your security testing, your team needs to be able to think like the bad guys. This requires employees to take up initiatives such as:

• Seeking out Secure Sockets Layer (SSL), Transport Layer Security (TLS), Secure Shell (SSH) or other encrypted communications protocol to mask what they’re doing;
• Using guest wireless and open web proxies belonging to someone else to launch mock attacks;
• Creating an account on an enterprise web application and logging in to see what can be done and exploited;
• Carrying out mock email phishing attacks against users, because even well-trained colleagues might fall for a cleverly crafted ploy;
• Registering internet domains similar to their intended target’s domain to lure in unsuspecting users; and
• Downloading a mobile app and analyzing it for security flaws to see how they can gain a leg up on their target environment from that angle.

The bad guys know that network visibility is minimal — and often nonexistent — in the average organization. They know that many enterprise systems go untested. They know that if they perform their own testing, odds are good that they won’t be detected. They gravitate toward exploiting user behaviors because they know what users are capable of and have access to. And finally, cybercriminals blend in and remain elusive on the network knowing that time is on their side. In other words, fraudsters have a leg up on security professionals, and they take every opportunity to use it to their advantage.

Promoting Psychological Security

Even information security leaders can benefit from thinking this way. It can be a bit negative in terms of seeing what’s wrong with the organization’s security culture, but that’s better than pretending things are all rosy and risks don’t exist.

Do what it takes to promote this way of thinking throughout your team. Send employees to the RSA Conference, Black Hat and DEF CON. Encourage them to get on the internet and find articles or videos on the subject. There are plenty of books on the cybercriminal mindset worth reading as well.

To run a successful security program, you have to do a handful of seemingly unimportant things exceptionally well, day after day. Instilling and utilizing a malicious mindset is one of those things.

In the words of Thomas J. Watson, former chairman and CEO of IBM, “All the problems of the world could be settled easily, if men were only willing to think.” In terms of finding and minimizing security risks, you can find all the important gaps and weaknesses in your security program if you step back and think about how they can be exploited and exposed by someone with malicious intent. Given the massive scope of the cyberthreat landscape, you need every advantage you can get.