The human
data perimeter.
A company can secure its network and still leave its people exposed. Personal information sits beyond the corporate fence, giving adversaries a way to reach the people behind the defenses. That's the human data perimeter.
Before deciding where the next security dollar goes, try this one.
List the cyber attacks that did not use some form of social engineering to get where they were going.
Almost every attack has a human component, because a person is the easiest mechanism to reach. What makes the approach work is not technical. It is knowledge of the person: what they do, who they trust, what is happening in their life this month. That knowledge is collected continuously, by parties the organization has never heard of, and it has never been audited.
The firm's position is that this is a threat surface in the ordinary sense, and should be measured and reduced the way any other surface is.
Are you thinking about employee personal data as a threat surface?
Every employee is a behavioural model that can be reconstructed from the outside. Personal data does not only say what a person does. It says how they think, decide and respond under pressure, and whoever holds it can build an approach around the person rather than around the company.
The red items are the ones that matter most: a life event, a schedule, a change in health. The device inferences are real categories offered by behavioural SDK vendors. They are not guesses about a person; they are products.
Awareness training covers the part you can see.
The data an employee knows about, their social accounts, their career history, the public record, is the cap. The mass is below the waterline: advertising identifiers, location history, marketing profiles, credit and risk data, breach dumps and the aggregators who stitch it together. It escapes the employee's awareness, which means it escapes every control that depends on the employee.
Same trail. Two people.
Data does not describe. It interprets, and the interpretation depends on who is reading.
A mother with a kid in middle school who parties a lot.
She has a skin condition, goes out on school nights, visits a friend's house for an hour almost every evening, then hits the bar. And she appears to have a medical marijuana card.
A single mother working two jobs and caring for a sick parent.
She works at a doctor's office and at a bar, occasionally picks up her father's medical marijuana order for his nausea, and still manages to drop off and pick up her kid from school every day.
Who writes the story, a person or a machine, decides which of these an employer, an insurer or a stranger believes. Neither reading is in the data. Both are available to anyone who buys it, which is the point: inference is cheap, and it does not have to be right to be used.
Four tiers, four different programs.
A roster is not one risk. It is four kinds of exposure, and the right defence for each costs a different amount. White-glove work for the people at the top; inexpensive, roster-scale reduction for everyone else; monitoring for the people whose access matters most.
High visibility
Executives, corporate evangelists, public faces
The most attention, the most public data, and a public profile that makes any approach easier to make plausible.
High net worth
C-suite, VP level, founders
Worth an adversary's time on their own account, and the household is the open flank.
High touch
Front-line and customer-facing staff
Reachable by design, so an approach arrives in the normal flow of work and looks like it.
Roster-scale exposure reduction · Training
High risk
Trust and safety, information security, help desk
The people whose access and routines matter most to everyone else's security.
Exposure reduction · ThreatWatch · Training
Reduce the surface. Watch what remains. Change the culture.
Awareness training addresses the cap of the iceberg and asks the employee to carry the rest. A program addresses the mass.
Remove the data before it is used
Digital footprint management is proactive defence: find what is exposed about each person, take down what can be taken down, at the brokers and the archives, and keep it down. Move the organization from awareness to control.
Exposure discovery and reduction →Watch the people who matter most
Continuous monitoring across the surface, deep and dark web for the high-risk tiers: doxxing, impersonation, credential and data leaks, and signs of surveillance, read by analysts for what they mean.
ThreatWatch →Security as cognitive ecology
Treat security behaviour as part of the organization's cognitive system. Build adaptive habits rather than awareness campaigns, reduce cognitive load, and cultivate resilience to deception, with the limits of what any employee can carry stated plainly.
Tactical Privacy Training →Privacy is a layer of defence. It is not only the corporate intellectual property that needs protecting. It is the people.
Privacy is power.
A talk, and the work behind it.
The argument on this page was given by Jeff Jockisch to the Cognitive Information Society as The Human Data Perimeter: Mapping the Employee Threat Surface in an AI-Powered World, and rests on the firm's CODEX of the commercial surveillance economy, more than 8,600 companies that collect consumer profiles, categorized, tagged and scored.
CODEX
The largest and deepest dataset of the entities that build profiles of people, and the basis for knowing where an employee's data sits.
Explore CODEX → For the teamsSecurity leaders and executive protection
How the program fits beside what cyber, physical security and privacy already do.
Who we protect →Audit the perimeter you have not measured.
An organizational baseline establishes what is exposed about the people who constitute the risk surface, tier by tier, and what it would take to reduce it.
Your people.