Who do we trust?

During the Covid-19 Pandemic, due to strict lockdowns in many areas of the world, many employees had no choice but to make a rapid and sometimes planned shift to remote work.

Corporations were left scrambling about how to provide employees access to corporate resources, often with the employees using their own personal computers or mobile devices to do so.

This trend of enabling remote work caused a rapid change in the nature of trust between employers and their employees. Employers had to trust that their employees could be productive without the more direct supervision that being in an office provides them. Employees had to find a place to work at home, embrace video meetings and other online collaboration tools, and for many, juggling kids doing school work within the same time and space as their own work.

Technology companies had to rapidly adjust to this new reality. Employees needed to access corporate resources securely, sometimes on a personal device, rather than one provided by their employer.  This use of personal devices created another new situation around trust.  When a personal device is being used to access corporate resources, does the employee feel that they are compromising the privacy of their personal data and device to do so.

These two trends represent a significant blurring of the boundary between work and personal use of technology. As this blurring has occurred, how we perceive the way technology is serving our need for trust and privacy becomes of critical importance.

How do we create more trust?

This rapidly evolving technology landscape has profoundly altered the way people are using technology in their daily lives, but also our concepts of who is trustworthy. For companies that offer technologies that facilitate this new world of remote work, there are wide ranging implications in terms of how we create trust, how we think about trust, the companies we work for, and the companies that build the technology we rely on every day.

Do employees trust their employers?

Clearly not. In the post pandemic landscape of early 2022, a global cultural phenomenon occurred. The Great Resignation tapped into a wide range of discontent that millions of employees had with their employers.

During the pandemic, while employers were forced to offer remote work to many employees, an increase in trust had occurred. Employees felt trusted to get the job done without the traditional idea that they needed to be visible in an office environment.

Yet after the pandemic ended, along with higher pay and better benefits elsewhere, some employees disagreed with their desire of their employers to have them back in the office again.

Do security professionals trust employees?

Clearly not. A 2019 report said that the vast majority (91%) of 500 IT professionals said they feel vulnerable to insider threats, whether malicious or accidental. This somewhat depressing statistic perhaps is a clue to why one of the newest security trends is named ‘Zero Trust Network Access’ (ZTNA). This acronym perhaps unwittingly sends a clear message from security professionals to anyone not in their ranks.  “We don’t trust you”, and even worse, “you’re not trustworthy”.

Whether this was the intention or not, the cybersecurity industry needs to be very careful about how it communicates its attitudes towards users at all levels.

Is the technology industry trustworthy?

Clearly not. In the last decades, countless data breaches have made receiving emails informing you that your password was compromised commonplace. I suspect that most users simply ignore these emails. Ransomware attacks impacted both the personal devices of millions of end users, and corporations alike.

In the last decade, whistleblowers exposing the actions of Facebook in conducting a huge psychological experiment on millions of users, and later allowing the personal information of millions of users to be fed to Cambridge Analytica, a political research firm that effectively was involved in feeding deliberate misinformation to millions of people for political purposes.

Technology, privacy, security, politics and threats to democracy started to merge into one sensitive, emotional topic. Recently, the world's richest man spent 44 billion US dollars to buy Twitter. Days later, he used it to spread a wild conspiracy theory about the brutal hammer attack on Paul Pelosi, the 82 year old husband of Speaker of the House Nancy Pelosi. Thoughtless, insensitive actions from technology leaders send profoundly negative messages about the technology industry and the people that lead technology companies - that they don’t care about either the truth or their customer. After these remarks, advertisers abandoned Twitter in large numbers.

Restoring and Building Trust

As technology plays an ever more integral role in our lives, the cyber-security professionals must play close attention to not only the technical innovations they bring to the table, but what both end users and administrators ‘feel like’ when they are engaging with privacy and security technologies. This includes the look and feel, colors, user experience design and wording used. The following are some ideas about how thoughtful use of words can dramatically change how we think about trust in technology.

Trusted Access

People need to feel valued by the technology they use. ‘Zero Trust Network Access’ (ZTNA), which refers to a technology component, unfortunately carries the implication implies that users are neither trustworthy nor trusted, a small change in wording can completely change the feeling of the product in a positive way for users.

Instead of ZTNA, we should call this technology ‘Trusted Access’. ‘Trusted Access’ clearly communicates that the user is valued and has gained the rights of some aspect of higher privilege, and is therefore trustworthy and responsible. When we phrase it like this, any steps the user needs to take to gain that level of trusted access are seen as a personal validation of their trustworthiness, and are more likely to be willingly undertaken by the user.

Secure Internet

Most users have a certain perception that the internet by nature is not inherently secure, without exactly knowing why.  When communicating with users, the cybersecurity industry should refrain from using terms that refer to technologies rather than user outcomes. The terms Secure Internet Gateway (SIG) or Secure Web Gateway (SWG), refer to functions in the security stack, but they mean little to end users. Users may be unclear about what exactly those functions are and what is going on in the internet with the concept of a gateway.

In comparison,  the term ‘Secure Internet’ is much more understandable as an outcome that users are likely to understand, want and need. ‘Secure Internet’ implies that something is in place to make the internet more secure. Most users will have no clue what that something really is at a technical level, and perhaps do not even need to know, but the label is likely to be reassuring enough to create trust and convey a positive experience.

Private Network

The concept of a virtual private network or (VPN) is another internet security term that refers to a technology rather than an outcome for users. To users, everything on the internet is virtual, and a ‘virtual private network’ as a conceptual idea is difficult to grasp. Virtual also has the connotation of something that is not really there in reality, and because it is not real, perhaps has no 'real' value!  This implication is unfortunate, as it implies that a ‘virtual private network’ is not really private at all, just private in some obscure technical way.

By dropping ‘virtual’, and simplifying the term to simple ‘Private Network’, the meaning becomes immediately clear. A 'Private Network' is something that not everyone has access to, therefore is by nature restricted and therefore more secure, because the people that are using it come from a narrow, known group. It conveys privilege, security, and access only to a selected group, which the user feels positive about being part of.

Safety is Psychological

Safety is often psychological, especially when users have no real idea of what is really occurring behind the scenes in the technology they use. When the words and terminology used to describe these technologies communicate that users are not worthy of trust, the cyber security industry is unwittingly sabotaging its own objectives.

As cyber security professionals, it’s not just about the technology, we owe it to our users to careful attention to how we communicate and think about trust.