“We’re always talking about the weakest link. The good news is we already know who that is. It’s the user,” says Joseph Apuzzo. “But what is that human touching? They’re touching the device, they’re touching the e-mail.” 

In this episode, Joseph and the panel look past the user to what the user touches: the endpoint, the phone, the network resources behind them and the data they handle. Along the way, they make the case that user risk is less a people problem and more a policy, design and accountability problem:
- Joseph Apuzzo, Senior Director of Security Solutions Engineering, CommandLink
- Austin Amraen, SOC Director, CommandLink
- David Morrison, Senior Solutions Engineer, Versa Networks

Why the Device Is So Hard to Control

The device is a physical thing, which gives security teams less control over it than tools like e-mail or cloud infrastructure. Austin explained that users can take a device anywhere, connect to any Wi-Fi, download malicious software or plug in a USB drive they found on the street. 

Users also blur the line between work and personal use. You don’t need to bring your laptop to Starbucks and get on the Starbucks Wi-Fi. You don’t need to download that movie. But users will use the device however they want, including handing a work laptop to their kid to look something up. 

The answer, Austin said, is to lock it down: no downloads, no access to certain websites, no personal accounts, no USB drives, no admin rights and only approved software. Even then, the device “is the most user input and the most user controlled thing in your entire company.” 

Joseph framed the fix as awareness plus accountability. Every device is the same out of the box. “The second a user touches it, that device becomes completely unique,” he said. Because every user is different, finding a problem is like looking for a needle in a haystack. That’s why policy and education have to be enforced. 

Five Ways to Strengthen the Weakest Link 

1. Stop Blaming the User for Bad Policy 

David agreed with Austin, then shifted the focus. The user is absolutely part of the issue, he said, but so are companies that are afraid, or financially unwilling, to say no to people using their own devices. 

The difference is significant. A corporately controlled, domain-joined device is far less likely to get a user into trouble than a bring-your-own (BYO) device. “We’re talking orders of magnitude,” David said. Yet companies love BYO, whether for the financials or to let users work from everywhere. 

That raises a hard question: are decision makers enabling the end user to be the problem? “I feel like there’s incentive to make bad policy over the right one,” David said. Security gets labeled the bottleneck to efficiency, and BYO is a prime example. 

Why it matters: Punishing an employee whose kid used the corporate laptop isn’t the solution. “Should we assume that they’re a nightmare and use that knowledge going forward? I would say it’s our fault if we don’t,” David said. Austin agreed: “It’s us. We need to be responsible and lock down the device.” 

2. Make No Exceptions for Executives 

Policy needs executive backing, but Joseph raised the obvious problem: “How many executives do we know that don’t follow the policy or want to be excluded from the policies that they sign off on?” 

“Oh, they’re the worst,” David said. He has seen it time and again in tech support, NOC and SOC teams: people treated differently because their title has a C or a V in it. “There should be no exclusion to these policies. There should be no fast track.” 

The usual excuse is productivity. An executive doesn’t want an endpoint policy because it makes them feel less productive. David’s response: if you feel that way, how do the 10,000 people who work under you feel? Avoiding the policy may feel easier now, but it “costs them 100 times more once the issue has happened.” 

Why it matters: Exceptions create blind spots. “The SOC and NOC cannot fix or cannot detect what they can’t see,” Austin said. If someone is excluded from a policy or rule, a threat can slip through, and both teams end up saying they didn’t know it happened. Everyone needs to be on the same playing ground. 

3. Bring Phones Under Control 

The phone is the part of this conversation that often gets missed. Austin pointed out that people have their e-mail and often their cloud repository on their phone. “You can do everything from your phone now.” The question for a company is how far it can go into that phone. “Policy works. But policy only works if it’s followed.” 

David’s answer is simple. If companies want employees to have mobile access to e-mail and the network, they need to provide a company device. If a company allows BYO access, “the company itself is the one at fault here, not the individual.” 

He also pointed to a bigger pattern. Most companies plan quarter to quarter, and they expect employees to be reachable 24/7, often on their personal phones. When David started his career, there was no concept of that, and companies still made a boatload of money. “Well, you get what you pay for.” 

Why it matters: Visibility is only half the job. With mobile device management (MDM) and containers on company phones, Austin said, teams can detect, control and shut down a compromised device. “The thing isn’t always, can we see it? It’s even if we can see it, what action can we take?” The SOC and NOC are responsible for both. 

4. Design the Network So One Device Can’t Reach Everything

Joseph brought back an example from last week: a summer accounting intern whose device is set up with a connection to the accounting server, and that connection never gets removed. What does that leave exposed for anyone who uses the device next? 

“Most networks are designed wrong when you look at it from a security perspective. Full stop,” David said. He loves the concept of zero trust and limiting access, but the reality is simple: “If there’s a path, there’s a way.” A determined hacker is going to make their way across. 

The good ones don’t rely on a single account, person, entry point or path. They jump from machine to machine, exploiting as they go, and the more talented ones do it intentionally to make their path hard to track. Automated tools can catch one person’s credentials being misused pretty fast. Jumping across platforms and machines is much harder to stop. 

The root problem, David said, is too little emphasis on proper design and architecture, and “too heavy a reliance on our edge firewall where it should be gates all the way across.” Because everyone loves simplicity and wants users empowered, networks end up flat, or tiered without enough isolation. 

Why it matters: “There’s no bulletproof,” David said, but you can make a network as hard to hack as possible. That starts with architecture: don’t make everything reachable from everything, and use separate networks with their own ingress and egress points for some services. Joseph added that the fear of losing productivity to IT, networking and security is “one of the biggest fallacies when it comes to business today.” 

5. Assume Users Are Cutting Corners With Data 

Joseph shared a recent conversation with a customer about compliance. The customer said they had no health information saved on any devices because it all lived in their ERP system. His follow-up: are you sure your users aren’t cutting corners? 

“Governance, compliance, DLP, it’s not going away,” Austin said. New laws keep coming, and the fines for data loss prevention violations under GDPR, Canada’s new framework and new frameworks in the United States are significant. Many companies assume a tool covers them, whether it’s an ERP system, a trust center or a GRC platform. 

But users don’t want to take an extra step or two. Instead of sending a file to a colleague through the ERP tool or the trust center with the right password and encryption, they save it to their desktop and send it by e-mail or Teams. “They’re doing that. Okay, I’m just telling you they’re doing that,” Austin said. 

Tracking is the answer, even when the alerts get noisy. Austin once saw a sharing link with no expiration date sit out in the open for about two years. Anyone with the link could open it, and it held a ton of personally identifiable information (PII) and some protected health information (PHI). 

His advice: lock down how files are shared and where they can be saved, limit permissions to what users need, and track every action. A file was sent, tracked. Someone hit download, tracked. 

Why it matters: The cost of one mistake can be huge. Joseph noted that a violation can be counted for each line of data, not just each file, so “one file could bankrupt the company.” As Austin put it, “You need to look at it now, not when the fine happens, before the fine happens.” 

AI: The Next Data Loss Challenge 

David closed with the issue that worries him most. “We are racing headfirst into an AI world and no one is taking this into account when they’re talking data loss prevention.” 

He described AI assistants that recognize a user’s corporate and personal accounts belong to the same person, then helpfully move files from a work desktop to home without passing through any corporate DLP controls. Teams can do everything right and still face new, inventive ways for data to leak. “AI is just making this worse,” he said. 

Austin expects this to become the next DLP issue: how AI reads data, and what customer data it is allowed to read. If an AI tool reads a customer’s PII, PHI or PCI data, that “could be considered a DLP violation depending on how it’s viewed.” 

“I don’t see how it couldn’t be,” David said. 

Key Takeaways 

The user may be the weakest link, but the panel agreed that blaming the user isn’t the answer. The real fixes sit with the organization: lock down devices, provide company phones instead of relying on BYO, apply policy to everyone including executives, design networks so one device can’t reach everything, and track how data moves. 

The SOC and NOC share that responsibility. Both teams need to see the data, and both need to be able to act on it. 

As Austin put it, the goal is “to make it not really a user problem, but more of a corporate security, corporate structure, infrastructure solution.”