- Welcome to lesson 28.
Given a scenario, implement security awareness practices.
In this lesson 28.1,
we're gonna talk about education, training, and awareness.
The information security is absolutely
a shared responsibility throughout the enterprise.
No one person is solely responsible
for information security.
That's a really important message
to both take to heart and to communicate.
Now, a critical component
of a successful information security program is knowledge
and awareness.
So ongoing education, training
and awareness programs are essential.
Now, our programs should always be customized
to our target audience
because we want them to be impactful and effective.
And programs should be adaptable to changing circumstances.
Like in the pandemic, when everybody went to remote work
from home, we may have had to pivot and adapt our program.
So NIST, the National Institute of Standards and Technology
has a model called their SETA model,
security, education, training and awareness.
And you can read more about it
in special publication 800-50.
This is a great model.
And what it says is education,
training and awareness are all different things.
And they have different audiences
and they have different objectives
and they have different ways that we're going to present it.
And they have different ways we can measure it
and different impact.
And we really need to be cognizant of that.
Education is all about why.
Why are we doing something?
And really our objective is understanding.
Now, the best method is for teaching
is gonna be a discussion or a seminar
or reading, particularly having good pre-reading materials.
If you're gonna measure this, it would be essay.
And the impact is generally long-term.
So who is education really appropriate for?
Well, definitely for our board of directors, our board
of trustees, and our executive management
who are making these major decisions, right?
These decisions on strategy and budget
and the future of an organization.
So it's important that they have insight and understanding.
You're probably not gonna test them by giving them an essay
but you know, do discussions, seminars,
giving them reading material that's gonna stick
with them for the long term.
The next is training
which is really what you and I have been doing.
It's all about how do I do something
and gaining knowledge and acquiring a skill.
Now the best teaching methods are going to be a lecture,
case study and hands-on.
And the measure is gonna be problem solving.
Now, what's the impact timeframe?
Well, intermediate, right?
You'll remember this for quite a while
but you may need to brush up on it if you don't use it.
And then last, we have awareness.
Awareness is all about what, huh?
What's going on?
It's all about the dissemination of information.
And our objective is to change people's behavior.
Now, the best methods are
for teaching are gonna be very interactive and engaging.
Videos, posters, games.
And if you are going to need a measure
you wanna test it out, true and false or multiple choice.
But here's the thing about awareness programs.
They're really short term, like really short term.
And I do wanna just share one story with you
to just emphasize how short term they can be.
Many, many years ago,
I was at NSA offices in Herndon, Virginia.
NSA is national security agency.
So they're supposed to be thinking about security
all the time.
And the part of the building I was in
was had lots of locked doors.
And so to get through a door,
you either had to swipe your badge or put in a code.
And so when I would go, like even to the restroom
I'd have to go through like three or four different doors.
And here's what amazed me all the time.
You'd go through a door and in front of you
when you came through it, there would be a sign
and the sign would say, one of two things.
Did you hear the door click behind you?
Or did anybody come in with you?
Now I'm in this agency, right?
That's all about security.
That's what these people do.
They live and breathe security
and yet they may be moving quickly
through the building, right?
Thinking about their next meeting,
thinking about their boss, thinking about the fact
that they're hungry and they wanna have lunch.
And so they still need to be continually reminded
of these things.
And that has always really stuck with me.
This idea
that awareness programs are never one and done, right?
They're very short term.
We need to be creative and we need to keep doing them.
And one of the ways they were creative
is those signs kept moving around.
So just when you knew, thought you knew where a sign was
you can come quickly through a door.
Turns out you might even smack into one.
Alright.
So let's look at how we implement a set
of program or how we might think about
implementing a set of program in our organization.
Well, we start at kind of non-existent.
It doesn't exist at all.
Then what happens
in a lot of organizations is security, education
training and awareness is kind of ad hoc.
Oh, we need to do this.
Oh, we just heard about another company that had ransomware
and we're nervous about it.
Oh, something else happened
that we decide we better do something.
Or someone just joined our organization, said, hey,
how come we're not doing this?
We should.
So it gets done, but not in any planned way
kind of really ad hoc.
The next level of maturity is compliance driven, right?
We're doing training on a regular basis, right?
Education, training, and awareness on a regular basis
but only because we have a compliance requirement.
From there, we move into more
of an integrated model where we say, you know what?
We recognize that security, education,
training and awareness is really, really important.
And so it becomes integrated
into our DNA and that we take it seriously
and we're really doing it continually.
We invest in it
and we look to have really good, strong programs.
And then the top of our maturity model would be
that it's measurable and reportable.
Meaning that it's metrics driven.
That not only are we doing it
but we're following up, is it effective?
Is it working?
So not just, oh, did you like your training?
But really watching behaviors
after the training to make sure that it is effective.
So it's measurable and reportable, metrics driven.
I wanna talk about two components
of the SETA model, specifically education and awareness.
And let's focus first on executive education.
Now, I have to tell you that when I talk to executives
when I'm educating executives
I never use the word education.
I always use the word briefing, right?
Why?
Because educating somebody
or teaching someone always kind of sounds like
I know something you don't.
And executives don't really like that.
But when I brief them, it really makes 'em sound like
I have information that I know you want
that I'm sharing with you under your direction.
The president of the United States
doesn't get educated each morning, right?
He or she gets briefed.
The briefing objective is insight
and understanding for the long term.
So when you are briefing your executives
and I hope that you have the opportunity to do so, make sure
that you know your audience's presentation preferences.
If they like PowerPoint, go with PowerPoint.
If they hate PowerPoint, and they would rather
just have a discussion, have a discussion, right?
If they would like to have the whole presentation ahead
of time so they can study it, then do that.
But find out what your audience,
their presentation preferences are and honor them.
I always suggest that you provide a discussion framework
and pre-reading materials.
And those pre-reading materials should be sources
that they respect.
Maybe the Wall Street Journal or maybe the NACD,
the National Association of Corporate Directors.
And then you wanna be specific to institutional goals.
And that includes regulatory requirements.
Like why do we need to do
whatever it is we're talking about?
And always feel comfortable putting in
those regulatory requirements.
Do not use geek speak, right?
Do not use any words.
They're not gonna understand.
Just use business language and recognize
that whether you're talking to the executive, the C-suite,
your CEO, your CFO, your CEO, your COO
or your board of directors or your board of trustees
that their time is limited.
You may want an hour to explain a topic to them.
There's a better chance you're gonna get 10 or 15 minutes.
And also recognize
that their technical expertise may be minimal.
So you never want them to be uncomfortable
because you're talking about something technical and geeky
and they're like
I don't even know what they're talking about.
That's not a good place to be.
And then I would always suggest
that you cover a limited number of topics.
You may have 10 things you wanna talk about,
but if you try to talk about 10 things in 15 minutes
none of them is gonna stick.
So stay focused.
Get your top two or three
and that's what you're gonna brief them on at that time.
Now, security awareness programs should be inclusive
of all levels of our organization
and extend to our consultants and our contractors
because the objective
of security awareness programs is to influence behavior.
Now, our onboarding
and our post boarding program should focus on policies.
For example, our acceptable use policy,
best practices, social engineering,
duress and reporting suspicious activity.
Then we'll supplement that with perhaps annual compliance
or hot topic or refresher programs.
And those could be instructor led or recorded or online.
And then we wanna make sure
that we have an ongoing awareness program
which includes posters and games and contests and prizes.
Everybody loves prizes, right?
And surveys.
We wanna get feedback.
How are we doing?
And as needed, situational awareness communications.
So let's say there's been
a social engineering attack in your organization
or a phishing email people started responding to.
Well, that's a situation it'd be great if people knew about.
So take something that's actually happening
and use that right?
Do situational awareness communications.
Very successful security awareness programs
will incorporate a variety of tools,
including newsletters, posters, games,
newsfeeds, blogs, phishing simulations, and competitions.
And you wanna diversify your material to appeal
to as many users as possible.
Two keys to success, interaction,
and personalization, right?
You don't want them just sitting back going,
oh, I don't know what they're talking about.
Why does that affect me?
And you want it really personal.
So get 'em involved, right?
And make them active.
Group competition is an absolute proven motivator.
And as I said, everybody loves recognition and prizes.
So let me share with you the secrets of impactful training.
Invite everyone, it's really important.
Training shouldn't just be
for the frontline or for, you know,
the people who are just doing all the day-to-day work.
The operations folks.
Invite everybody, right?
Everybody from you know, all across all business units.
You know, from place A all the way up
to your board of directors.
So invite everyone.
You wanna create a really comfortable
and welcoming environment.
So greet people when they come in.
You wanna make sure
that maybe you have very comfortable chairs.
Make sure the temperature is right.
Make sure that you have some food and drink.
Everybody loves snacks.
Start on time.
That's really important.
When you're doing training, start on time.
Do not punish people for being on time
by making them sit there and wait for the stragglers.
Start your training on time, just a couple of times
and everybody will get there on time in the future.
Begin with an unexpected opening line
'cause nobody's really excited
about being at your security awareness training.
So punch it out.
Begin with a really unexpected opening line.
Get their attention.
And then engage your audience
through interactive activities, games.
My personal favorite is songs.
I write songs all the time to known tunes
like Frere Jacques and Row, Row, Row Your Boat.
And I make my audiences sing those songs.
Be concise, don't wander, right?
Stay on topic.
And then really reinforce the idea
that we need to get everyone to work together.
We wanna get everyone to believe in a shared outcome.
Why?
Because information security is a shared responsibility.
And have them share that outside of your organization.
Encourage them to take what they've learned
and tell their family members to tell their friends,
tell their neighbors.
Because not only do we wanna be securing our companies
but we also wanna be securing our communities
and our country.
That my friends, brings us to a three second challenge.
This is our last three second challenge
that we're gonna do together.
Five challenge questions, three seconds each.
The attribute is how, the objective is skill.
What is that?
1, 2, 3.
That's training.
Timeframe impact of an awareness program.
1, 2, 3.
That's short-term.
Number three, maturity level where training is provided
on an as-needed basis.
1, 2, 3.
That's ad hoc.
Alright.
Number four, a policy that should be introduced
during the onboarding period.
Reach back a couple of lessons for this one.
1, 2, 3.
That's an acceptable use policy.
And lastly, number five,
who's responsible for information security?
Oh, everybody's gonna get this answer.
I know.
Oh, I just gave you a hint.
1, 2, 3.
Everyone.
Awesome.
Alright, let's do our last security-in-action
case study together.
This one's about training and participation.
Your organization
had its first social engineering assessment,
and the results were not good.
The tester was able to obtain
legally protected customer information,
change customer records
even have a refund check set to a new address.
So you have been asked to design a training session.
Now the question is, who should attend?
Just those who responded in error,
specific departments or all employees?
The senior management has recommended
that only the relevant departments attend.
Do you agree?
So a quick little recap here.
We had our very first social engineering simulation
which are very, very important to do.
I'm glad that it was done, but the results were not good.
Well, we're not happy about that.
But you know what?
It's a learning experience.
The tester was able to obtain
legally protected customer information,
change a customer record,
even have a refund check sent.
But part of, you know, what we're gonna do
before we do that social engineering assessment
or simulation, is we're gonna have a rules
of engagement document that's gonna talk about, okay,
if you're able to get legally customer, you know,
protected customer information
or do any other activity, you know, here is the process.
Here's who you have to notify,
here's how you have to handle that data.
So all of this went on.
Management's pretty concerned
as they should be, and they've said, listen,
can you design a training session so we can learn from this?
But the big question is, who's going to attend?
Just those who responded in error, specific employees
or specific departments or everybody?
So just those who responded
in error, specific departments or all employees.
Senior management has said
I think only relevant departments,
we don't need to go to that.
Do you agree?
Go ahead and put me on pause.
Write down some notes for who you think should participate.
Well, this is a great opportunity to reach all employees
with a really relatable scenario
because it's something that happened in their organization.
So, weave the results
of that assessment or simulation into the training.
Now with a caveat that no employee
should ever be singled out or embarrassed.
We don't ever wanna say,
well, Jane did this and Joe did that.
We don't wanna do that, right?
So we wanna do it in such a way that, you know,
we're not tattling on anybody.
Now, only use names when there's praise to be given.
So when someone did something great, use their name, right?
If they didn't do something great
we're not going to use their names.
You can utilize recording transcripts to make it real.
You know, one of the problems is
if there is a recording and you use the actual recording
people will recognize the voice.
Now, you could use the voice, again,
when it's something good,
when there's praise to be given
like this was the right way to do it.
But again, we don't want to embarrass anybody.
So you may wanna use written transcripts instead
of audio transcripts for things that went wrong.
Showing a picture of how that social engineer
was dressed to make it real, right?
Did they come in dressed as a UPS driver?
Did they come in, you know, as electrician?
Did they come in to measure for new blinds?
How were they dressed?
What were they wearing?
You know, did they have a cap and a jacket on?
Did they have a clipboard or a work order?
Show all those things to really bring it home.
You know, just what social engineers do.
And then be positive.
Be positive, not punitive, right?
This is what we've learned.
And now here are updated procedures.
This is how we're gonna handle things in the future.
Because we've learned, right?
That if our results were not good,
well, we probably didn't have the right procedures in place.
So we've updated our procedures
we're sharing those with you now.
We don't wanna punish anyone.
We want improvement.
And then we're gonna stress
that we are all in this together.
And even though we might not have been the one who fell
for the social engineer, someday, it could be us.
So we're not pointing fingers.
We're in this all together.
And we're really looking for continuous improvement
to continue to protect our organizations
and our stakeholders,
our employees, our customers, everybody.
Because security is a shared responsibility.
That, my friends, brings us to our very last word cloud.
You know what to do.
Make sure that you understand all this.
You can speak to it comfortably and confidently
and that you can deliver impactful training.
And now let's go do our last quiz.