Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

5/30/2017
05:53 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Securing the Human a Full-Time Commitment

Encouraging the people in your organization to make safer cyber decisions requires dedicated brainpower to pull off, SANS study shows.

While most enterprises today boast at least some sort of security awareness training program, the fruits of those labors are a mixed bag. In fact, when measured on a five-tier security awareness maturity model, only about 10% of organizations can boast the highest two tiers of maturity, according to a study out from SANS Institute today.

The study's findings show that a lot of the varied success has to do with one simple and unavoidable factor - staffers dedicated to training efforts.

It may seem like a no-brainer, but the truth is that many organizations today are stuck with subpar security awareness training because they are simply tacking duties around the organization and implementation of an awareness program onto existing security staffers' job descriptions.

"If you've got somebody that's spending only 10%, 15%, or 20% of their time dedicated to awareness, you're just checking the box," says Lance Spitzner, director of SANS Securing the Human program, who helped spearhead the 2017 Security Awareness Report.

In its third year running, the report questioned over 1,000 security awareness professionals worldwide about the state of their awareness training programs at their organizations. The survey showed that about half of organizations are in the middle stage of program maturity - promoting awareness and behavior change - while over 27% are still stuck in compliance focus.

Only about 7.6% of organizations say their program is nonexistent, although selection bias may have played a part in this low number, given the type of participants chosen for this study. According to the 2016 Dark Reading Strategic Security Survey, only 56% of participants reported that their organization provided end-user awareness training. A different survey from ESET out earlier this month shows that one in three employees do not receive any form of cybersecurity training at their organization and one in five employee respondents said they are "not at all" aware of cyber security best practices. 

Meanwhile, the organizations really making a dent with their existing security programs are rare indeed. SANS found that about 9.8% of organizations had reached the maturity of long-term sustainment and culture change. Meanwhile, just .85% of organizations have gotten to the point where they've got a metrics framework that can tie awareness training to security readiness.

The SANS report took a look at the top two categories of performance and found that one of the biggest factors correlated to success was full-time employee commitment. The report found that the minimum level of staffing for a program to change behavior at an organizational level was 1.4 full-time employees. Meanwhile, the most successful programs had at least 2.6 full-time employees dedicated to awareness.

According to Spitzner, the number of people dedicated to the program trumped even overall budget as a success factor. 

"Awareness programs are all about collaboration, communication, and partnerships, and that takes time," he explains. "Some of the most effective awareness programs are high impact, but low budget, because they're using existing resources, ambassador programs, champion programs and even existing graphic design capabilities."

As a result, Spitzner says the number one recommendation coming out of the report is for organizations to heavily funnel awareness dollars to human resources than to fancy technology. 

"I don't want to say that to be successful you can't use external resources or buy things. What I'm saying is awareness is not just about buying a big flashy box," he says. "It doesn't have to cost a lot of money. [The team] just needs time to put it together."

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36192
PUBLISHED: 2021-01-18
An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php p...
CVE-2020-36193
PUBLISHED: 2021-01-18
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
CVE-2020-7343
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
CVE-2020-28476
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
CVE-2020-28473
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...