Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

5/30/2017
05:53 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Securing the Human a Full-Time Commitment

Encouraging the people in your organization to make safer cyber decisions requires dedicated brainpower to pull off, SANS study shows.

While most enterprises today boast at least some sort of security awareness training program, the fruits of those labors are a mixed bag. In fact, when measured on a five-tier security awareness maturity model, only about 10% of organizations can boast the highest two tiers of maturity, according to a study out from SANS Institute today.

The study's findings show that a lot of the varied success has to do with one simple and unavoidable factor - staffers dedicated to training efforts.

It may seem like a no-brainer, but the truth is that many organizations today are stuck with subpar security awareness training because they are simply tacking duties around the organization and implementation of an awareness program onto existing security staffers' job descriptions.

"If you've got somebody that's spending only 10%, 15%, or 20% of their time dedicated to awareness, you're just checking the box," says Lance Spitzner, director of SANS Securing the Human program, who helped spearhead the 2017 Security Awareness Report.

In its third year running, the report questioned over 1,000 security awareness professionals worldwide about the state of their awareness training programs at their organizations. The survey showed that about half of organizations are in the middle stage of program maturity - promoting awareness and behavior change - while over 27% are still stuck in compliance focus.

Only about 7.6% of organizations say their program is nonexistent, although selection bias may have played a part in this low number, given the type of participants chosen for this study. According to the 2016 Dark Reading Strategic Security Survey, only 56% of participants reported that their organization provided end-user awareness training. A different survey from ESET out earlier this month shows that one in three employees do not receive any form of cybersecurity training at their organization and one in five employee respondents said they are "not at all" aware of cyber security best practices. 

Meanwhile, the organizations really making a dent with their existing security programs are rare indeed. SANS found that about 9.8% of organizations had reached the maturity of long-term sustainment and culture change. Meanwhile, just .85% of organizations have gotten to the point where they've got a metrics framework that can tie awareness training to security readiness.

The SANS report took a look at the top two categories of performance and found that one of the biggest factors correlated to success was full-time employee commitment. The report found that the minimum level of staffing for a program to change behavior at an organizational level was 1.4 full-time employees. Meanwhile, the most successful programs had at least 2.6 full-time employees dedicated to awareness.

According to Spitzner, the number of people dedicated to the program trumped even overall budget as a success factor. 

"Awareness programs are all about collaboration, communication, and partnerships, and that takes time," he explains. "Some of the most effective awareness programs are high impact, but low budget, because they're using existing resources, ambassador programs, champion programs and even existing graphic design capabilities."

As a result, Spitzner says the number one recommendation coming out of the report is for organizations to heavily funnel awareness dollars to human resources than to fancy technology. 

"I don't want to say that to be successful you can't use external resources or buy things. What I'm saying is awareness is not just about buying a big flashy box," he says. "It doesn't have to cost a lot of money. [The team] just needs time to put it together."

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
Edge-DRsplash-10-edge-articles
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23394
PUBLISHED: 2021-06-13
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
CVE-2021-34682
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
CVE-2021-31811
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-31812
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-32552
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.