Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

10/27/2016
01:30 PM
Lance Spitzner
Lance Spitzner
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

How To Build A Strong Security Awareness Program

To become more secure, focus your training and manage your top risks.

At the Security Awareness Summit this August in San Francisco, a video clip was shown that highlights the need to develop holistic security awareness. The segment showed an employee being interviewed as a subject matter expert in his office cubicle. Unfortunately, all his usernames and passwords were on sticky notes behind him, facing the camera and audience for all to see.

I bring this story up not to pick on this poor chap but to highlight the fact that security awareness is about human behavior, first and foremost. Understand that point and you are well on your way to building a more secure culture and organization.

My work as director of the Security Awareness Training program at the SANS Institute affords me a view across hundreds of organizations and hundreds of thousands of employees trying to build a more secure workforce and society. As we near the end of this year's National Cyber Security Awareness Month, here are two tips to incorporate robust security awareness training into your organization and daily work.

1. Focus the Training
Changing behavior is hard. But security awareness training shouldn't be. Most training is just too hard for many users. "Too hard" has many definitions: Too long. Too much. Too often. Too boring. Too many behaviors. In general, many organizations make the mistake called cognitive overload, which is when you dump so much on employees that they simply forget it all. Sound familiar?  There is a better way. Keep the training short and sweet and focused on what will really mitigate your risks. Avoid cognitive overload by taking the time up front to ensure engagement and relevance. 

2. Manage the Top Three
To build a mature security awareness program, you need to identify your top human risks and focus on them. Too often, organizations attempt to eliminate all human risk by covering too many topics. As a result, employees are bombarded with numerous, haphazard behaviors they must follow and too many messages, resulting in cognitive overload.

Often the hardest part of awareness is not determining what to train on, but determining what to cut and not include. One key step is to conduct a human risk assessment for your organization. When I look across the more than a thousand clients we work with and the results of this year's Verizon Database Investigations Report (where over half of the breaches in 2015 were human factor-related), three big human risks emerge.

  • Phishing: The focus here is on the behaviors we need to develop so people know the indicators of a phishing attack along with what to do when they detect such an attack as well as how to report such an attack and feel comfortable doing so. Note the nuance here. Focus on the secure behaviors needed to thwart an attack. Unfortunately, phishing is where many awareness programs not only start but also end. Phishing training is an important part of building a holistic security awareness program, but it's not enough by itself."
  • Passwords: The most critical aspect of password security is how people use their passwords. Are they sharing their passwords with coworkers? Are they setting unique passwords for each site? I love passphrases and password managers because they help address the underlying behavioral element of password security. And the ultimate solution whenever possible? Two-step verification.
  • Accidental: While deliberate attacks are a fact of life, many security issues arise from simple employee accidents or oversight. Leaving your mobile phone in a cab, freely sharing documents without realizing they have highly sensitive data in them, or accidently emailing the wrong person because auto-complete in your email client set the recipient to the wrong (but similar) name.

These top three are a good start, but what's important is managing the risk presented by humans in and around your organization, so take the time to understand what matters for your company and create your own top three. 

Related Content:

Black Hat Europe 2016 is coming to London's Business Design Centre November 1 through 4. Click for information on the briefing schedule and to register.

Lance Spitzner is an internationally recognized leader in the field of cyber threat research and security training and awareness. He sits on the board of the National Cyber Security Alliance and helped develop and implement numerous multi-cultural security awareness programs ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.