Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

5/22/2019
02:30 PM
Ira Winkler
Ira Winkler
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Proving the Value of Security Awareness with Metrics that 'Deserve More'

Without metrics that matter to the business, awareness programs will continue to be the bastard child of security.

Awareness programs are a staple of any good security program, yet they rarely get the resources that they require to accomplish their goal. The reason seems to be, "You get the budget that you deserve, not the budget that you need."

Awareness programs generally run phishing campaigns and push out computer-based training (CBT). Phishing has some potential demonstration of value. CBT proves people view training. There might be some collateral advantage as well. However, the only tangible metrics most awareness programs provide is proof of compliance, and potentially showing that people become less susceptible to simulated phishing. 

To "deserve more" you need to determine metrics that show true business value. To that end, I've broken awareness-relevant metrics into four categories: Compliance, Engagement, Tangible Return on Investment (ROI), and Intangible Benefits.

Compliance Metrics
Compliance metrics involve ensuring that an organization satisfies third-party compliance needs, which, in general, means that you ensure employees complete awareness training. The minimal amount of budget required to provide training to your employees is justified at a minimum level.

Engagement Metrics
This is the most common category of metrics that I see used by most awareness practitioners. These metrics involve the general use and acceptance of the awareness components. Completion metrics, which overlap with compliance metrics, is one form. Sometimes, people are surveyed about the likability of the materials. Metrics may also include voluntary engagement with supplemental materials, such as if a user voluntarily takes extra awareness training, attends an event, etc.

There are two caveats with engagement metrics. They don't indicate effectiveness, and remember that the more engagement people have, the less the time they are performing their jobs.

Tangible Behavioral Improvement and ROI
This is the metric that shows employees are actually raising their security awareness. In this case, you need to measure actual security behaviors or the indications of those behaviors. It is irrelevant if people can recite the criteria for a good password. Do they have a secure password? It doesn't matter if people know they should secure sensitive information. Do they leave sensitive information vulnerable when they leave their desk?

Simulated phishing attacks do not demonstrate behavioral change. The issue is that while simulated phishing attacks could indicate how people might respond to real attacks, it is too easy to manipulate phishing simulations to return any level response that you want. On the other hand, fewer malware incidents on the network are a relevant metric.

Ideally, you want to attach a financial value to behavioral changes. For example, if malware incidents are decreased by 25%, and there is an average cost associated to malware incidents, you can calculate an estimated ROI. Likewise, if there are fewer incidents associated with compromised credentials, you can calculate an estimated ROI. To do so, you need to collect metrics that are related to potential awareness failings, and track those metrics.

Intangible Benefits
Clearly, you want to demonstrate a financial return; however, there are other potential points of value to an organization. For example, if an awareness program creates goodwill toward the security department, users may be more likely to report incidents and cooperate with other efforts. If users believe the awareness program generates value to them, there might be better employee retention. If employees are less susceptible to personal attacks, they might spend less time at work mitigating stolen identities.

"Deserve More"
While compliance requirements will mean that there will always be an awareness program, it is up to a security awareness practitioner to demonstrate that their efforts deserve more than the minimum funding required to achieve compliance. The way to do this is to focus on the periodic collection of metrics that demonstrate a ROI well beyond standard engagement metrics. This is how you deserve more.

Related Content:

Ira Winkler is president of Secure Mentem and author of Advanced Persistent Security. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Tough Love: Debunking Myths about DevOps & Security
Jeff Williams, CTO, Contrast Security,  8/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5638
PUBLISHED: 2019-08-21
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user accou...
CVE-2019-6177
PUBLISHED: 2019-08-21
A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that customers migrate to Le...
CVE-2019-10687
PUBLISHED: 2019-08-21
KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request.
CVE-2019-11601
PUBLISHED: 2019-08-21
A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.
CVE-2019-11602
PUBLISHED: 2019-08-21
Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure.