Let's take a look at security awareness training,
part of Security Operations for Certified in Cybersecurity.
This course was divided into four section,
data security, security operations and administration.
Now we'll take a look at security awareness training before
we review exam review tips and techniques.
One of the things to remember is that there are golden security keys.
These are the security keys that will make a security program
much more likely to actually be successful.
The first thing is that in order to have a good security program,
you really need to have senior management support.
If they don't support it,
then most employees will just kind of shrug their
shoulders and ignore it as well.
And that support should be active and demonstrated as well.
In addition,
the second key is that security must be seen to be
aligned with and to support the business.
In the end,
if there's ever a debate about operating the business or being more secure,
you know that security will lose that debate every time.
In the end, the business exists in order to meet its mission and objectives.
Security is just there to help the business to meet its mission and objectives.
And if it's seen that security gets in the way,
oh,
then very much we can see that people start to bypass and ignore all
of the things that the security people are saying.
It gets to the point that security is seen like a dog
that is barking several miles away, and that dog barks and barks,
and everybody sort of says I wish the dog would be
quiet because it's not doing any good.
It's not talking about anything that really matters.
And we don't want to be seen as security dogs just quite simply barking
without people recognizing the value of what security is.
Therefore, it has to be seen that we are supporting business goals as well.
Now the third thing is the best control is security awareness.
We've seen this through a number of different studies where
they've seen that of all the things that can help the
organization to be more secure,
all of the tools and technologies and contracts and applications,
the one that works best is actually to work with our people,
that is to create a culture of security to let everybody
know that what they do is important,
that actually security is a part of their job,
and the way they do things should be in a secure way.
So security awareness is important.
We have, of course,
awareness that creates a recognition or recognization of what's important,
what the risks are, what the policies are,
and, of course, creates a sensitivity for everybody to know what to look for.
What are the things that could go wrong?
And that way, everybody becomes a part of our security team.
Many of us have seen this, for example, the sayings on posters.
If you see something, say something.
And that's really what awareness does.
So people are watching,
and they would notice if there's something a little bit off.
That is not the same as training.
Training is working with our staff so they know how to do their job,
how to use a certain tool, how to use a certain application,
for example.
And education is teaching people how to make good decision‑making skills.
So we quite often you can see here a progression from the awareness
level to a training level to an education level.
Everybody should have security awareness training.
When we talk about security awareness,
the goal of this is to change people's beliefs.
If I can change people's beliefs so they believe that security is a good thing,
that is going to change their behavior because people
act according to their beliefs.
And so we influence and change behavior in that way.
The awareness program should be convincing.
It should be something that allows people to see and
recognize that what we're saying is important,
not just trying to be troublesome, for example.
Through this,
we create a sensitivity to issues so people now are
aware when there's something; whereas, in the past,
maybe they didn't recognize that this actually was,
should we say here, not a good thing.
But there's another side to this.
The other side to this is that when we've told people,
now they are accountable for what they do.
If I've never told somebody,
I can't expect somebody to know something if they've never been told.
But once I've told them, well, now they are accountable for their actions.
And so in one way,
security awareness brings a greater responsibility to each individual as well.
When we talk about awareness programs, they should be timely,
talk about the things that are happening today.
We don't need to talk about things that were the problems of 20 years ago.
But we should very much have little messages that come
out about today's issues of ransomware, DDoS,
bring your own device, advanced persistent threats.
Talk about the things that they are seeing in the
newspaper or hearing on the news, and let them know how our organization,
we're aware of these things,
and we certainly are working to try and prevent them from getting in.
One of the things I noticed with having children is that very often it
wasn't enough to tell them about something once.
It was good to actually repeat that message until they remembered it.
And so that message should be consistent,
but also should be repeated, so it becomes ingrained in them.
It becomes a part of their belief system as well.
And so we should have a security awareness program,
which isn't just once a year of a boring meeting where somebody stands up
in front and tells everybody they're doing things wrong.
No.
Our security awareness program should be exciting,
alive,
talk about what's going on so people actually may perk up and
take an interest in what we're doing as well.
When we do awareness, we should encourage attendance.
And one of the secrets to this‑‑‑ I remember I was taken to a
large organization who wanted to have all other staff attend
this security awareness program,
and the attendance of the first couple of sessions was really,
really poor, nowhere near the number of people that should have been there.
We were counting on 150 in each session.
We were lucky if we had 30.
And I went to the organizer and I said you know
that you have to get the CEO here.
And he said no.
He literally was shaking.
He says I can't go to the CEO about this.
I said the CEO paid for this.
The CEO signed off on having this done.
I said you need to go and make sure he is in the next session.
And shakingly he went. And certainly what happened?
The CEO showed up.
But you know what happened with every session after that.
Well, then we were full to capacity with standing room only.
Why?
Because there's no one who could say well I was too busy.
If the CEO can take time to come,
you know that everybody else better find the time to come as well.
And so, we should encourage attendance.
And in fact, in some cases,
if we want to be certified by something like an IS0 27001,
this is actually a requirement.
We have to show that our people were then given a security
awareness program at least once a year.
But things get boring.
I love posters.
You know posters are a little bit funny and a little humorous sometimes.
But after 3 days, posters become wallpaper.
And so we could think that, well,
the best way to get the message across is through a poster.
It's a very good way.
But that's not the only way.
Maybe we need to do something that pops up on a personal
screen first thing in the morning.
Here's your security tip of the day.
Maybe we need to‑‑‑ I like how one company did this at a conference.
As you were walking around, they handed everybody a little pad of Post‑it notes.
And on the Post‑in note in a watermark, it said no passwords here.
What a great fun way to get the message across to everybody.
And of course, so use different delivery models that'll appeal to
different people's, should we say, sense of learning as well.
Talk about things that are practical. Don't make it theoretical.
But instead, talk about this is what's happened.
For example,
an example from other organizations or even within our own organization
so that people can apply with they're hearing, and that makes it much
more understandable and real for them as well.
One of the problems we often do is to make security
impossible. We almost convince people that we can't win
because the hackers are smarter than us.
And we put unrealistic requirements on people, such as the old one
about passwords. I gave that quote in the last module,
you know,
from Bruce Schneier. We tell everybody to choose an impossible
password to remember, but never write it down.
Well, that doesn't work.
So instead, what should we do?
We tell people here's how to choose a good password.
Have a favorite song, favorite poem.
Maybe, for example, take the first letter of each word in say,
for example,
our favorite song. That can easily make a password out of that that would be
difficult to remember and would meet all of the rules for it.
We make a password out of that that would be difficult to
guess, and yet we can easily remember it.
And of course, that makes security possible for people.