Ira Winkler - Security Awareness For Dummies

To determine whether your awareness training is effective, ask participants what they learned from it rather than whether they liked it.

Awareness is just one tactic within an overall strategy to reduce the risk associated with user-initiated loss. If you’re in charge of your organization’s overall efforts to mitigate user-related loss, you need to consider awareness as one tool in your arsenal. If you’re responsible solely for awareness, you need to understand your place within the overall loss-reduction strategy.

Users can fail only if the technology around them provides them with the opportunity to fail. A user can’t click on a phishing message, for example, unless all the antiphishing technologies in place failed to filter the message in the first place. Of course, technology fails significantly less often than users fail. For this reason, you need to either frame your efforts accordingly or work with the teams that provide the users with the environment.

Here are some ways other teams can help:

Work with the teams that provide the technical security environments to reduce the opportunities presented by the environment for users to initiate losses.

Work with the teams that manage the technology that anticipates harmful user actions, such as data leak prevention tools, to mitigate the harm from the actions proactively.

Work with the operations team to see how users’ actions can be better defined to avoid the initiation of losses.

Security awareness is just one tactic, among many, to mitigate damage caused by users. If you want to fail, portray your efforts as a strategy to deal with the entire problem.

Chapter 3

IN THIS CHAPTER

Establishing common knowledge

Seeing what safety science does right

Borrowing from accounting practices

Knowing the ABCs of awareness

Applying group psychology to your awareness efforts

Understanding how risk management works

When you create a security awareness program, or any awareness program, you’re attempting to influence group behavior throughout an organization. The success of your program depends on the reliability of the science and the theories you base your assumptions on.

As I say throughout this book, perfection and universal applicability are myths of the security profession; they don’t exist. I have found, however, that the sciences described in this chapter work more consistently than other flawed but commonly held ideas, such as those that can cause the difficulties I cover in Chapter 2.

As you see in this chapter, you gain the most benefit for your awareness efforts by consulting sciences that influence (or attempt to influence) crowd and organizational behaviors. You need to understand the sciences of how people think and behave only to the extent you need to know to do your job properly.

The greatest criticism I seem to hear about security awareness is that it’s all common sense. It’s common sense to know not to click on certain emails. It’s common sense to know that the tax service won’t call you to persuade you to give them a credit card number to pay a bill immediately. And so on. Going back to my psychology lessons, the response that comes to mind is this: “You can’t have common sense without common knowledge.” To a large extent, security awareness is about creating common knowledge (stuff that everyone truly knows) so that users can exercise common sense (perceived good judgment in practical matters).

People within an organization generally assume that what is common sense for them is common sense for everyone. But within the group, people often lack the common knowledge required to share common sense understanding.

Common sense is based on common knowledge. You can’t have common sense without first establishing common knowledge.

In cybersecurity, people without a technical background definitely lack the knowledge that people within the IT or security professions possess. You need to account for this fact when building your assumptions. You must understand where common knowledge does (and does not) exist among the individuals within the group whose behavior you want to influence.

When you approach the design of your awareness programs, ask yourself, “Is this fact or idea common knowledge, and should it be?”

Be sure to consider whether users lack the common knowledge required to act on your recommendations. Security awareness programs often tell users to create strong passwords, for example, or to check the identity of the sender for the email messages they receive. Even though most awareness communications require concise messaging, you must consider whether you must back up such guidance with instruction. If users don’t know how to create a strong password or how to adequately verify the identity of an email’s sender, the higher-level guidance is worthless. You must establish a base of common knowledge before you can require the common sense behavior.

Company leaders sometimes assume that technical workers, including security team members, have more common sense than the average users. In my experience, this assumption is often incorrect. A common tactic used by cyberthieves, for example, is to pretend to be another person, call an organization’s Help desk, and persuade an unwitting Help desk representative to reset that person’s password. As a test, I have personally convinced a Help desk rep within one of my targeted companies to send me a new computer during a social engineering exercise. During physical penetration tests, I frequently just walk into the security office and persuade the employees to issue me an actual facility badge.

Unless you know that a person in a given job function receives fundamental training that enables them to act on your guidance, you should assume that they lack the necessary common knowledge. This assumption should be embedded in every aspect of your awareness program, where you consider whether users have the underlying knowledge to enact the information you provide. You probably can’t include every basic concept into awareness materials, but you need to design your messaging to accommodate a lack of common knowledge.