Securing the Human a Full-Time Commitment

Encouraging the people in your organization to make safer cyber decisions requires dedicated brainpower to pull off, SANS study shows.

While most enterprises today boast at least some sort of security awareness training program, the fruits of those labors are a mixed bag. In fact, when measured on a five-tier security awareness maturity model, only about 10% of organizations can boast the highest two tiers of maturity, according to a study out from SANS Institute today.
The studys findings show that a lot of the varied success has to do with one simple and unavoidable factor - staffers dedicated to training efforts.
It may seem like a no-brainer, but the truth is that many organizations today are stuck with subpar security awareness training because they are simply tacking duties around the organization and implementation of an awareness program onto existing security staffers job descriptions.
If youve got somebody thats spending only 10%, 15%, or 20% of their time dedicated to awareness, youre just checking the box, says Lance Spitzner, director of SANS Securing the Human program, who helped spearhead the
2017 Security Awareness Report
.
In its third year running, the report questioned over 1,000 security awareness professionals worldwide about the state of their awareness training programs at their organizations. The survey showed that about half of organizations are in the middle stage of program maturity - promoting awareness and behavior change - while over 27% are still stuck in compliance focus.
Only about 7.6% of organizations say their program is nonexistent, although selection bias may have played a part in this low number, given the type of participants chosen for this study. According to the 2016 Dark Reading Strategic Security Survey, only 56% of participants reported that their organization provided end-user awareness training. A different survey from ESET out earlier this month shows that one in three employees do not receive any form of cybersecurity training at their organization and one in five employee respondents said they are not at all aware of cyber security best practices.
Meanwhile, the organizations really making a dent with their existing security programs are rare indeed. SANS found that about 9.8% of organizations had reached the maturity of long-term sustainment and culture change. Meanwhile, just .85% of organizations have gotten to the point where theyve got a metrics framework that can tie awareness training to security readiness.
The SANS report took a look at the top two categories of performance and found that one of the biggest factors correlated to success was full-time employee commitment. The report found that the minimum level of staffing for a program to change behavior at an organizational level was 1.4 full-time employees. Meanwhile, the most successful programs had at least 2.6 full-time employees dedicated to awareness.
According to Spitzner, the number of people dedicated to the program trumped even overall budget as a success factor.
Awareness programs are all about collaboration, communication, and partnerships, and that takes time, he explains. Some of the most effective awareness programs are high impact, but low budget, because theyre using existing resources, ambassador programs, champion programs and even existing graphic design capabilities.
As a result, Spitzner says the number one recommendation coming out of the report is for organizations to heavily funnel awareness dollars to human resources than to fancy technology.
I dont want to say that to be successful you cant use external resources or buy things. What Im saying is awareness is not just about buying a big flashy box, he says. It doesnt have to cost a lot of money. [The team] just needs time to put it together.
Related Content:
Why OAuth Phishing Poses A New Threat to Users
9 Ways Organizations Sabotage Their Own Security: Lessons from the Verizon DBIR
7 Ways Hackers Target Your Employees
With Billions Spent on Cybersecurity, Why Are Problems Getting Worse?

Last News
▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Securing the Human a Full-Time Commitment