1
00:00:06,540 --> 00:00:07,980
- Welcome to lesson 28.

2
00:00:07,980 --> 00:00:11,580
Given a scenario, implement
security awareness practices.

3
00:00:11,580 --> 00:00:13,560
In this lesson 28.1,

4
00:00:13,560 --> 00:00:18,510
we're gonna talk about education,
training, and awareness.

5
00:00:18,510 --> 00:00:21,030
The information security is absolutely

6
00:00:21,030 --> 00:00:23,640
a shared responsibility
throughout the enterprise.

7
00:00:23,640 --> 00:00:26,250
No one person is solely responsible

8
00:00:26,250 --> 00:00:28,200
for information security.

9
00:00:28,200 --> 00:00:30,180
That's a really important message

10
00:00:30,180 --> 00:00:33,213
to both take to heart and to communicate.

11
00:00:34,380 --> 00:00:35,670
Now, a critical component

12
00:00:35,670 --> 00:00:39,150
of a successful information
security program is knowledge

13
00:00:39,150 --> 00:00:40,440
and awareness.

14
00:00:40,440 --> 00:00:43,140
So ongoing education, training

15
00:00:43,140 --> 00:00:45,900
and awareness programs are essential.

16
00:00:45,900 --> 00:00:48,420
Now, our programs should
always be customized

17
00:00:48,420 --> 00:00:49,680
to our target audience

18
00:00:49,680 --> 00:00:52,980
because we want them to be
impactful and effective.

19
00:00:52,980 --> 00:00:56,760
And programs should be adaptable
to changing circumstances.

20
00:00:56,760 --> 00:00:59,550
Like in the pandemic, when
everybody went to remote work

21
00:00:59,550 --> 00:01:04,023
from home, we may have had to
pivot and adapt our program.

22
00:01:06,180 --> 00:01:09,270
So NIST, the National Institute
of Standards and Technology

23
00:01:09,270 --> 00:01:12,210
has a model called their SETA model,

24
00:01:12,210 --> 00:01:14,610
security, education,
training and awareness.

25
00:01:14,610 --> 00:01:15,990
And you can read more about it

26
00:01:15,990 --> 00:01:19,050
in special publication 800-50.

27
00:01:19,050 --> 00:01:20,310
This is a great model.

28
00:01:20,310 --> 00:01:22,410
And what it says is education,

29
00:01:22,410 --> 00:01:24,960
training and awareness
are all different things.

30
00:01:24,960 --> 00:01:26,610
And they have different audiences

31
00:01:26,610 --> 00:01:28,050
and they have different objectives

32
00:01:28,050 --> 00:01:30,657
and they have different ways
that we're going to present it.

33
00:01:30,657 --> 00:01:32,640
And they have different
ways we can measure it

34
00:01:32,640 --> 00:01:33,990
and different impact.

35
00:01:33,990 --> 00:01:36,420
And we really need to
be cognizant of that.

36
00:01:36,420 --> 00:01:39,060
Education is all about why.

37
00:01:39,060 --> 00:01:40,350
Why are we doing something?

38
00:01:40,350 --> 00:01:43,680
And really our objective is understanding.

39
00:01:43,680 --> 00:01:46,200
Now, the best method is for teaching

40
00:01:46,200 --> 00:01:49,020
is gonna be a discussion or a seminar

41
00:01:49,020 --> 00:01:52,380
or reading, particularly having
good pre-reading materials.

42
00:01:52,380 --> 00:01:54,750
If you're gonna measure
this, it would be essay.

43
00:01:54,750 --> 00:01:57,900
And the impact is generally long-term.

44
00:01:57,900 --> 00:02:00,030
So who is education
really appropriate for?

45
00:02:00,030 --> 00:02:02,160
Well, definitely for our
board of directors, our board

46
00:02:02,160 --> 00:02:05,010
of trustees, and our executive management

47
00:02:05,010 --> 00:02:07,980
who are making these
major decisions, right?

48
00:02:07,980 --> 00:02:11,190
These decisions on strategy and budget

49
00:02:11,190 --> 00:02:13,350
and the future of an organization.

50
00:02:13,350 --> 00:02:16,320
So it's important that they
have insight and understanding.

51
00:02:16,320 --> 00:02:19,110
You're probably not gonna test
them by giving them an essay

52
00:02:19,110 --> 00:02:21,360
but you know, do discussions, seminars,

53
00:02:21,360 --> 00:02:23,700
giving them reading
material that's gonna stick

54
00:02:23,700 --> 00:02:25,740
with them for the long term.

55
00:02:25,740 --> 00:02:26,760
The next is training

56
00:02:26,760 --> 00:02:28,710
which is really what you
and I have been doing.

57
00:02:28,710 --> 00:02:30,990
It's all about how do I do something

58
00:02:30,990 --> 00:02:34,920
and gaining knowledge
and acquiring a skill.

59
00:02:34,920 --> 00:02:37,860
Now the best teaching methods
are going to be a lecture,

60
00:02:37,860 --> 00:02:40,500
case study and hands-on.

61
00:02:40,500 --> 00:02:43,500
And the measure is gonna
be problem solving.

62
00:02:43,500 --> 00:02:45,780
Now, what's the impact timeframe?

63
00:02:45,780 --> 00:02:47,310
Well, intermediate, right?

64
00:02:47,310 --> 00:02:49,020
You'll remember this for quite a while

65
00:02:49,020 --> 00:02:51,750
but you may need to brush up
on it if you don't use it.

66
00:02:51,750 --> 00:02:53,790
And then last, we have awareness.

67
00:02:53,790 --> 00:02:55,620
Awareness is all about what, huh?

68
00:02:55,620 --> 00:02:56,670
What's going on?

69
00:02:56,670 --> 00:02:59,070
It's all about the
dissemination of information.

70
00:02:59,070 --> 00:03:03,420
And our objective is to
change people's behavior.

71
00:03:03,420 --> 00:03:05,130
Now, the best methods are

72
00:03:05,130 --> 00:03:08,610
for teaching are gonna be
very interactive and engaging.

73
00:03:08,610 --> 00:03:11,190
Videos, posters, games.

74
00:03:11,190 --> 00:03:13,200
And if you are going to need a measure

75
00:03:13,200 --> 00:03:17,220
you wanna test it out, true
and false or multiple choice.

76
00:03:17,220 --> 00:03:19,710
But here's the thing
about awareness programs.

77
00:03:19,710 --> 00:03:22,740
They're really short term,
like really short term.

78
00:03:22,740 --> 00:03:24,630
And I do wanna just
share one story with you

79
00:03:24,630 --> 00:03:27,453
to just emphasize how
short term they can be.

80
00:03:28,380 --> 00:03:29,430
Many, many years ago,

81
00:03:29,430 --> 00:03:32,550
I was at NSA offices in Herndon, Virginia.

82
00:03:32,550 --> 00:03:34,290
NSA is national security agency.

83
00:03:34,290 --> 00:03:36,510
So they're supposed to be
thinking about security

84
00:03:36,510 --> 00:03:37,343
all the time.

85
00:03:37,343 --> 00:03:39,900
And the part of the building I was in

86
00:03:39,900 --> 00:03:41,970
was had lots of locked doors.

87
00:03:41,970 --> 00:03:43,590
And so to get through a door,

88
00:03:43,590 --> 00:03:46,560
you either had to swipe
your badge or put in a code.

89
00:03:46,560 --> 00:03:49,260
And so when I would go,
like even to the restroom

90
00:03:49,260 --> 00:03:51,540
I'd have to go through like
three or four different doors.

91
00:03:51,540 --> 00:03:53,850
And here's what amazed me all the time.

92
00:03:53,850 --> 00:03:56,220
You'd go through a door
and in front of you

93
00:03:56,220 --> 00:03:58,620
when you came through
it, there would be a sign

94
00:03:58,620 --> 00:04:00,720
and the sign would say, one of two things.

95
00:04:00,720 --> 00:04:02,460
Did you hear the door click behind you?

96
00:04:02,460 --> 00:04:05,010
Or did anybody come in with you?

97
00:04:05,010 --> 00:04:07,050
Now I'm in this agency, right?

98
00:04:07,050 --> 00:04:08,430
That's all about security.

99
00:04:08,430 --> 00:04:09,510
That's what these people do.

100
00:04:09,510 --> 00:04:11,190
They live and breathe security

101
00:04:11,190 --> 00:04:13,470
and yet they may be moving quickly

102
00:04:13,470 --> 00:04:14,303
through the building, right?

103
00:04:14,303 --> 00:04:15,510
Thinking about their next meeting,

104
00:04:15,510 --> 00:04:17,010
thinking about their boss,
thinking about the fact

105
00:04:17,010 --> 00:04:18,630
that they're hungry and
they wanna have lunch.

106
00:04:18,630 --> 00:04:21,900
And so they still need to
be continually reminded

107
00:04:21,900 --> 00:04:22,860
of these things.

108
00:04:22,860 --> 00:04:24,810
And that has always really stuck with me.

109
00:04:24,810 --> 00:04:26,040
This idea

110
00:04:26,040 --> 00:04:29,310
that awareness programs are
never one and done, right?

111
00:04:29,310 --> 00:04:30,570
They're very short term.

112
00:04:30,570 --> 00:04:33,420
We need to be creative and
we need to keep doing them.

113
00:04:33,420 --> 00:04:34,830
And one of the ways they were creative

114
00:04:34,830 --> 00:04:36,540
is those signs kept moving around.

115
00:04:36,540 --> 00:04:38,940
So just when you knew, thought
you knew where a sign was

116
00:04:38,940 --> 00:04:40,560
you can come quickly through a door.

117
00:04:40,560 --> 00:04:42,560
Turns out you might even smack into one.

118
00:04:45,870 --> 00:04:46,703
Alright.

119
00:04:46,703 --> 00:04:50,430
So let's look at how we implement a set

120
00:04:50,430 --> 00:04:52,470
of program or how we might think about

121
00:04:52,470 --> 00:04:55,650
implementing a set of
program in our organization.

122
00:04:55,650 --> 00:04:58,410
Well, we start at kind of non-existent.

123
00:04:58,410 --> 00:05:00,360
It doesn't exist at all.

124
00:05:00,360 --> 00:05:01,193
Then what happens

125
00:05:01,193 --> 00:05:03,390
in a lot of organizations
is security, education

126
00:05:03,390 --> 00:05:05,700
training and awareness is kind of ad hoc.

127
00:05:05,700 --> 00:05:07,830
Oh, we need to do this.

128
00:05:07,830 --> 00:05:11,580
Oh, we just heard about another
company that had ransomware

129
00:05:11,580 --> 00:05:13,290
and we're nervous about it.

130
00:05:13,290 --> 00:05:14,610
Oh, something else happened

131
00:05:14,610 --> 00:05:16,500
that we decide we better do something.

132
00:05:16,500 --> 00:05:18,390
Or someone just joined our
organization, said, hey,

133
00:05:18,390 --> 00:05:19,410
how come we're not doing this?

134
00:05:19,410 --> 00:05:20,243
We should.

135
00:05:20,243 --> 00:05:23,070
So it gets done, but
not in any planned way

136
00:05:23,070 --> 00:05:24,843
kind of really ad hoc.

137
00:05:25,860 --> 00:05:29,310
The next level of maturity
is compliance driven, right?

138
00:05:29,310 --> 00:05:32,010
We're doing training on
a regular basis, right?

139
00:05:32,010 --> 00:05:34,830
Education, training, and
awareness on a regular basis

140
00:05:34,830 --> 00:05:37,623
but only because we have
a compliance requirement.

141
00:05:38,850 --> 00:05:40,710
From there, we move into more

142
00:05:40,710 --> 00:05:42,630
of an integrated model
where we say, you know what?

143
00:05:42,630 --> 00:05:45,120
We recognize that security, education,

144
00:05:45,120 --> 00:05:48,090
training and awareness is
really, really important.

145
00:05:48,090 --> 00:05:49,950
And so it becomes integrated

146
00:05:49,950 --> 00:05:53,430
into our DNA and that we take it seriously

147
00:05:53,430 --> 00:05:55,500
and we're really doing it continually.

148
00:05:55,500 --> 00:05:56,550
We invest in it

149
00:05:56,550 --> 00:06:00,390
and we look to have really
good, strong programs.

150
00:06:00,390 --> 00:06:02,910
And then the top of our
maturity model would be

151
00:06:02,910 --> 00:06:05,160
that it's measurable and reportable.

152
00:06:05,160 --> 00:06:07,170
Meaning that it's metrics driven.

153
00:06:07,170 --> 00:06:09,330
That not only are we doing it

154
00:06:09,330 --> 00:06:11,580
but we're following up, is it effective?

155
00:06:11,580 --> 00:06:12,840
Is it working?

156
00:06:12,840 --> 00:06:14,910
So not just, oh, did
you like your training?

157
00:06:14,910 --> 00:06:17,220
But really watching behaviors

158
00:06:17,220 --> 00:06:20,460
after the training to make
sure that it is effective.

159
00:06:20,460 --> 00:06:23,820
So it's measurable and
reportable, metrics driven.

160
00:06:23,820 --> 00:06:26,400
I wanna talk about two components

161
00:06:26,400 --> 00:06:31,170
of the SETA model, specifically
education and awareness.

162
00:06:31,170 --> 00:06:34,770
And let's focus first
on executive education.

163
00:06:34,770 --> 00:06:38,280
Now, I have to tell you that
when I talk to executives

164
00:06:38,280 --> 00:06:39,840
when I'm educating executives

165
00:06:39,840 --> 00:06:42,000
I never use the word education.

166
00:06:42,000 --> 00:06:45,330
I always use the word briefing, right?

167
00:06:45,330 --> 00:06:46,163
Why?

168
00:06:46,163 --> 00:06:47,580
Because educating somebody

169
00:06:47,580 --> 00:06:50,040
or teaching someone
always kind of sounds like

170
00:06:50,040 --> 00:06:51,540
I know something you don't.

171
00:06:51,540 --> 00:06:53,580
And executives don't really like that.

172
00:06:53,580 --> 00:06:56,850
But when I brief them, it
really makes 'em sound like

173
00:06:56,850 --> 00:06:58,890
I have information that I know you want

174
00:06:58,890 --> 00:07:01,830
that I'm sharing with
you under your direction.

175
00:07:01,830 --> 00:07:02,850
The president of the United States

176
00:07:02,850 --> 00:07:05,310
doesn't get educated each morning, right?

177
00:07:05,310 --> 00:07:06,723
He or she gets briefed.

178
00:07:07,680 --> 00:07:10,140
The briefing objective is insight

179
00:07:10,140 --> 00:07:12,573
and understanding for the long term.

180
00:07:14,280 --> 00:07:16,920
So when you are briefing your executives

181
00:07:16,920 --> 00:07:19,680
and I hope that you have the
opportunity to do so, make sure

182
00:07:19,680 --> 00:07:22,860
that you know your audience's
presentation preferences.

183
00:07:22,860 --> 00:07:25,320
If they like PowerPoint,
go with PowerPoint.

184
00:07:25,320 --> 00:07:27,360
If they hate PowerPoint,
and they would rather

185
00:07:27,360 --> 00:07:30,450
just have a discussion,
have a discussion, right?

186
00:07:30,450 --> 00:07:32,940
If they would like to have
the whole presentation ahead

187
00:07:32,940 --> 00:07:35,760
of time so they can
study it, then do that.

188
00:07:35,760 --> 00:07:37,980
But find out what your audience,

189
00:07:37,980 --> 00:07:41,610
their presentation preferences
are and honor them.

190
00:07:41,610 --> 00:07:44,370
I always suggest that you
provide a discussion framework

191
00:07:44,370 --> 00:07:46,170
and pre-reading materials.

192
00:07:46,170 --> 00:07:48,780
And those pre-reading
materials should be sources

193
00:07:48,780 --> 00:07:51,210
that they respect.

194
00:07:51,210 --> 00:07:54,210
Maybe the Wall Street
Journal or maybe the NACD,

195
00:07:54,210 --> 00:07:56,970
the National Association
of Corporate Directors.

196
00:07:56,970 --> 00:08:00,090
And then you wanna be specific
to institutional goals.

197
00:08:00,090 --> 00:08:02,700
And that includes regulatory requirements.

198
00:08:02,700 --> 00:08:04,260
Like why do we need to do

199
00:08:04,260 --> 00:08:05,760
whatever it is we're talking about?

200
00:08:05,760 --> 00:08:08,130
And always feel comfortable putting in

201
00:08:08,130 --> 00:08:10,170
those regulatory requirements.

202
00:08:10,170 --> 00:08:11,880
Do not use geek speak, right?

203
00:08:11,880 --> 00:08:13,080
Do not use any words.

204
00:08:13,080 --> 00:08:14,790
They're not gonna understand.

205
00:08:14,790 --> 00:08:18,570
Just use business language and recognize

206
00:08:18,570 --> 00:08:21,690
that whether you're talking
to the executive, the C-suite,

207
00:08:21,690 --> 00:08:25,140
your CEO, your CFO, your CEO, your COO

208
00:08:25,140 --> 00:08:28,050
or your board of directors
or your board of trustees

209
00:08:28,050 --> 00:08:29,940
that their time is limited.

210
00:08:29,940 --> 00:08:32,730
You may want an hour to
explain a topic to them.

211
00:08:32,730 --> 00:08:35,880
There's a better chance you're
gonna get 10 or 15 minutes.

212
00:08:35,880 --> 00:08:37,140
And also recognize

213
00:08:37,140 --> 00:08:40,140
that their technical
expertise may be minimal.

214
00:08:40,140 --> 00:08:42,480
So you never want them to be uncomfortable

215
00:08:42,480 --> 00:08:45,090
because you're talking about
something technical and geeky

216
00:08:45,090 --> 00:08:45,923
and they're like

217
00:08:45,923 --> 00:08:47,220
I don't even know what
they're talking about.

218
00:08:47,220 --> 00:08:49,500
That's not a good place to be.

219
00:08:49,500 --> 00:08:50,940
And then I would always suggest

220
00:08:50,940 --> 00:08:53,340
that you cover a limited number of topics.

221
00:08:53,340 --> 00:08:55,020
You may have 10 things
you wanna talk about,

222
00:08:55,020 --> 00:08:58,260
but if you try to talk about
10 things in 15 minutes

223
00:08:58,260 --> 00:08:59,790
none of them is gonna stick.

224
00:08:59,790 --> 00:09:01,230
So stay focused.

225
00:09:01,230 --> 00:09:02,760
Get your top two or three

226
00:09:02,760 --> 00:09:05,560
and that's what you're gonna
brief them on at that time.

227
00:09:07,800 --> 00:09:10,620
Now, security awareness
programs should be inclusive

228
00:09:10,620 --> 00:09:12,810
of all levels of our organization

229
00:09:12,810 --> 00:09:16,230
and extend to our consultants
and our contractors

230
00:09:16,230 --> 00:09:17,063
because the objective

231
00:09:17,063 --> 00:09:21,300
of security awareness programs
is to influence behavior.

232
00:09:21,300 --> 00:09:22,410
Now, our onboarding

233
00:09:22,410 --> 00:09:25,140
and our post boarding program
should focus on policies.

234
00:09:25,140 --> 00:09:27,660
For example, our acceptable use policy,

235
00:09:27,660 --> 00:09:30,720
best practices, social engineering,

236
00:09:30,720 --> 00:09:34,140
duress and reporting suspicious activity.

237
00:09:34,140 --> 00:09:37,560
Then we'll supplement that
with perhaps annual compliance

238
00:09:37,560 --> 00:09:40,680
or hot topic or refresher programs.

239
00:09:40,680 --> 00:09:44,220
And those could be instructor
led or recorded or online.

240
00:09:44,220 --> 00:09:45,570
And then we wanna make sure

241
00:09:45,570 --> 00:09:47,910
that we have an ongoing awareness program

242
00:09:47,910 --> 00:09:52,050
which includes posters and
games and contests and prizes.

243
00:09:52,050 --> 00:09:54,510
Everybody loves prizes, right?

244
00:09:54,510 --> 00:09:55,380
And surveys.

245
00:09:55,380 --> 00:09:56,490
We wanna get feedback.

246
00:09:56,490 --> 00:09:57,630
How are we doing?

247
00:09:57,630 --> 00:10:00,960
And as needed, situational
awareness communications.

248
00:10:00,960 --> 00:10:02,100
So let's say there's been

249
00:10:02,100 --> 00:10:05,160
a social engineering
attack in your organization

250
00:10:05,160 --> 00:10:08,580
or a phishing email people
started responding to.

251
00:10:08,580 --> 00:10:11,580
Well, that's a situation it'd
be great if people knew about.

252
00:10:11,580 --> 00:10:14,220
So take something that's
actually happening

253
00:10:14,220 --> 00:10:15,840
and use that right?

254
00:10:15,840 --> 00:10:18,633
Do situational awareness communications.

255
00:10:20,460 --> 00:10:23,220
Very successful security
awareness programs

256
00:10:23,220 --> 00:10:25,470
will incorporate a variety of tools,

257
00:10:25,470 --> 00:10:29,010
including newsletters, posters, games,

258
00:10:29,010 --> 00:10:34,010
newsfeeds, blogs, phishing
simulations, and competitions.

259
00:10:35,760 --> 00:10:38,460
And you wanna diversify
your material to appeal

260
00:10:38,460 --> 00:10:41,610
to as many users as possible.

261
00:10:41,610 --> 00:10:44,220
Two keys to success, interaction,

262
00:10:44,220 --> 00:10:45,660
and personalization, right?

263
00:10:45,660 --> 00:10:46,890
You don't want them
just sitting back going,

264
00:10:46,890 --> 00:10:48,480
oh, I don't know what
they're talking about.

265
00:10:48,480 --> 00:10:50,190
Why does that affect me?

266
00:10:50,190 --> 00:10:51,450
And you want it really personal.

267
00:10:51,450 --> 00:10:53,730
So get 'em involved, right?

268
00:10:53,730 --> 00:10:55,890
And make them active.

269
00:10:55,890 --> 00:11:00,150
Group competition is an
absolute proven motivator.

270
00:11:00,150 --> 00:11:04,833
And as I said, everybody
loves recognition and prizes.

271
00:11:07,410 --> 00:11:11,133
So let me share with you the
secrets of impactful training.

272
00:11:12,840 --> 00:11:15,300
Invite everyone, it's really important.

273
00:11:15,300 --> 00:11:16,500
Training shouldn't just be

274
00:11:16,500 --> 00:11:19,770
for the frontline or for, you know,

275
00:11:19,770 --> 00:11:22,620
the people who are just doing
all the day-to-day work.

276
00:11:22,620 --> 00:11:24,060
The operations folks.

277
00:11:24,060 --> 00:11:25,590
Invite everybody, right?

278
00:11:25,590 --> 00:11:29,970
Everybody from you know, all
across all business units.

279
00:11:29,970 --> 00:11:33,000
You know, from place A all the way up

280
00:11:33,000 --> 00:11:34,350
to your board of directors.

281
00:11:34,350 --> 00:11:36,003
So invite everyone.

282
00:11:37,380 --> 00:11:39,180
You wanna create a really comfortable

283
00:11:39,180 --> 00:11:40,770
and welcoming environment.

284
00:11:40,770 --> 00:11:42,930
So greet people when they come in.

285
00:11:42,930 --> 00:11:43,763
You wanna make sure

286
00:11:43,763 --> 00:11:45,990
that maybe you have
very comfortable chairs.

287
00:11:45,990 --> 00:11:47,670
Make sure the temperature is right.

288
00:11:47,670 --> 00:11:50,190
Make sure that you have
some food and drink.

289
00:11:50,190 --> 00:11:51,603
Everybody loves snacks.

290
00:11:52,740 --> 00:11:53,970
Start on time.

291
00:11:53,970 --> 00:11:55,350
That's really important.

292
00:11:55,350 --> 00:11:58,320
When you're doing training, start on time.

293
00:11:58,320 --> 00:12:00,360
Do not punish people for being on time

294
00:12:00,360 --> 00:12:03,300
by making them sit there
and wait for the stragglers.

295
00:12:03,300 --> 00:12:05,670
Start your training on
time, just a couple of times

296
00:12:05,670 --> 00:12:08,880
and everybody will get
there on time in the future.

297
00:12:08,880 --> 00:12:11,220
Begin with an unexpected opening line

298
00:12:11,220 --> 00:12:12,480
'cause nobody's really excited

299
00:12:12,480 --> 00:12:15,090
about being at your
security awareness training.

300
00:12:15,090 --> 00:12:16,200
So punch it out.

301
00:12:16,200 --> 00:12:19,140
Begin with a really
unexpected opening line.

302
00:12:19,140 --> 00:12:20,970
Get their attention.

303
00:12:20,970 --> 00:12:22,830
And then engage your audience

304
00:12:22,830 --> 00:12:25,770
through interactive activities, games.

305
00:12:25,770 --> 00:12:27,420
My personal favorite is songs.

306
00:12:27,420 --> 00:12:30,750
I write songs all the time to known tunes

307
00:12:30,750 --> 00:12:33,210
like Frere Jacques and
Row, Row, Row Your Boat.

308
00:12:33,210 --> 00:12:35,823
And I make my audiences sing those songs.

309
00:12:37,380 --> 00:12:39,750
Be concise, don't wander, right?

310
00:12:39,750 --> 00:12:41,133
Stay on topic.

311
00:12:42,210 --> 00:12:45,420
And then really reinforce the idea

312
00:12:45,420 --> 00:12:48,270
that we need to get
everyone to work together.

313
00:12:48,270 --> 00:12:52,080
We wanna get everyone to
believe in a shared outcome.

314
00:12:52,080 --> 00:12:52,920
Why?

315
00:12:52,920 --> 00:12:57,420
Because information security
is a shared responsibility.

316
00:12:57,420 --> 00:13:00,690
And have them share that
outside of your organization.

317
00:13:00,690 --> 00:13:02,850
Encourage them to take
what they've learned

318
00:13:02,850 --> 00:13:06,120
and tell their family members
to tell their friends,

319
00:13:06,120 --> 00:13:07,470
tell their neighbors.

320
00:13:07,470 --> 00:13:10,410
Because not only do we wanna
be securing our companies

321
00:13:10,410 --> 00:13:13,380
but we also wanna be
securing our communities

322
00:13:13,380 --> 00:13:14,643
and our country.

323
00:13:16,350 --> 00:13:19,260
That my friends, brings us
to a three second challenge.

324
00:13:19,260 --> 00:13:21,120
This is our last three second challenge

325
00:13:21,120 --> 00:13:22,470
that we're gonna do together.

326
00:13:22,470 --> 00:13:24,783
Five challenge questions,
three seconds each.

327
00:13:25,920 --> 00:13:28,980
The attribute is how,
the objective is skill.

328
00:13:28,980 --> 00:13:30,000
What is that?

329
00:13:30,000 --> 00:13:31,143
1, 2, 3.

330
00:13:32,190 --> 00:13:33,123
That's training.

331
00:13:35,100 --> 00:13:38,040
Timeframe impact of an awareness program.

332
00:13:38,040 --> 00:13:39,183
1, 2, 3.

333
00:13:40,410 --> 00:13:42,420
That's short-term.

334
00:13:42,420 --> 00:13:46,200
Number three, maturity level
where training is provided

335
00:13:46,200 --> 00:13:47,973
on an as-needed basis.

336
00:13:48,870 --> 00:13:50,853
1, 2, 3.

337
00:13:52,470 --> 00:13:53,583
That's ad hoc.

338
00:13:54,540 --> 00:13:55,373
Alright.

339
00:13:55,373 --> 00:13:57,810
Number four, a policy
that should be introduced

340
00:13:57,810 --> 00:13:59,460
during the onboarding period.

341
00:13:59,460 --> 00:14:02,130
Reach back a couple of
lessons for this one.

342
00:14:02,130 --> 00:14:03,363
1, 2, 3.

343
00:14:04,620 --> 00:14:06,840
That's an acceptable use policy.

344
00:14:06,840 --> 00:14:08,550
And lastly, number five,

345
00:14:08,550 --> 00:14:11,340
who's responsible for
information security?

346
00:14:11,340 --> 00:14:13,200
Oh, everybody's gonna get this answer.

347
00:14:13,200 --> 00:14:14,520
I know.

348
00:14:14,520 --> 00:14:15,600
Oh, I just gave you a hint.

349
00:14:15,600 --> 00:14:17,190
1, 2, 3.

350
00:14:17,190 --> 00:14:18,180
Everyone.

351
00:14:18,180 --> 00:14:19,013
Awesome.

352
00:14:19,013 --> 00:14:21,360
Alright, let's do our
last security-in-action

353
00:14:21,360 --> 00:14:22,830
case study together.

354
00:14:22,830 --> 00:14:25,030
This one's about training
and participation.

355
00:14:25,920 --> 00:14:26,880
Your organization

356
00:14:26,880 --> 00:14:29,490
had its first social
engineering assessment,

357
00:14:29,490 --> 00:14:31,620
and the results were not good.

358
00:14:31,620 --> 00:14:33,150
The tester was able to obtain

359
00:14:33,150 --> 00:14:35,520
legally protected customer information,

360
00:14:35,520 --> 00:14:37,290
change customer records

361
00:14:37,290 --> 00:14:40,680
even have a refund check
set to a new address.

362
00:14:40,680 --> 00:14:44,100
So you have been asked to
design a training session.

363
00:14:44,100 --> 00:14:46,920
Now the question is, who should attend?

364
00:14:46,920 --> 00:14:49,230
Just those who responded in error,

365
00:14:49,230 --> 00:14:53,160
specific departments or all employees?

366
00:14:53,160 --> 00:14:54,960
The senior management has recommended

367
00:14:54,960 --> 00:14:57,870
that only the relevant departments attend.

368
00:14:57,870 --> 00:14:59,280
Do you agree?

369
00:14:59,280 --> 00:15:00,930
So a quick little recap here.

370
00:15:00,930 --> 00:15:03,690
We had our very first social
engineering simulation

371
00:15:03,690 --> 00:15:05,490
which are very, very important to do.

372
00:15:05,490 --> 00:15:08,580
I'm glad that it was done,
but the results were not good.

373
00:15:08,580 --> 00:15:09,990
Well, we're not happy about that.

374
00:15:09,990 --> 00:15:10,823
But you know what?

375
00:15:10,823 --> 00:15:12,540
It's a learning experience.

376
00:15:12,540 --> 00:15:13,950
The tester was able to obtain

377
00:15:13,950 --> 00:15:15,570
legally protected customer information,

378
00:15:15,570 --> 00:15:16,920
change a customer record,

379
00:15:16,920 --> 00:15:18,900
even have a refund check sent.

380
00:15:18,900 --> 00:15:21,120
But part of, you know, what we're gonna do

381
00:15:21,120 --> 00:15:23,340
before we do that social
engineering assessment

382
00:15:23,340 --> 00:15:25,440
or simulation, is we're gonna have a rules

383
00:15:25,440 --> 00:15:28,170
of engagement document that's
gonna talk about, okay,

384
00:15:28,170 --> 00:15:30,780
if you're able to get
legally customer, you know,

385
00:15:30,780 --> 00:15:32,040
protected customer information

386
00:15:32,040 --> 00:15:35,730
or do any other activity, you
know, here is the process.

387
00:15:35,730 --> 00:15:36,870
Here's who you have to notify,

388
00:15:36,870 --> 00:15:39,660
here's how you have to handle that data.

389
00:15:39,660 --> 00:15:41,013
So all of this went on.

390
00:15:41,970 --> 00:15:43,470
Management's pretty concerned

391
00:15:43,470 --> 00:15:45,480
as they should be, and
they've said, listen,

392
00:15:45,480 --> 00:15:49,110
can you design a training session
so we can learn from this?

393
00:15:49,110 --> 00:15:51,450
But the big question is,
who's going to attend?

394
00:15:51,450 --> 00:15:55,450
Just those who responded in
error, specific employees

395
00:15:56,490 --> 00:15:59,820
or specific departments or everybody?

396
00:15:59,820 --> 00:16:01,680
So just those who responded

397
00:16:01,680 --> 00:16:05,160
in error, specific
departments or all employees.

398
00:16:05,160 --> 00:16:06,570
Senior management has said

399
00:16:06,570 --> 00:16:08,700
I think only relevant departments,

400
00:16:08,700 --> 00:16:10,260
we don't need to go to that.

401
00:16:10,260 --> 00:16:11,370
Do you agree?

402
00:16:11,370 --> 00:16:12,900
Go ahead and put me on pause.

403
00:16:12,900 --> 00:16:15,850
Write down some notes for who
you think should participate.

404
00:16:18,390 --> 00:16:21,660
Well, this is a great opportunity
to reach all employees

405
00:16:21,660 --> 00:16:23,340
with a really relatable scenario

406
00:16:23,340 --> 00:16:26,373
because it's something that
happened in their organization.

407
00:16:27,630 --> 00:16:29,040
So, weave the results

408
00:16:29,040 --> 00:16:32,460
of that assessment or
simulation into the training.

409
00:16:32,460 --> 00:16:34,920
Now with a caveat that no employee

410
00:16:34,920 --> 00:16:37,050
should ever be singled out or embarrassed.

411
00:16:37,050 --> 00:16:37,883
We don't ever wanna say,

412
00:16:37,883 --> 00:16:40,080
well, Jane did this and Joe did that.

413
00:16:40,080 --> 00:16:41,070
We don't wanna do that, right?

414
00:16:41,070 --> 00:16:43,680
So we wanna do it in such
a way that, you know,

415
00:16:43,680 --> 00:16:45,783
we're not tattling on anybody.

416
00:16:47,490 --> 00:16:50,490
Now, only use names when
there's praise to be given.

417
00:16:50,490 --> 00:16:54,600
So when someone did something
great, use their name, right?

418
00:16:54,600 --> 00:16:56,340
If they didn't do something great

419
00:16:56,340 --> 00:16:58,263
we're not going to use their names.

420
00:16:59,250 --> 00:17:03,240
You can utilize recording
transcripts to make it real.

421
00:17:03,240 --> 00:17:04,380
You know, one of the problems is

422
00:17:04,380 --> 00:17:06,540
if there is a recording and
you use the actual recording

423
00:17:06,540 --> 00:17:08,040
people will recognize the voice.

424
00:17:08,040 --> 00:17:10,170
Now, you could use the voice, again,

425
00:17:10,170 --> 00:17:11,460
when it's something good,

426
00:17:11,460 --> 00:17:12,630
when there's praise to be given

427
00:17:12,630 --> 00:17:14,880
like this was the right way to do it.

428
00:17:14,880 --> 00:17:16,980
But again, we don't want
to embarrass anybody.

429
00:17:16,980 --> 00:17:20,100
So you may wanna use
written transcripts instead

430
00:17:20,100 --> 00:17:22,980
of audio transcripts for
things that went wrong.

431
00:17:22,980 --> 00:17:25,110
Showing a picture of
how that social engineer

432
00:17:25,110 --> 00:17:27,690
was dressed to make it real, right?

433
00:17:27,690 --> 00:17:29,790
Did they come in dressed as a UPS driver?

434
00:17:29,790 --> 00:17:32,220
Did they come in, you
know, as electrician?

435
00:17:32,220 --> 00:17:34,950
Did they come in to
measure for new blinds?

436
00:17:34,950 --> 00:17:35,783
How were they dressed?

437
00:17:35,783 --> 00:17:37,050
What were they wearing?

438
00:17:37,050 --> 00:17:39,810
You know, did they have
a cap and a jacket on?

439
00:17:39,810 --> 00:17:41,940
Did they have a clipboard or a work order?

440
00:17:41,940 --> 00:17:45,180
Show all those things
to really bring it home.

441
00:17:45,180 --> 00:17:47,583
You know, just what social engineers do.

442
00:17:48,570 --> 00:17:50,130
And then be positive.

443
00:17:50,130 --> 00:17:52,440
Be positive, not punitive, right?

444
00:17:52,440 --> 00:17:53,970
This is what we've learned.

445
00:17:53,970 --> 00:17:55,950
And now here are updated procedures.

446
00:17:55,950 --> 00:17:57,990
This is how we're gonna
handle things in the future.

447
00:17:57,990 --> 00:17:59,610
Because we've learned, right?

448
00:17:59,610 --> 00:18:01,260
That if our results were not good,

449
00:18:01,260 --> 00:18:04,260
well, we probably didn't have
the right procedures in place.

450
00:18:04,260 --> 00:18:05,730
So we've updated our procedures

451
00:18:05,730 --> 00:18:07,410
we're sharing those with you now.

452
00:18:07,410 --> 00:18:09,030
We don't wanna punish anyone.

453
00:18:09,030 --> 00:18:10,623
We want improvement.

454
00:18:12,030 --> 00:18:13,800
And then we're gonna stress

455
00:18:13,800 --> 00:18:16,110
that we are all in this together.

456
00:18:16,110 --> 00:18:18,570
And even though we might not
have been the one who fell

457
00:18:18,570 --> 00:18:22,170
for the social engineer,
someday, it could be us.

458
00:18:22,170 --> 00:18:24,360
So we're not pointing fingers.

459
00:18:24,360 --> 00:18:26,400
We're in this all together.

460
00:18:26,400 --> 00:18:29,460
And we're really looking
for continuous improvement

461
00:18:29,460 --> 00:18:32,040
to continue to protect our organizations

462
00:18:32,040 --> 00:18:32,970
and our stakeholders,

463
00:18:32,970 --> 00:18:35,970
our employees, our customers, everybody.

464
00:18:35,970 --> 00:18:38,523
Because security is a
shared responsibility.

465
00:18:39,450 --> 00:18:43,740
That, my friends, brings us
to our very last word cloud.

466
00:18:43,740 --> 00:18:45,090
You know what to do.

467
00:18:45,090 --> 00:18:47,010
Make sure that you understand all this.

468
00:18:47,010 --> 00:18:49,410
You can speak to it
comfortably and confidently

469
00:18:49,410 --> 00:18:52,260
and that you can deliver
impactful training.

470
00:18:52,260 --> 00:18:54,513
And now let's go do our last quiz.