1
00:00:06,600 --> 00:00:09,360
- Welcome to lesson 28, Deep Dive Quiz.

2
00:00:09,360 --> 00:00:11,430
This is our last quiz together.

3
00:00:11,430 --> 00:00:14,460
Now, lesson 28 was about given a scenario,

4
00:00:14,460 --> 00:00:17,790
implement security awareness practices.

5
00:00:17,790 --> 00:00:20,040
And we had one lesson 28.1

6
00:00:20,040 --> 00:00:24,600
where we focused on education,
training, and awareness.

7
00:00:24,600 --> 00:00:26,403
So let's do five questions together.

8
00:00:27,300 --> 00:00:28,230
You know how to do this,

9
00:00:28,230 --> 00:00:30,480
but I'm gonna give you one last reminder,

10
00:00:30,480 --> 00:00:33,300
pen or pencil, paper at the ready,

11
00:00:33,300 --> 00:00:35,750
and then put me on pause
as often as you need to.

12
00:00:38,070 --> 00:00:40,500
All right, let's get started.

13
00:00:40,500 --> 00:00:41,610
All right, question one,

14
00:00:41,610 --> 00:00:42,900
we're gonna complete the sentence

15
00:00:42,900 --> 00:00:45,030
by dragging and dropping the words.

16
00:00:45,030 --> 00:00:48,240
In the SETA model, education
is all about blank,

17
00:00:48,240 --> 00:00:50,910
and the best teaching method is blank.

18
00:00:50,910 --> 00:00:52,950
Training focuses on blank,

19
00:00:52,950 --> 00:00:56,250
and the best assessment method is blank.

20
00:00:56,250 --> 00:00:59,190
And awareness is sharing of blank

21
00:00:59,190 --> 00:01:01,890
with the objective of influencing blank.

22
00:01:01,890 --> 00:01:03,630
That's a lot of blanks, isn't it?

23
00:01:03,630 --> 00:01:06,090
And our words are information, behavior,

24
00:01:06,090 --> 00:01:09,330
short-term, skills development, insight

25
00:01:09,330 --> 00:01:13,440
intermediate, problem
solving, and discussion.

26
00:01:13,440 --> 00:01:14,490
Go ahead and put me on pause

27
00:01:14,490 --> 00:01:16,590
while you work on filling in those blanks.

28
00:01:17,820 --> 00:01:19,320
Right, in SETA model,

29
00:01:19,320 --> 00:01:22,800
education is gonna be all about insight,

30
00:01:22,800 --> 00:01:25,890
and the best teaching method
of our choices given here

31
00:01:25,890 --> 00:01:28,203
is going to be discussion.

32
00:01:29,340 --> 00:01:32,580
Training focuses on skills development,

33
00:01:32,580 --> 00:01:34,290
it's what you and I have been doing.

34
00:01:34,290 --> 00:01:36,630
And the best assessment method

35
00:01:36,630 --> 00:01:39,900
is going to be problem solving.

36
00:01:39,900 --> 00:01:44,900
And lastly, awareness is
the sharing of information

37
00:01:45,390 --> 00:01:49,890
with the objective of
influencing behavior.

38
00:01:49,890 --> 00:01:52,110
All right, let's read the whole
thing and see if we agree.

39
00:01:52,110 --> 00:01:54,720
In the SETA model,
education is about insight,

40
00:01:54,720 --> 00:01:57,180
and the best teaching
method is discussion.

41
00:01:57,180 --> 00:01:59,400
Training focuses on skills development,

42
00:01:59,400 --> 00:02:02,430
and the best assessment
method is problem solving.

43
00:02:02,430 --> 00:02:04,800
And awareness is the
sharing of information

44
00:02:04,800 --> 00:02:07,650
with the objective of
influencing behavior.

45
00:02:07,650 --> 00:02:08,550
Do you agree?

46
00:02:08,550 --> 00:02:09,843
All right, let's check.

47
00:02:11,040 --> 00:02:13,320
And we are correct, awesome.

48
00:02:13,320 --> 00:02:14,820
All right, question two.

49
00:02:14,820 --> 00:02:17,070
Which technique is not appropriate

50
00:02:17,070 --> 00:02:18,770
for a board of directors briefing?

51
00:02:19,740 --> 00:02:23,460
Use business language, reference
compliance requirements,

52
00:02:23,460 --> 00:02:25,620
cover a wide range of topics,

53
00:02:25,620 --> 00:02:27,903
or provide pre-reading materials.

54
00:02:28,980 --> 00:02:31,290
So which technique
would not be appropriate

55
00:02:31,290 --> 00:02:32,850
for a board of directors briefing,

56
00:02:32,850 --> 00:02:34,653
or for executive management?

57
00:02:35,790 --> 00:02:37,090
What are you gonna choose?

58
00:02:38,880 --> 00:02:41,370
Well, we do wanna use business language,

59
00:02:41,370 --> 00:02:42,990
so that would be appropriate.

60
00:02:42,990 --> 00:02:45,660
We really should reference
compliance requirements,

61
00:02:45,660 --> 00:02:47,520
so that would be appropriate.

62
00:02:47,520 --> 00:02:49,320
They love having pre-reading materials

63
00:02:49,320 --> 00:02:52,590
so they come prepared,
so that's appropriate.

64
00:02:52,590 --> 00:02:53,730
How about this one?

65
00:02:53,730 --> 00:02:54,690
We don't wanna mean meander,

66
00:02:54,690 --> 00:02:56,820
we don't wanna cover a
wide range of topics.

67
00:02:56,820 --> 00:02:59,100
We'll probably only have
a short period of time,

68
00:02:59,100 --> 00:03:01,620
we wanna be concise,
we wanna stay focused,

69
00:03:01,620 --> 00:03:03,570
and only cover a couple of topics.

70
00:03:03,570 --> 00:03:08,190
What we really, really need
to be sharing with them.

71
00:03:08,190 --> 00:03:09,023
Do you agree?

72
00:03:09,023 --> 00:03:10,290
All right, let's check.

73
00:03:10,290 --> 00:03:11,970
And that's correct.

74
00:03:11,970 --> 00:03:13,270
All right, question three.

75
00:03:14,370 --> 00:03:16,320
The best way to build management support

76
00:03:16,320 --> 00:03:20,370
for social engineering
training and simulations is to,

77
00:03:20,370 --> 00:03:23,160
share anecdotal stories,

78
00:03:23,160 --> 00:03:25,800
require that they go to training,

79
00:03:25,800 --> 00:03:28,680
quantify the value to the organization,

80
00:03:28,680 --> 00:03:30,990
or provide industry statistics.

81
00:03:30,990 --> 00:03:32,700
So we're trying to
build management support

82
00:03:32,700 --> 00:03:35,580
to have social engineering
training and simulations.

83
00:03:35,580 --> 00:03:38,227
We tell stories about, "Oh,
this happened at this place,

84
00:03:38,227 --> 00:03:39,870
"and this happened at that place."

85
00:03:39,870 --> 00:03:42,060
Or say, "Well, you're gonna have to go."

86
00:03:42,060 --> 00:03:45,030
Or provide industry
statistics about, you know,

87
00:03:45,030 --> 00:03:48,810
how other industries or other
companies in our industry

88
00:03:48,810 --> 00:03:51,363
have been perhaps social engineered,

89
00:03:52,290 --> 00:03:55,383
or do we quantify the
value to the organization?

90
00:03:56,280 --> 00:03:57,360
What do you think?

91
00:03:57,360 --> 00:04:00,210
Put me on pause if you
wanna think about it.

92
00:04:00,210 --> 00:04:03,180
Well, whenever we're trying
to build management support,

93
00:04:03,180 --> 00:04:05,640
could be for social engineering
training and simulation,

94
00:04:05,640 --> 00:04:07,710
really could be for almost anything,

95
00:04:07,710 --> 00:04:12,030
we always wanna quantify the
value to the organization.

96
00:04:12,030 --> 00:04:14,100
Agree, all right.

97
00:04:14,100 --> 00:04:15,333
And that's correct.

98
00:04:16,830 --> 00:04:17,970
All right, question four,

99
00:04:17,970 --> 00:04:20,460
we are going to order
the set of maturity model

100
00:04:20,460 --> 00:04:25,020
from the lowest number one,
to the highest number five.

101
00:04:25,020 --> 00:04:28,170
So we've got measurable
and reportable, integrated,

102
00:04:28,170 --> 00:04:31,833
compliance driven,
non-existent, or ad hoc.

103
00:04:33,540 --> 00:04:36,490
Go ahead and put me on pause
so you can put these in order.

104
00:04:38,010 --> 00:04:39,150
All right, well, I'm gonna start

105
00:04:39,150 --> 00:04:41,970
with the lowest and
number one, non-existent.

106
00:04:41,970 --> 00:04:44,040
We don't have a security
education training

107
00:04:44,040 --> 00:04:45,303
and awareness program.

108
00:04:46,500 --> 00:04:48,930
Next would probably be ad hoc,

109
00:04:48,930 --> 00:04:51,570
we do it when we need it, we
do what we think we should.

110
00:04:51,570 --> 00:04:54,150
Maybe it's in response to an attack,

111
00:04:54,150 --> 00:04:59,150
maybe it's a response to
a regulatory exam comment.

112
00:05:01,470 --> 00:05:03,240
All right, well, what do we do after that?

113
00:05:03,240 --> 00:05:06,660
Well, it becomes compliance-driven,

114
00:05:06,660 --> 00:05:08,910
that the only reason
we're doing it, right?

115
00:05:08,910 --> 00:05:10,740
Might be, we're doing
it on a regular basis,

116
00:05:10,740 --> 00:05:12,480
but the only reason we're doing it

117
00:05:12,480 --> 00:05:14,310
is because we have a
compliance requirement.

118
00:05:14,310 --> 00:05:15,840
If we didn't have the
compliance requirement,

119
00:05:15,840 --> 00:05:17,740
forget about it, we would never do it.

120
00:05:19,020 --> 00:05:20,580
Next it becomes integrated,

121
00:05:20,580 --> 00:05:22,650
it becomes part and parcel
of our organization,

122
00:05:22,650 --> 00:05:24,453
of our DNA, it's expected.

123
00:05:25,560 --> 00:05:28,500
And lastly, it is
measurable and reportable,

124
00:05:28,500 --> 00:05:30,030
and it's metric-driven.

125
00:05:30,030 --> 00:05:33,150
So we can assess how
well our set of program

126
00:05:33,150 --> 00:05:34,830
is actually working.

127
00:05:34,830 --> 00:05:38,550
So non-existent, ad
hoc, compliance driven,

128
00:05:38,550 --> 00:05:41,430
integrated, measurable, and reportable,

129
00:05:41,430 --> 00:05:43,440
Agree? Let's check.

130
00:05:43,440 --> 00:05:44,730
And we are correct.

131
00:05:44,730 --> 00:05:47,700
Okay, here's our very
last question together.

132
00:05:47,700 --> 00:05:50,250
What is the secret to impactful training?

133
00:05:50,250 --> 00:05:52,470
I want you to choose all that apply.

134
00:05:52,470 --> 00:05:54,450
Interactive, comfortable,

135
00:05:54,450 --> 00:05:58,203
welcoming, personalized, and engaging.

136
00:05:59,490 --> 00:06:01,540
What do you think? Choose all that apply.

137
00:06:02,400 --> 00:06:05,913
Well, hopefully you said
every single one of those,

138
00:06:06,780 --> 00:06:10,890
that impactful training is
interactive, it's comfortable,

139
00:06:10,890 --> 00:06:15,093
it's welcoming, it's
personalized, and it's engaging.

140
00:06:16,500 --> 00:06:17,400
Should we check?

141
00:06:17,400 --> 00:06:18,420
I don't even think we need to

142
00:06:18,420 --> 00:06:19,380
'cause we know it's right,

143
00:06:19,380 --> 00:06:21,240
but let's go ahead and check anyway.

144
00:06:21,240 --> 00:06:23,340
And there we go, it's correct.

145
00:06:23,340 --> 00:06:25,890
Congratulations, a great job.

146
00:06:25,890 --> 00:06:26,970
Now don't go away yet

147
00:06:26,970 --> 00:06:28,770
'cause we still have one more lesson.

148
00:06:28,770 --> 00:06:30,240
We're going to do lesson 29,

149
00:06:30,240 --> 00:06:33,930
which is preparing for the SYO-701 exam.

150
00:06:33,930 --> 00:06:35,430
There won't be any quiz,

151
00:06:35,430 --> 00:06:38,520
but we do have some really
important topics to discuss.

152
00:06:38,520 --> 00:06:39,620
So I'll see you there.