Building a Strategic Plan for Your Security Awareness Program

Transcription

1 SESSION ID: HUM-T09 Building a Strategic Plan fr Yur Security Awareness Prgram Lance Spitzner Directr SANS Securing The

2 WindwsOS EMET Micrsft Security Essentials Security Cntrls Data Executin Prtectin (DEP) Baseline Security Analyzer Firewall Enabled by Default Micrsft Secure Develpment Lifecycle Autmatic Updating Sftware Restrictin Plicies Trustwrthy Cmputing Bitlcker User Accunt Cntrl ASDL Windws Defender Malicius Sftware Remval Tl Encrypted File System AppLcker Mandatry Integrity Cntrl Windws Service Hardening HumanOS

3 Security Awareness Maturity Mdel Security Awareness Security Awareness Maturity Mdel Maturity Mdel Nnexistent Nn-existent Cmpliance- Fcused Cmpliance Fcused Metrics Metrics Lng-Term Framewrk Framewrk Lng-Term Sustainment Sustainment & and Prmting Culture Cultural Change Change Awareness and Behaviral Change Prmting Awareness & Behavir Change

4 4

5 Yur Strategic Plan WHO WHAT HOW

6 WHO Are Yu Targeting? Different targets require different / additinal cntent and cmmunicatin methds: Emplyees Cntractrs / Vendrs IT Staff / Develpers Senir Management Accunts Payable / HR Many rganizatins start with just all emplyees, but as their prgrams mature, they identify unique sub-grups

7 Defining Wh

8 WHAT D Yu Teach? Fcus n tpics that have the greatest ROI: Peple can remember nly s much cgnitive verlad Yu have limited time and resurces t teach Fewer tpics are easier t reinfrce Avid training fatigue Identify the greatest human risks t yur rganizatin, and then develp training mdules t address each f thse risks

9 Verizn DBIR

10 Qualitative Analysis VH / 5 X Prbability H / 4 M / 3 L / 2 X Phishing Tpic % Impact Risk Scre Tracking Ckies VL / 1 VL / 1 L / 2 M / 3 Impact H / 4 VH / 5

11 Learning Objectives - Bad A cmmn security awareness tpic is passwrds: Minimum f 12 characters 1 symbl 1 number 1 capital letter N tw repeated letters Change every 90 days Csts assciated with this

12 Learning Objectives - Gd D nt get infected D nt share yur passwrds D nt lg in using untrusted systems Persnal questins are just anther passwrd Passphrases Where is my Cffee? Passwrd Managers Use tw-step verificatin whenever pssible

13 HOW t Change Behavir Security teams have t think like marketing, cmmunicatins r sales peple. Awareness is a prduct we are attempting t sell Cnnect peple at an emtinal, creative level. Why des cyber security matter?

14 Curse f Knwledge

15 Why Cyber Security Matters

16 Engagement Centers fr Disease Cntrl (CDC) has lng-term awareness campaign n preparing fr disasters; n ne was listening May 16, 2011 psted blg n preparing fr "Zmbie Apcalypse" Three hurs later, the netwrk cllapsed; 2 days later, they made an fficial public annuncement

17 Push Versus Pull Push: Sending infrmatin t peple Pull: Peple get infrmatin n their wn Pull methd is becming mre cmmn and ppular: Online / Cmputer Based Training Pdcasts / blgs Newsletters / Psters Bth events Ambassadr prgrams

18 Primary vs. Reinfrcement Primary: Typical annual training. Mandatry / cmpliance Lays fundatin fr peple Instructr Led / Cmputer Based Reinfrcement: Rest f the year Nt mandatry / engaging One tpic at a time Numerus ways t cmmunicate

19 Turkcell Dn t feed the mnster. I like it here, there is a lt f infrmatin t satisfy my stmach!

20 Annual Prgram

21 Tw Types f Metrics Cmpliance Metrics: Measure the deplyment f yur awareness prgram. Are yu cmpliant? Impact Metrics: Measure the impact f yur awareness prgram. Are yu changing behavir?

22 Impact Metrics Every metric shuld tie t a specific behavir that helps manage a human risk yu care abut Phishing ID Badges / Drafting Dumpster diving Phne calls Data Lss Preventin (DLP) Screenlck use Mbile device lss

23 Metrics Key Pints Biggest difference between technical and human metrics is that humans have feelings Annunce yur metrics prgram ahead f time, and then start slw and simple D nt embarrass peple (n Viagra s). D nt release names f thse wh fail. Only ntify management f repeat ffenders Fcus n real-wrld risks, d nt trick peple Always make sure there are at least tw ways t detect an assessment

24 When Yu Return t Wrk Identify yur key high risk grups (accunts payable, HR, etc) and take them ut t lunch r hst a specialized webcast fr them. Build bridges D a human risk analysis and priritize the risks / behavirs yu teach Partner with yur cmmunicatins team, have a persn assigned t yur security team Read Leading Change and Made t Stick Partner with a senir champin, have that persn help yu cmmunicate with leadership 24