Shaking up security awareness: How one organization is building a culture of security

May 16, 2022 by

Susan Morrow

Human beings are naturally good at making connections and engaging in behaviors and relationships; these behaviors and norms of a society build a culture. Connecting to a subject and engaging in its content is part of the learning process, too. This engagement process is used in security awareness training to help improve understanding of often dry and complex subjects. Creating an environment where security-first thinking becomes second nature is the golden chalice of security awareness training. Getting there requires employee engagement; if engagement levels are high, the training is more effective, resulting in a culture of security that permeates your organization.

Organizations like Johnson County in Kansas have successfully achieved a culture of security by driving employee engagement using fun and games. How they do that is the secret sauce of security culture creation.

ChatGPT training built for everyone

We've created a training video and supplemental resources to educate every employee on how to use AI tools securely. Meet with a member of our team to get started.

Meet with Us

What defines a strong culture of security?

An Infosec survey that explored how to quantify a security culture revealed some interesting insights. One of these insights shows that 31% of respondents found that their organization's cybersecurity awareness training (SA&T) was only a "little engaging or not engaging at all." That's a telling statistic; if a third of your employees do not engage with security training modules, they will not connect the dots needed to create a strong culture of security within an organization.

You know that you have developed a strong culture of security when your employees actively use security best practices. Infosec has created a framework based upon the results of intensive surveys carried out across industry sectors to measure the level of engagement. This framework allows an organization to track its success score in developing a cybersecurity culture across five domains.

Domain one: Confidence.

Do employees feel they can use their cybersecurity knowledge in a practical manner?

Domain two: Responsibility

How an employee perceives their role within organizational security.

Domain three: Engagement

How willing are employees to participate and apply available resources to support and improve personal security behaviors?

Domain four: Trust

The perception of the security posture and security processes at an organization by its employees.

Domain five: Outcomes

How do employees perceive the consequences of a security incident at their organization?

Donna Gomez of Johnson County told Infosec about her practical experience delivering engaging security awareness training to build a security culture.

Scoring high with engaging security awareness

The antithesis of engagement is blame. Gomez explained that Johnson County deals with a cybersecurity event by avoiding blame — after all, the person who has been tricked by a phishing email or is socially engineered is a victim. Gomez told Infosec, "I look at that non-engaged 31% as not being connected to the SA&T (security awareness and training) material. They are simply going along with the program. And, if you're going to punish people, they're going to disengage."

The research shows that certain forms of negative feedback, such as punishment, contribute to security awareness disengagement and can cause a SA&T program to fail.

Gomez uses the Infosec framework to help Johnson County measure the effectiveness of its SA&T program. She told Infosec that she was "really excited when I saw that our average was 3.84 across all five domains." Gomez said that seeing a high score of 4 for trust and responsibility was most encouraging as this high score demonstrated to Gomez and her team that they had successfully changed the security mindset of employees. To achieve this, Gomez and her team took a stance that security is not an IT issue because it impacts everyone. It is the responsibility of us all.

The fun and games of engaging security awareness training

Creating and maintaining an engaging security awareness training program does take commitment. As Gomez reminded us, "It's (security awareness) not an IT problem. It is not an HR problem. It's a human problem, and you must deal with the user community."

Engagement in security training can be broken down into four core elements that will help keep that entire community engaged.

No blame policy

Removing the concept of employee blame from a cyberattack creates a framework of trust that allows a security culture to develop unhindered. Gomez pointed out, "Employees needed to believe that they won't face serious consequences if they caused a security event." This transparency, openness, and understanding have helped Johnson County improve its trust score. Employees must be able to approach management and report cyber incidents to allow triage and response to happen quickly to mitigate the impact of a cyberattack. In the case of Johnson County, this open-door, no-blame policy increased incident reporting.

Boost employee confidence

Confident employees are more likely to engage in security awareness training. This building stone of a security culture is helped by the no-blame policy. At Johnson County, confidence boosted security awareness, "we were close to a score of four in confidence, but we still need to improve our score; employee confidence shows us that we are doing the right thing and that all parts of the awareness puzzle are in place."

Share ideas

Keeping employees' interest when going through security awareness content is a must-have to maintain engagement. Sharing ideas helps cement the relationship with the training and adds to the engagement in the SA&T program. As Gomez put it, "just try anything, and don't be afraid to try something new." Engagement comes by asking employees to share an idea. At Johnson County, one such request resulted in the "phishing derby" where staff can win prizes. Similar initiatives at Johnson County created a "choose your own adventure series" as a module within the SA&T program. One of the adventures was called "Security Feud." The game became more sophisticated as time went by.

Keep it going

One of the key aspects of a successful security awareness program is to keep it going. Gomez told Infosec that she plans to use the Infosec framework scoring at least twice a year. She intends to do so at key junctures in the cybersecurity calendar, namely, July for Phish Week, (Johnson County's play on Shark Week") and again during Cyber Security Month in October. Once the scores are in, they can be used to measure change. These data can be shared with everybody to show progress: "Hey, look where you are." We can also use the results to find out who trained across the entire county, using the scores to compare results and identify areas of improvement.

The aha! moment in security awareness engagement

Aha moments are always useful to hear about as they can provide a deep understanding of a given situation. Infosec asked Gomez if she could give us her aha moment regarding security awareness engagement. Gomez told us, "Back in 1999, when I started out in the industry, I would tell people, 'don't click on attachments and emails.' From that starting point to where I am now, in every single program, the most important lesson learned is 'don't punish'. Instead, ask and learn from your people. Take the leadership approach. Find out where your users are and use the knowledge management and training design approaches. Assess individual needs as every individual learns differently. And the way they interact with information at a point in time is going to be different. You will have to try different ways of delivering a message and be willing to accept the fact that you don't know everything, and you will have to adjust."

ChatGPT training built for everyone

We've created a training video and supplemental resources to educate every employee on how to use AI tools securely. Meet with a member of our team to get started.

Meet with Us

Shake-up engagement to build a security culture

Engagement is about connecting to the individual learner, understanding what makes them tick and how to leverage that. The pathway to a security culture is through this engagement. Gomez has practical experience in doing this and has won an InfoSec Excellence Award for exceptional engagement in SA&T. A final word from Gomez explains why she stands out from the crowd in the delivery of security awareness training. She told us, "To engage people, you must not be afraid to try something new — shake it up — throw a curveball in the middle that just catches staff off guard, something that is completely different."

Sources:

• Infosec, Cybersecurity Culture — Quantified
• Infosec excellence Awards, Donna Gomez: Security Risk and Compliance Analyst , Johnson County - State of Kansas