Designing Effective Security Awareness Programme To Fortify Your Human Firewall
Ashish Shrestha, CEO & Co-Founder of Zyn Global, Information Security Leader Linking Information Security to Digital Wellbeing
Foreword
There is no doubt that the “Human Firewall” is the best security defence system that we have. Yet, majority of Security Awareness Training (SAT) strategies continue to fail in achieving the desired outcome or achieve only limited results. So why is it despite all the effort, advancements in technology, and fancy presentation slides, it is difficult to permeate the human mindset and inflict the desired change in behaviour and organisational culture?
Where does the responsibility lie – Information Security programme, the business technology in use or the employees?
We need to step inside the problem with an intention of solving it, because stepping away from it isn’t the solution. What I am about to say may sound counterintuitive, even provocative and some may disagree, but nonetheless, here is my view:
“The weakness does not lie in humans, but lies in the status quo – for decades, we have crafted and delivered awareness and training programmes in the same stereotypical manner. The truth may be uncomfortable, but it still stays true.
A classroom style, “death by PowerPoint” shoehorned to broadcast company policies “dos and don’ts”, is an all too familiar formula. Capitalising on fearmongering, carrot and stick approach fuelled by disciplinary action for non-compliance and the experience for the human becomes impersonal and frustrating. Let’s face it, this policing control and warden like behaviour simply doesn’t work.
Perhaps this is even more provocative, but in my view, the core of the problem is the continued insistence of leaders with years of experience in this domain on traditional methods of instilling security discipline. I believe this is the single biggest factor impeding the desired progress and outcome.
Put simply, the traditional approach lacks the perspective and required depth to understand that SAT is less about content, not about promoting bad news nor banking on the fear factor, but more about human behaviour, storytelling and emotional connection. Meaningful change requires deeper understanding beyond the conservative mindset and the hypothetical problem statement – “Human is the weakest link in the cyber chain”.
Adopting a Problem First vs Solution First Approach
What has been your approach and remedy to this? You may ask.
My Learned, Unlearned and Relearned moments.
Learned Moments – Applying the same approach to the same problem isn’t a solution – Be relentless about finding a new approach
My journey began with “Learn”, with intense research and meticulous analysis – books, articles, and publications about creating an impactful change. I also explored the basic science behind the human brain and the associated neuroplasticity. More importantly, then implementing these learning moments in bite-size manageable chunks, assessing how these “Learned” principles could help me creatively inspire a transformation in security culture within the organisation. It worked, it honestly did.
You see, the human brain is a sophisticated piece of biological technology and me being a technology enthusiast, the more I researched the more fascinated I became.
I soon learned that behaviour change pattern does not happen simply because of rational scripture I present to my audience. The human brain is not a computer system that we can program to respond robotically under our command and control. This is because it also requires connection with human feelings, values and emotions.
Behaviour change is elusive in nature, and to achieve your desired programme objectives and key results, you need depth, authenticity, and a genuine desire to make an impact. And to make an impact you must immerse yourself in the process.
This aspiration of change involved a process of dismantling my old habits to establish new ones. I had to “Unlearn” and let go of the approach and problem that even I was part of and leading it.
Unlearned Moment – Experience doesn’t always equate to simplicity and pragmatism
In my more than a decade of experience in this domain, I have seen, participated in and executed many SAT programmes with deluded optimism to instil basic cyber security hygiene practice within their business and drive culture changes based on below:
In this segment of unlearning, it came with discovery and realisation that there is huge fatigue amongst the people who are the biggest asset for business’s success when it comes to the learning programme.
The only issue here is that the above is not only counter-productive but undermines the effort to truly build a pragmatic programme and sustainable programme strategy, that supports and fortifies the right cyberculture that delivers.
Relearned Moment – Be creative in generating the thirst in your audience
As I have insinuated, the core of the challenge appears to be as much of a biological problem that we have as humans along with a poorly designed awareness and training programme that is inflammatory to this problem. Yes, you read it right – A neurobiological battle that needs to be understood and conquered!
Understanding our emotional responses – Why do we (humans) think and behave the way we do?
I unlearned the status quo to relearn that being conscious and contextual in communicating “WHY” is important for them, and not the business, brand, reputation or its growth. The “WHY” is critical in generating the thirst – The curiosity to get themselves to the oasis in the first place. The “How” and “What” of the strategy is secondary, and in fact comes naturally as a by-product of this thinking.
Develop a programme that can:
- Capture the “Attention” of your audience
- Help them “Retain” the information
- Inspire the application of desired “Action”.
Mindset change becomes the by-product of this winning mantra.
Our Approach Must Change
For me designing a radical, successful, and enduring SAT Programme has revolved around my 3C Principles
It is paramount to keep it “fun and entertaining” but it is equally important that you “test your programme effectiveness, not people”. As the adage goes – Trust but verify – Conduct attack and active breach simulation.
Having a Clear Purpose and Maintaining Focus – Your compass in this journey
It is optimistic to even try and cover every aspect of this topic in this article. Maturity is a journey and an ongoing evolution in building a sustainable programme.
The whole objective here is to shift your compass to help manoeuvre without losing track of your true purpose and focus.
The fundamental problem we are facing is because we believe that our job is to take the horse to the water and make them drink – We are not creating thirst. If we can make someone thirsty you never have to lead them to water or make them drink. They will seek their own water and then drink all their lives. This is what I call intellectual curiosity.
This simple recalibration can help repair and reinforce a security awareness program that makes the human mindset and behaviour shift.
Educating Beyond The Compliance Gap
To conclude, my mission is focused on making security optional rather than obsolete. Because making security obsolete implies “just listen to me, let me take care of it and can count on me to do something”.
Instead, my role is to empower you with information, and actionable intelligence, know my audience and their concern, and be mindful of tools, technologies and modalities that can benefit them. This simple change has been critical to my programme’s effectiveness, developing a sustainable defence mechanism that strengthens the best security that money can buy – Human Intelligence. Period.
In today’s information age, security and privacy awareness training programmes need to incorporate far more than organisational policy and compliance checkbox deliverables. So, defy the status quo and be convicted to help your audience protect them and their wellbeing. Business security posture, resilience and compliance will be a by-product.
