Apart from the conventional email phishing tests, what other security Key Performance Indicators can be used to measure end user security awareness in an Organization?
Looking at the SANS critical security control #9:
- 9.4 Validate and improve awareness levels through periodic tests to see whether employees will click on a link from suspicious e-mail or provide sensitive information on the telephone without following appropriate procedures for authenticating a caller; targeted training should be provided to those who fall victim to the exercise.
I am trying to come with an indication that looks beyond the phishing emails or providing sensitive information over the phone. For example, how would I know people are aware of the dangers of using infected USBs in the organisation? Disabling the use of the USB prevents the security breach but does not benifit end user awareness of the issue. Users usually see it as an annoying control that stops them from performing their tasks. USB is just one example, how would I know that users are aware of the dangers of sharing their usernames? and similarly other wrong practices. getting their answers on the subject by surveys is one part, are there other indications?