45

Of course no one wants to report, they are "turning in" their peers. Also, the time and complexity it takes to go through the reporting process you described is another negative reinforcement. You are only going to get low compliance if everything is a negative. And ... YOU CANNOT FORCE PEOPLE TO DO ANYTHING!! You are approaching the problem backwards. You ...


42

I actually did a presentation similar to this a little over a year ago, and spent quite a bit of time deciding how to structure it. My target audience did include developers and other people quite knowledgeable in IT, but also managers and other non-programmers, so I tried to keep it fairly general, and not to technically complicated. As someone else pointed ...


22

The idea of customising the training to meet user requirements is in fact a very good approach. However, there will have to be certain additions to this approach which will then suit everyone in your organisation. With that being said, it is very correct when you say that the training required for an application developer will not be the same as an HR ...


15

None of the existing answers mention this and its too long for a comment even if its not a thorough answer. One thing you will absolutely need to avoid engendering in your audience is nihilism (i.e. I will get hacked no matter what I do). Its quite easy to scare people s@#$less (and temptingly entertaining depending on circumstances). But big part of ...


14

Security Awareness expert here (awards, best-selling book). Absolutely, you should/need to customise training to the role/risks. Many international bodies actually call this out as important: NIST CSF (PR.AT) NIST SP 800-16 SANS FBI/DHS Jonathan Steenland, COO of the National Cyber Center Those were just what I could recall off the top of my head. But ...


10

Encouraging your employees to snitch on each other by sending documentation of minor misbehavior to a centralized email address is a terrible idea for work climate. Nobody does it because nobody wants their colleagues to hate them and nobody wants to build a work environment governed by a denunciation culture. The resistance to your process is not just ...


7

The problem isn't so much awareness of the risk. I'm sure some (many?) people still don't know that e-mails can be intercepted, however an increasing number do know and they simply don't care. The amount of resources needed to be able to compromise e-mails is still relatively high and the threat isn't seen as all that serious by non-government entities. ...


6

Going out on a limb here, I believe in testing by regular drills and Red Team simulated attacks. If the Red Team succeeds in social engineering or other kinds of compromise, the awareness is nil. Reasoning: KPIs and surveys and whatnot measure and report averages. The attacker is not interested in averages, he's going to attack (citing from a recent comment ...


6

A rudimentary training program should minimally educate users on critical issues. Measuring its effectiveness provides the opportunity to ensure that users are getting the relevant information they need to do their jobs safely and effectively. Send out a survey that assesses awareness of job-specific information security issues and see how your employees ...


6

as @TerryChia said the correct defence against this kind of attack is strong policies. In this case users should be trained not to provide passwords to people in person or on the phone regardless of what the circumstances are. If IT need to log in to a users account they should either use something like sudo (for *nix environments) or if that's not ...


6

Information security is a technically complex topic and it is largely invisible. You can see a door lock, and see a burglar, and see and understand the loss of your TV, but one cannot see or understand what it means for a database of password hashes to be accessed by an unauthorised person. I found my greatest successes by communicating the end risks ...


6

Putting privacy concerns aside (as it sounds like you don't particularly care), having detailed personal information about you makes at least four things easier: Identity theft, opening new accounts in your name with your money and/or credit on the line Guessing password reset/security questions or impersonating you to customer service, to take over your ...


5

It's so unreal for them that the only way to have it stick is by showing them by real life example. Ask them: Who knows what phishing is? Ask them: So what kind of information leaked would be Problematic? They say: If document ThisIsImportant.doc with accounting info about customer C would be leaked. Ask them: Who has access to ThisIsImportant.doc? They say:...


5

Sounds like you really put some thought in that lesson, sounds really fun. I used to run a gaming company and our players were around that age. Here's what we dealt with most: Maybe you could give an example of brute forcing insecure passwords and how simple it is to hack your accounts with insecure passwords. Maybe you could give an example of a ...


5

I don't think it's a good practice to include footers like this in email correspondences. My arguments: It clutters your email thread, making the actual message stand out less The info is irrelevant to most recipients It's probably not wise to expose the anivirus mechanism to the outside if it can be prevented As has been mentioned by Steffen already, the ...


5

Every business, no matter what it does or how big it is, runs on information Information has value to the business, so the business needs to protect the availability and integrity of that information Information has value to others; your customers, your employees, your business partners, and has value to others who can exploit it for their own gain, so that ...


4

I think most of the problem lies in the fact that it is still not easy to use PGP for an average user. When using a computer and an email client, like Thunderbird or Outlook, some plugins exist though I can't vouch for their UI. The Outlook plugin that I've found only supports plain text encryption, not HTML, and most companies like to have their logo in ...


4

The efficacy of a 1-hour annual online series of videos to affect user behaviour is very low (industry stats are 0-5% change in behaviour - perhaps statistically insignificant). Compliance is higher within the days after training, but then trails off very quickly. This type of training needs to be coupled with other supports in order to see results, but it ...


4

I find it interesting to speak to the one who ever thought this was a good way to achieve results. The stimulus is extremely negative. You ask people to snitch on their co-workers. They must do this in full view of other co-workers (taking photographs). You clearly distrust the offender to 'own up' and the snitch to report honestly, as you require hard ...


4

I think the question is too broad so I will only cover what I think is the main aspect: Is security, at the end of the day, simply risk management? That's what it is. There are several risks relevant to SMB which are addressed by information security, for example: Ransomware might result in the inability to access data or systems which are critical for ...


4

In practical terms there are three threats I'd be worried about: Passive monitoring by network owner/other users on the network Direct exploitation by network owner/other users on the network Active man-in-the-middle attacks such as Karma and sslstrip If you haven't already, I'd recommend simply adding Wireshark to your demonstration, and showing a capture ...


3

Pim gave a great answer on the security aspects. You also mentioned privacy, so I'd add in a talk about the privacy policies that various companies have, and the importance of THAT. Security is about who you trust with your data, and you shouldn't necessarily trust the provider either. The perfect example is of course the Facebook mood manipulation study. ...


3

Love the suggestions you gave so far, I'll be keeping them in mind for future reference! My #1 suggestion would be to attack your own employees. I don't mean you should run around with an axe all "Here's Johnny!" style, screaming at people about proper security practice, but rather stage cyber-attacks and judge their responses, then explain to them what ...


3

On the one hand you say you want to run workshops while on the other, you dive into some some quite hard-core topics with people who have limited knowledge of security. While I applaud your efforts, if it were me I would be looking to raise awareness and get people thinking about security rather than just presenting death-by-powerpoint / something which ...


3

The "big deal" is that personal information that was knowingly shared with and entrusted to Quora by consenting individuals was compromised and obtained illegally by a third party. Obviously, the individuals affected did not consent to this and, at least for a time, were completely unaware that their data entrusted to Quora was hacked. As touched on by ...


2

Short answer is: nobody cares. The risk is too far fetched from everyone's life that unless everyone you exchange e-mail with has a good grasp of the consequences of using unencrypted e-mail, the extra mile they need to go won't be perceived as useful. As a rule of thumb, if you can't convince your grandmother to do that (or aunt, or whoever is not ...


2

Have a look at http://www.securingthehuman.org/. The newsletters are quite good. And http://www.cpni.gov.uk/advice/Personnel-security1/. They have reusable posters and other resources for awareness and training.


2

SANS Secure The Human now publishes lists of KPIs for you to consider: https://securingthehuman.sans.org/resources/metrics They split it up into "Tracking" metrics (who has completed the training) and "Impact" metrics to try to measure the impact training has had. number of people successfully phished over time number of people reporting phishing number ...


2

What we decided for one KPI is the amount of incidents reported. In the current phase, we say we want more incidents to be reported: not enough people report/are aware they should. When the amount rises, this will mostly be because of increased awareness. From a certain point (no real steady increase in reports) we will switch to Less incident reports means ...


Only top voted, non community-wiki answers of a minimum length are eligible