“It’s not the end of the world. If something happens, it happens.”
These were comments made by an ‘average technology user’ in research carried out by the National Institute of Standards and Technology (NIST) in the US. They assessed perceptions and beliefs about cybersecurity and online privacy, and identified that people are increasingly desensitised to constant reminders about cyber risks.
The quote highlights the difficulties we face in moving beyond the frustration, weariness and ‘security fatigue’ many of us feel from the bombardment of messages about the dangers lurking online. We’re tired of being told the sky is falling down. But the risk of cyber attack remains real and relentless – and the reality is that cyber attackers often find it easier to communicate with, engage and influence the behaviours of our staff than we do. So, a new approach is required to engage all of us in making the right decisions at the right time in response to a range of different and changing cyber risks, whether you sit in the boardroom or on the front desk.
The NIST research found that many of us often feel out of control or resigned to do nothing in regards to online security.
Now take these attitudes into the workplace and organisations are faced with a real dilemma. The stark reality is that we know that 90% of all successful cyber-attacks succeed because of human error – the unwitting actions of any one of us, irrespective of our role or responsibility.
While many forward-thinking organisations already recognise the need to provide information security training to all staff, how can this be delivered in a way that overcomes the apathy identified in the NIST study? How can we ensure that Information Security training for non-technical staff really engages them to change behaviours and doesn’t just ‘tick the box’?
For me, there are five key lessons for effective Information Security training:
Stories spark emotions. An emotional response can help drive curiosity and action about subjects we previously thought dull and irrelevant. Stories help to explain the complex and the confusing in new, insightful ways. They can help make people care. The most successful marketing campaigns have a compelling story at the centre of them. Stories have the power to communicate consequences and relevance to audiences. We listen to compelling stories and we empathise – we imagine how this could be happening to us or to people and groups we know and care about. Stories can be shared, can inspire and involve.
Combine great storytelling with the delivery techniques we now have at our disposal – games, animations, video, simulations – and we have the ability to make a real difference to the way we change behaviours for the better.
People need to hear from their leaders. Information security is a business risk and leadership teams have a vital responsibility to show their commitment and dedication to leading the way in protecting what’s most precious and valuable to them. The goal is to be able to say “it’s the way we do things around here”. The active and continued involvement of leaders – being seen and heard – in their organisations’ information security training will be time well spent. Critically, leaders must also appreciate that they’re far from immune to attack themselves.
Keep it simple. Most of us would be defined as ‘average users’ of technology, and in asking for support and interest in information security from the ‘average user’, we need to talk and provide guidance in a language that will be understood. For example, research in 2016 highlighted that 36% of UK adults said they could not confidently define what a phishing attack is. We, therefore, need to understand what our target audience (the ‘average user’) does and doesn’t know before deciding how we can communicate most effectively with them. We have to design and deliver learning that our people can relate to. Using plain English to explain threats like phishing and providing simple, practical guidance is essential.
4. FREQUENCY AND TIMING
Changing behaviours takes time. We need active, engaging online learning that adapts to changing threats delivered on a regular, consistent basis. We have found that refreshers, assessments and competition all work well in keeping our people engaged and interested. Diagnostics also helps to provide choice and options in developing targeted, relevant learning at the right time to the right people. This targeted, drip-drip approach can help prevent ‘security fatigue’ and encourage better decision making. Organisations also need to measure success and improvements over time. Take phishing for example. Some organizations now integrate managing an ethical and controlled phishing attack on their staff with engaging online learning to benchmark the number of people who would open a potentially damaging email before and after training.
5. CULTURE AND INCENTIVES
Develop the right culture. This is one area where I believe we need a real focus. We need a culture from top to bottom that rewards ideas and learns positively from mistakes. I sometimes see working environments that do not encourage or reward people for ‘putting their hand up’ – indeed I’ve often seen those hands being slapped down if anyone admits to making a mistake or suggests an alternative way of doing things.
By adopting these key lessons, I see innovative and engaging Information Security training helping organisations to really embed and sustain better behaviours. Our RESILIA™ Awareness Learning provides first-hand evidence of the power of on-line learning to embed a more resilient security culture.
The importance of health and safety at work is now widely understood and accepted to help protect organisations and their people. We now need to effect the same change in our approach to Information Security training. Otherwise, many more organisations will be forced to explain to the world’s media why they’ve been breached.