Securing the Human a Full-Time Commitment

While most enterprises today boast at least some sort of security awareness training program, the fruits of those labors are a mixed bag. In fact, when measured on a five-tier security awareness maturity model, only about 10% of organizations can boast the highest two tiers of maturity, according to a study out from SANS Institute today.

The study's findings show that a lot of the varied success has to do with one simple and unavoidable factor - staffers dedicated to training efforts.

It may seem like a no-brainer, but the truth is that many organizations today are stuck with subpar security awareness training because they are simply tacking duties around the organization and implementation of an awareness program onto existing security staffers' job descriptions.

"If you've got somebody that's spending only 10%, 15%, or 20% of their time dedicated to awareness, you're just checking the box," says Lance Spitzner, director of SANS Securing the Human program, who helped spearhead the 2017 Security Awareness Report.

In its third year running, the report questioned over 1,000 security awareness professionals worldwide about the state of their awareness training programs at their organizations. The survey showed that about half of organizations are in the middle stage of program maturity - promoting awareness and behavior change - while over 27% are still stuck in compliance focus.

Only about 7.6% of organizations say their program is nonexistent, although selection bias may have played a part in this low number, given the type of participants chosen for this study. According to the 2016 Dark Reading Strategic Security Survey, only 56% of participants reported that their organization provided end-user awareness training. A different survey from ESET out earlier this month shows that one in three employees do not receive any form of cybersecurity training at their organization and one in five employee respondents said they are "not at all" aware of cyber security best practices. 

Meanwhile, the organizations really making a dent with their existing security programs are rare indeed. SANS found that about 9.8% of organizations had reached the maturity of long-term sustainment and culture change. Meanwhile, just .85% of organizations have gotten to the point where they've got a metrics framework that can tie awareness training to security readiness.

The SANS report took a look at the top two categories of performance and found that one of the biggest factors correlated to success was full-time employee commitment. The report found that the minimum level of staffing for a program to change behavior at an organizational level was 1.4 full-time employees. Meanwhile, the most successful programs had at least 2.6 full-time employees dedicated to awareness.

According to Spitzner, the number of people dedicated to the program trumped even overall budget as a success factor. 

"Awareness programs are all about collaboration, communication, and partnerships, and that takes time," he explains. "Some of the most effective awareness programs are high impact, but low budget, because they're using existing resources, ambassador programs, champion programs and even existing graphic design capabilities."

As a result, Spitzner says the number one recommendation coming out of the report is for organizations to heavily funnel awareness dollars to human resources than to fancy technology. 

"I don't want to say that to be successful you can't use external resources or buy things. What I'm saying is awareness is not just about buying a big flashy box," he says. "It doesn't have to cost a lot of money. [The team] just needs time to put it together."

Related Content: