‘Tick-box’ tedium – the information security conundrum

Five key lessons for effective information security training.

“It’s not the end of the world. If something happens, it happens.”

These were comments made by an ‘average technology user’ in research carried out by the National Institute of Standards and Technology (NIST) in the US. They assessed perceptions and beliefs about cybersecurity and online privacy, and identified that people are increasingly desensitised to constant reminders about cyber risks.

The quote highlights the difficulties we face in moving beyond the frustration, weariness and ‘security fatigue’ many of us feel from the bombardment of messages about the dangers lurking online. We’re tired of being told the sky is falling down. But the risk of cyber-attack remains real and relentless – and the reality is that cyber attackers often find it easier to communicate with, engage and influence the behaviours of our staff than we do. So, a new approach is required to engage all of us in making the right decisions at the right time in response to a range of different and changing cyber risks, whether you sit in the boardroom or on the front desk. 

The NIST research found that many of us often feel out of control or resigned to do nothing in regards to online security. This is further backed up by recent research from the Institute of Directors and Barclays which highlights that despite most businesses surveyed (95 per cent) viewing cyber security as important to their business, this is not then being translated into effective strategies and responses to the risks they face. 

One of the key findings of this research was that 45 per cent of those businesses surveyed do not have any cyber awareness training in place for their people. Of those that do, 81 per cent undertake training once a year, or less often or simply don’t know. The stark reality is that we know that 90 per cent of all successful cyber-attacks succeed because of human error – the unwitting actions of any one of us, irrespective of our role or responsibility. 

While many forward thinking organisations already recognise the need to provide information security training to all staff, how can this be delivered in a way that overcomes the apathy identified in the NIST study? How can we ensure that Information Security training for non-technical staff really engages them to change behaviours and doesn’t just ‘tick the box’? 

For me, there are five key lessons for effective Information Security training:

Storytelling

Stories spark emotions. An emotional response can help drive curiosity and action about subjects we previously thought dull and irrelevant. Stories help to explain the complex and the confusing in new, insightful ways. They can help make people care. The most successful marketing campaigns have a compelling story at the centre of them. Stories have the power to communicate consequences and relevance to audiences. We listen to compelling stories and we empathise – we imagine how this could be happening to us or to people and groups we know and care about. Stories can be shared, can inspire and involve. 

Combine great storytelling with the delivery techniques we now have at our disposal – games, animations, video, simulations – and we have the ability to make a real difference to the way we change behaviours for the better. 


Leadership

People need to hear from their leaders. Information security is a business risk and leadership teams have a vital responsibility to show their commitment and dedication to leading the way in protecting what’s most precious and valuable to them. The goal is to be able to say “it’s the way we do things around here”.  The active and continued involvement of leaders - being seen and heard - in their organisations’ information security training will be time well spent. Critically, leaders must also appreciate that they’re far from immune to attack themselves. 

Language

Keep it simple. Most of us would be defined as ‘average users of technology and in asking for our support and interest in information security from the ‘average user’ we need to talk in a language and provide guidance in a language that will be understood. For example research in 2016 highlighted that 36 per cent of UK adults said they could not confidently define what a phishing attack is. We therefore need to understand what our target audience (the ‘average user’) does and doesn’t know before deciding how we communicate most effectively with them.

We have to design and deliver learning that our people can relate to. Using plain English to explain threats like phishing and providing simple, practical guidance is essential. 

Frequency and timing

Changing behaviours takes time. We need active, engaging online learning that adapts to changing threats delivered on a regular, consistent basis. We have found that refreshers, assessments and competition all work well in keeping our people engaged and interested. Diagnostics also helps to provide choice and options in developing targeted, relevant learning at the right time to the right people. This targeted, drip-drip approach can help prevent ‘security fatigue’ and encourage better decision making.

Culture and incentives

Develop the right culture. This is one area where I believe we need a real focus. We need a culture from top to bottom that rewards ideas and learns positively from mistakes. I sometimes see working environments that do not encourage or reward people for ‘putting their hand up’ – indeed I’ve often seen those hands being slapped down if anyone admits to making a mistake or suggests an alternative way of doing things. 

By adopting these key lessons, I see innovative and engaging Information Security training helping organisations to really embed and sustain better behaviours. Our RESILIA™ Awareness Learning provides first-hand evidence of the power of on-line learning to embed a more resilient security culture.

The importance of Health and Safety at work is now widely understood and accepted to help protect organisations and their people. We now need to effect the same change in our approach to Information Security training. Otherwise, too many more organisations will be forced to explain why they’ve been breached to the world’s media.

Nick Wilding, General Manager, Cyber Resilience, AXELOS Global Best Practice
Image Credit: Wright Studio / Shutterstock