Computerworld - Security awareness gets no respect.
It can be extremely valuable, if properly implemented. Too often, when it falls short, that is seen as a mark against security awareness programs themselves, instead of a problem with the implementation. And implementation is often a problem, because security awareness is usually taught by untrained people.
Earlier this year, I read an article in CSO saying that security awareness would never eliminate social-engineered security threats and therefore was a waste of time. I disagree with this point of view and responded with an article of my own, in which I touted the many success stories of security awareness campaigns and noted that it is folly to believe that any security measure is ever going to be 100% effective.
The fact is, security awareness can provide the greatest return on investment of any security countermeasure.
"OK," says the opposition to this viewpoint, "but attacks that target people seem to be proliferating faster than ever. Isn't that evidence that security awareness training has been a failure?"
In a word, no. The fact is that all attacks are proliferating faster than ever. There is nothing special about a rise in social-engineered attacks. But that doesn't mean that security awareness can't be improved to decrease the number of attacks that are successful.
I was recently asked to review some extensive research on security awareness. I wasn't surprised to learn from that research that while most security awareness programs are created by security practitioners, those practitioners had laymen's skill levels in the principles that underlie awareness preparation and training. In fact, too many security practitioners trivialize the knowledge, skills and abilities that it takes to create an effective awareness program. They believe that since what is involved is not technology but instead soft knowledge, soft skills and soft abilities, anyone with a basic understanding of security can implement an awareness program.
Wrong!
Think of it this way: Imagine that you are a security professional and a user tells you that he should be able to maintain the corporate firewall system because he has managed to securely maintain his home computer. You, the security professional, are not going to say, "Great! The job is yours." But all too often, that same security professional thinks that all that is needed to set up a program designed to change the behavior of the entire organization is to find any generic security professional.
Here's the fallacy in that assumption: There are very specialized knowledge, skills and abilities involved in delivering quality awareness programs. The person designing the program does need to be knowledgeable about security, but even more important is to have a familiarity with social science disciplines. The most successful security awareness programs incorporate the latest research and multiple delivery methods.
You are previewing premium content. 
Free Insider Guide
