id衡量人类行为变化-t07b lance security awareness metrics v3hum安全意识指标.pdfVIP

MeasuringChangeinHuman

Behavior

SESSIONID:HUM-T07B

LanceSpitzner

TrainingDirector

SANSSecuringTheHuman

@lspitzner

TwoTypeofSecurityAwarenessMetrics

Metricsthatmeasurethedeploymentofyourawareness

program.-Areyoucompliant?

Metricsthatmeasuretheimpactofyourawareness

program.–Areyouchangingbehavior?

Focusonafewgoodmetrics.

#RSAC

3

JustAsk

Whatisonethingyouhavelearnedasaresultofthis

training?

Whatbehaviorhaveyouchangedasaresultofwhatyou

learned?

#RSAC

4

Traditionalvs.HumanSecurityMetrics

Oftenhumanmetricsareassessments.Justlikeany

otherassessment,makesureyouhaveapproval.

Unlikecomputers,peoplehavefeelings.Thechallengeis

creating/implementingmetricsthatpeoplelike.

Havingtroublegettingapproval?DoatrialagainstHR/

Legal.

#RSAC

#RSAC

WhyPhishing?

Recreatetheverysameattacksthatthebadguysare

launching.Excellentwaytomeasurechangeinbehavior.

Measuresatophumanrisk

Simple,lowcostandeasytorepeat

Quantifiablemeasurements

Actionable

#RSAC

KeyPointsforSuccess

Recommendmonthlyorquarterly.

Explainprogramaheadoftime,thenstartslowsimple.

Neverembarrasspeople,noViagraphishingemailsnorrelease

nameswhofe