Lance Spitzner

Non-Existent Compliance Focused Promoting Awareness & Change Long Term Sustainment Metrics Security Awareness Maturity Model

Useful Metrics Focus on just a few, high-value metrics. –A metric that measures a human risk or behavior that you care about –A metric that is actionable –A metric that is low cost/automated –A metric that repeatable

2 Types of Awareness Metrics Metrics that measure the deployment of your awareness program. Are you compliant? Metrics that measure the impact of your awareness program. Are you changing behavior?

Key Points Computers do not have feelings, but people do. Announce and explain your metrics program ahead of time, then start slow & simple Do not embarrass people nor release names of those who fail to management. Only notify management of repeat offenders. Focus on real-world risks, do not ‘trick’ people.

Example Metric - Phishing Recreate the very same attacks that the bad guys are launching. Excellent way to measure change in behavior. –Measures a top human risk –Simple, low-cost and easy to automate –Repeatable and quantifiable measurements –Actionable

Get Approval Before conducting any type of assessment, make sure you have appropriate approvals. If you can’t get approval, try a test run against the blockers (HR, Legal). Make sure security team knows ahead of time. Let them know each time you do it and whom to contact when things go wrong.

Example

Click Results If an end user falls victim to an assessment, you have two general options –Error message/no feedback –Immediate feedback that explains this was a test, what they did wrong and how to protect themselves

Follow-up Send results of test to all employees 24 hours later. Explain the results, how they could have detected phishing and what to look for in the future. Include an image of phishing . Include your monthly security awareness newsletter.

Violations First violation: Employee is notified and given additional or follow-up training. Second violation: Employee is notified and manager is copied. Third violation: Manager is required to have meeting with employee and report results to security. Fourth violation: Employee reported to HR.

The Impact First phish: 30-60% fall victim months later: As low as 5%. The more often the assessments, the more effective the impact. –Quarterly: 19% –Every other month: 12% –Monthly:05% Over time, you will most likely have to increase the difficulty of the tests.

Human Sensors Another valuable metric is how many reported the attack. At some point, you may need to develop a policy on what to report. For example: –Do not report when you know you have a phish. Simply delete. –Report if you don’t know (think APT). –Report if you fell victim.

How To Phish URL Shorteners Marketing Solutions Cloud Phishing Services Pen Testing Software

The Attack

Are People Updating Devices?

Physical Security Behaviors See if an unauthorized person can enter or walk around facilities without an ID badge. Check desktops to make sure computer screens are locked and there is no sensitive information left on desks. Check parked cars for mobile devices left in the open.

Number of Infected Computers Track the number of infected computers on monthly a basis. As most infections are the result of human behavior, the number should go down over time. One Defense Industry organization had such a dramatic drop in infections they could free up half a FTE (Full-Time Employee).

Visualizing Your Measurements

Next Generation Awareness 3 rd Generation STH will be about understanding and measuring User Risk – security and compliance TOGETHER. Measurable metrics to understand whether you’re winning or losing. SANS Security Awareness Summit will have a focus around this initiative – 10 September 2014 in Dallas. Interested in being involved in the development of this new approach? - John Fitzgerald

Summary Metrics are a powerful way to both measure and reinforce your awareness program. securingthehuman.org/resources/metrics sans.org/mgt433