Targeting Awareness of Emerging Cyber Threats with Risk-Based Policy and Training Intervention

Auto-generated from the live recording.

0:07My name is David Tunley. I am a cybersecurity awareness and training professional based out of Portland, Oregon. So if any of you are in the Portland area or the Pacific Northwest, please say hello, send me a message, happy to connect, meet up in person if possible. I have been in the field for about five years now. I've worked with various different types of teams at First Republic Bank, if you remember them, Nike, and currently at Rivian Automotive leading the cybersecurity, what we call engagement program, but as awareness training, security training, whatever you want to call it, as part of our cybersecurity risk management program.

0:48I've attended a few of the security awareness conferences in the past, so some of you I may have met in person. For those of you who have not, I'm happy to meet you here today in this format, looking forward to connecting LinkedIn or future conferences. And throughout my career, I've learned a thing or two about the different approaches to building a security awareness program. And I'm happy to share some of those insights from my experiences. But before I move forward, I just want to say that one thing that I've learned that's been consistent in this field over the last several years is that we are all trying to figure it out together, this human risk management thing.

1:30What does it mean, what does it look like in practice, and how do I sell this to highly technical cybersecurity engineers or architects or leadership management, et cetera. And I think that these gatherings are really good opportunity for us to come together and share ideas, approaches, information, stories, and hopefully help each other as we take the next steps in our program. So definitely looking forward to some conversation a little bit later in the Q&A. Today's agenda is gonna be relatively short. I wanna make sure that we open up time to just have some question that kind of bounce back and forth.

2:07So we're gonna talk about challenges on the road to a risk-based approach. We're gonna talk about why this matters. I think we've already kind of talked about that collectively as a group, why this human risk management training and awareness, why this all matters, effective awareness and training, the need for personalization and how policies can support that, and hopefully open it up for some good Q&A. So if you have any questions or you want to offer any suggestions that may be something that's working with your program, please do so, and we'd love to talk about that. But the first thing, challenges. On the road to a risk-based approach, I feel like this could be the entire session.

2:46Like, I don't even know where to begin with the challenges. I could talk at length about all the challenges that we're facing. I feel like budget, resources, headcount, the idea that this is the most important thing, but we're only gonna give you one person to manage it. That could be an entire session on its own. But nobody really cares, so let's not stress about that. Let's move on. I'll highlight a few common challenges that I think we probably all share or that we probably have all experienced one way or another. First one is generic training limitations. Traditionally, training is boring. They fail to capture the nuances of our field.

3:23They fail to speak to company culture. They're not engaging. People typically don't learn from them. Users view them, this type of training, as a checkbox requirement. This approach typically favors completion rates over comprehension. So think about, I believe some of the speakers before talked about presenting these type of metrics. We have 65% completion rate. We have 85% completion rate. I don't think there's an agreement in our field as to what completion rate equates to less risk. It's kind of ad hoc at this point. So maybe this is something that we can move away from as practitioners.

4:01Human differences. Humans do things differently for different reasons. And in cybersecurity, that may be because of their specific role, their specific function, or maybe their education level as it comes to technology. Different job functions dictate their relationship with technology. So an example I give is that a user on the accounts payable team is gonna interact with your technology much different than, let's say, an hourly employee on your manufacturing floor. These are both users that have accounts that have access to the network, that have email addresses.

4:37These are opportunities for compromise and you need to reach these audiences equally. And a one size fits all training module doesn't do this, right, in this approach. Employee engagement. I think that employee engagement is one of the biggest challenges currently that we're facing as practitioners, especially if you're working with teams that are in a remote environment, it's really difficult to gain their interest. It is really difficult for any type of extracurricular activities, especially if it's via Zoom.

5:13I know I have faced this over the last couple of years. If any of you are dealing with this, please, it's not you, it's not your programming, it's not your content. This is something that we are facing as a whole in our field. And then perception. Perception, there is a big misperception in our field. I'm not saying it's for everyone, but that we are just the annual cybersecurity training people that we are not really cyber people. I know that I have felt this in the past with different teams that I've worked with and with technology and with threats moving so quickly.

5:50Think of the conversation around AI that's happening right now. It's really difficult to keep up and really feel like you're part of the cybersecurity team. In my experience over the last five years, taking a more risk-based approach to my program has helped naturally ease a lot of these challenges and kind of build and evolve the program off of that. So here's a cybersecurity domains map. You probably have seen this. I'm not even sure this is the most updated one. I think these things get updated pretty regularly, but it depicts the complex apparatus that we're operating in.

6:27And behind all of these bubbles are teams of people that are working to prevent something, that are working to implement a technology control, that are encouraging people to do things a certain way. And these are all humans, right? So these are all humans that they're trying to influence behavior. So this is no longer a technical problem. This is a human problem that needs to be managed just like all of these other domains. So if you're sitting here today and you haven't worked cross-functionally in this web, I think there's an opportunity to do so as you're looking to really elevate your program and take a more risk-based approach.

7:03So why does this matter? The speakers touched on this at great length in the first round of talks. But with all of these challenges that we're facing, like why does this matter? Humans are the weakest link. How many of you have ever heard this phrase before? I've heard it many times, humans are the weakest link. It's a common phrase in our field. And I believe that it depicts the big problem that we are tasked to solve, right? The human problem. So there was a speaker from Forrester, Jessica, was talking about their approach.

7:38They recently published a report where they're predicting in 2024 that 90% of data breaches will include a human element. I believe the Verizon report a few years ago predicted or estimated at 75%. You know, 75, 90, it doesn't matter. At that point, we are in really high numbers here for incidents involving the human element. If you look at a lot of really blockbuster, big hit cyber attacks, you know, Twitter, MGM, there was a human behind these incidents that caused, you know, millions, hundreds of millions of dollars in damage.

8:15I believe it because I've seen it. We track incidents involving human element tags. We can talk a little bit about that later. But when there is a data breach, when there is a, not a data breach, but when there is an incident involving a human, we tag it so that we know, hey, the engagement team needs to get involved with the human element side of an incident. So humans are a significant factor in cybersecurity incidents. But then the question comes up, well, how do you manage this risk? Then what, right? Then what do you do? And as practitioners, you know, are we responsible for compliance? Are we responsible for communication, for marketing, learning and development, human risk management?

8:55Are we the cybersecurity PR team? The real reality of it all is that it's all the above and then some, right? And then some, that's kind of the like, what we're trying to figure out. I would argue that most security awareness programs traditionally have had two primary driving forces. First one is compliance driven and the second one is content driven. Compliance and content driven approaches are essential to a successful program at any stage of maturity. At minimum, we as practitioners need to be able to provide IT security control evidence about annual cybersecurity training.

9:32And then some more, let's say if you're practicing and with regulations that are covered by GDPR, there may be some more, but that's like baseline fundamental. And we need to be able to push out regular content to our users, such as during Cybersecurity Awareness Month. You know, that's low hanging fruit. In my opinion, that should be on repeat or covering monthly security topics. These are things that are kind of fundamental for our programs. But how else do we add value to our organization security posture, right? So by addressing real risks that an organization are facing today, we can really add value and help enhance our security posture and really elevate our program out of this, you know, nexus of compliance and learning and development.

10:19I believe that cybersecurity awareness and training can be an important component of cybersecurity incident response. This is the risk based in real time approach. So done successfully, it is the after the fact, the lessons learned, the education and outreach arm of an incident response plan. This is the how do we influence future behaviors so that we can reduce this type of risks over the next 12 months? I actually, I believe said it in the chat and I actually wrote it down. Technical controls won't ever be 100% effective.

10:57So we need our people to remain vigilant. That is very, very true. Not every incident will have any immediate technical fix. Sometimes a human outreach approach is the best mitigation while your cyber teams are working to create some sort of IT control, some sort of configuration to mitigate the risk. Again, the aim here is to influence future behaviors by increasing awareness. I like to use the term influence future behaviors. I think changing behaviors is really a tall order. I'm not looking to change. I'm hoping to influence them in the future.

11:34And this is a targeted approach, a targeted awareness approach for emerging cyber threats. So this is a huge value add in addition, in addition to covering baseline compliance or regulatory needs around security trainings. So we'll talk a little bit now about effective security awareness starts with personalization. And this kind of rolls off of the incident response component because typically those type of campaigns are very, very personalized and very much so risk-based. So in addition to incident response, effective security awareness training starts with a more personalized approach.

12:10We've heard this already today. And for me, this means addressing real risk that your organization is actively dealing with. So how do you do this, right? So go after your risk. How do you plan an effective security awareness training program or any type of campaigns if you don't know what the security gaps are or the risks that your technical teams are trying to design for, or maybe the risks that your leadership are really concerned about and they wanna address over a 12 month period. So work with your leadership team, work with the risk management team to understand what are the type of risks that they are worried about and then plan campaigns that help address the human element of those risks.

12:54Sorry if you can hear my dog barking. I have two great parodies and I think a delivery is here. So it's just chaos right now, but it's okay. So this approach will be a more personalized approach in nature. It will be in concert with your broader security teams. So while your colleagues are addressing the technical controls needed to reduce risk, your team is tasked with addressing the human element. Again, how do you influence future behaviors? This doesn't have to be a huge shift, right? It's not like we're reinventing the entire program. It could be a small pivot and it could also be an incremental pivot.

13:31So I wanna give you an example and this can oftentimes be a controversial topic in our field, but phishing simulations, right? Let's talk about phishing simulations. I do not phish. I do not have a phishing simulation program. I do not believe it to be entirely effective or irrelevant metric of my current security posture. Now this is my belief. I have phished in the past. I have been a part of teams that we phished monthly and we would send metrics monthly to leadership and to the board. I always found myself having trouble really talking through those metrics that I shared with leadership.

14:07You know, like the click rates and the report rates and whatever it may be. Here's an example that I'm sharing with you all. This is an actual example. This was actually one of the examples that made me propose a new approach to phishing. So this was Q1 FY22. You can see that we had a 22% click rate, you know, and then Q2 FY22, about the same population size, we had a 2% click rate. Why was there a 19% drop in failure rates, right, in click rates? While I would like to take credit for this, and I would like to say the engagement team has done a really good job of educating the workforce not to click on phishing emails.

14:47This wasn't accurate because we were still, we were still experiencing real phishing incidents where our incident response teams were having to get involved. So what was happening in the simulation world wasn't reflecting what was happening on the ground. When I reported these metrics to leadership, sometimes get more questions than you do praise, which made me think, "Is this really the best use of my time?" You know, we have limited resources. We have limited headcount. What else could I be doing to educating the workforce around phishing? Especially, you know, especially, again, with limited resources.

15:22My approach, instead, was to propose a phishing awareness program, phishing awareness program, which works with my detection and response team to identify real phishing campaigns that are targeting specific groups and organization. With that information, I can then create an awareness response that addresses the specific risk in real time alongside my incident response partners. The benefit of this is that I'm addressing real risk of organization. I'm working cross-functionally with my technical team to help enhance our overall security posture. And, you know, for an example like this, an awareness campaign can be anything from a quick email to a specific group of people that maybe have received this campaign.

16:05An overview of the phishing, you know, with an overview of this phishing email explaining why they received it in accounts payable or procurement or wherever it may be. It could also be a quick 15, 20 minute presentation and the next team all hands. I found this particular option to be very successful. I had this incident with our vendor management team related to a vendor email compromise. This is a really good way to make it personal. It is not a one size fits all approach. It is, I'm talking to David Tunley because he is in this role and this is what his team experienced recently. You get a lot of questions, a lot of engagement.

16:41And what we see is we see increased reporting of real events from that team. So we start to see an overwhelming amount of people saying, "Hey, Cyber, I remember y'all came and talked with us last week. We received this suspicious message. Can you guys check it out?" And that's the behavior that we're trying to influence. We want individuals to know who to turn to immediately when they don't feel comfortable engaging with some sort of messaging or some sort of action that they're not familiar with. That's the behavior we're hoping to influence. Another example is with our customer service team. We experienced this with our customer service team with phishing phone calls that they were receiving at the call center and the same approach.

17:22We went in, we spoke with the customer service team and what we have seen is increased reporting of actual events. I will say that sometimes they over report, but that's okay. Sometimes they're reporting spam or they're reporting vendors, they're cold calls. We all get those type of cold call emails or whatever it may be, but that's okay. That's the behavior that we're looking for. We're looking for people to be vigilant. We're looking for people to reach out to the cybersecurity team. Vendor email compromise. I kind of already talked about this. This is another example, but this is a huge human problem.

17:58The FBI estimates that vendor email compromise industry is worth over $26 billion. I've seen a lot of these attacks recently. This is a human problem because the red flags are really difficult to catch. These types of attacks are leveraging normal business relationships and normal work activities such as please pay invoice today from vendors that you have relationships with. This is an opportunity to engage with your vendor management team, your accounts payable team, accounts receivable team, procurement teams. This is an opportunity to review their internal processes for payments, invoices, changing bank information and suggesting updates if needed.

18:38I think it was Brian Krebs that was talking about the two person approach for changing any type of financial information or issuing any type of payment. That's gonna be documented in a policy. And if you're reviewing these processes and you're reviewing your policies, you don't own the policy, right? But you can review it. And if there are suggestions that you can make and you can point to data showing that your organization has had a significant amount of vendor email compromise reports and attempts of the past 12 months, and from a leadership perspective, who wouldn't wanna make an update to that policy? You can show, hey, this is a risk that we are dealing with and this is a human risk.

19:17We need to make updates to these processes, to these policies that are gonna help reduce this risk from a human perspective. That is a really good way to lead a risk-based approach that is then supported underlined by policy changes. So again, speak with your incident response team. Ask them if this is a problem. Is this something that your organization has experienced over the last 12 months? And if so, how many? It doesn't mean that you need to do something about it, but it'd be good to know, what are some incidents? Secure software development. This is another one. Addressing emerging threats in the software development space.

19:54I know that software development world can be very intimidating. I feel intimidated any time I'm talking about software development. It is highly technical, especially when we start talking about AI, but it is highly problematic from a security awareness perspective. The market makes it that way, right? We need to push out products. We need to be the first, and we'll worry about the bugs and the fixes later. Creating a department newsletter is a really easy way to tiptoe into software development world without making a huge splash. And again, it's a more tailored approach, working with your software development team, working with your secure software analysts, where whatever may be sharing information about some of the projects that they're working on, and what are some risks and some vulnerabilities that those teams need to be aware with.

20:37So again, this is a little bit more of a risk-based approach. And you can see here, here's an example, an email that related to vendor email compromise, that was sent out to a specific group of individuals. And we also include the actual email. So if you received it, you would have said, "Oh, I remember this email, and now the cyber team has brought it to my attention." And they're right, I thought it was suspicious. I didn't know I was supposed to report it, but now I do know. So I'm gonna make sure to report it next time. And then human risk-based approach.

21:13I mean, this is kind of what we're all talking about. Measuring human risk is difficult. It is really difficult, but I think that it is the next level of our program. It is the next level of our field. It's difficult because I've worked with teams that have a moat around the castle of cybersecurity incidents, where they don't talk about what is going on from an incident perspective. I'm a huge opponent of this dynamic, because I think without the information and the knowledge that your organization is facing, you're essentially fine blind, right? You're creating content for content's sake and throwing out and kind of seeing what sticks.

21:53This is what I call the wheel of fortune of security topics. You spin the wheel, see what it lands on and go with it. So for me, managing human risk, again, is that next level of program maturity. And I think of human risk as identifying and measuring the different ways that humans engage with the technology apparatus of your organization. I'll say that again, human risk is measuring the different ways that humans engage with the technology apparatus of your organization. If you look at this image here, you see all of these vendors, all of these companies here that provide security solutions or some sort of security product.

22:29Your team may have one of them, your team may have all of them. There is an opportunity here that these products and these technologies can tell you something about how humans are using that technology. And we would want to know that information because then we could use that information to identify specific risks, try to educate users and increase or reduce human risk exposure. I'll be fully transparent. I use the Living Security unified platform and I have been working with our team to tune these types of insights from an integration perspective to help guide our security awareness program.

23:10So pooling different data points and information about how humans are using this technology. So some example, do users have MFA enabled? Do users have USB removable media drives? Are users moving bulk data? If any particular answer to any of these questions increases your risk, then there is an opportunity to lead a human risk-based approach. I see that I am at time, so this is the last slide. I just want to, I'll leave it with this is the road to human risk-based cybersecurity awareness training.

23:46It is not quick, it is not easy, but it's possible. And I think it's really, really valuable to start having those conversations with your teams.