Evolving from Annual Security Compliance Training to Risk-Based Policy and Training

Auto-generated from the live recording.

0:07Hi everyone, thanks for joining this session and a big thank you to Living Security for having me here at their annual Human Risk Management Conference. My name is Michele Kim. I'm the Head of Business Information Risk at Fitch Group and one of the functions I manage is human behavior risk. I'm going to talk about how our program at Fitch has evolved over the years and what I've learned along the way that I wish someone had showed me before. As security professionals, we all have the knowledge and vision of how the program should look like. However, the challenge I faced was in the implementation piece, transforming this theoretical knowledge and vision into a tangible program.

0:46I found myself wishing for a concrete example to look at how others policies look like, how others phishing program is run, so I can use them as starting points for my programs. Throughout the slides, I try to use actual examples of the contents from my program so that hopefully you can take away a thing or two, whether you are new to the role or revamping an existing program. Okay, before I dive into the content, I want to mention that this is not about maturing your program, according to the many maturity models out there.

1:24It's easy for many of us to get boggled down with these models, probably because as security professionals, we are used to applying structured cybersecurity frameworks. But just like how we apply the frameworks, these maturity models should be used as a guideline and not as a Bible. We shouldn't be afraid to mix them to suit our culture so that we can ultimately create phases that fits our own organization. Today, I'm going to talk about the different phases that my organization went through and how we've evolved over the years to creating risk-based programs.

2:03Okay, so phase one. During this period, the notion of having a comprehensive security awareness program didn't really exist. What we did have was the most basic form of compliance training, compliance-driven annual training, I should say, a couple with a single article published in October for cybersecurity awareness month. The only feedback I received during that time was around how long and boring the training was. This phase happened to us during COVID when our employees were working remote mostly. Fortunately for us, the interest in online safety was increasing during this time.

2:41It was a good time for us to refresh our annual training and enhance our publications. We published something like 35 articles in two-year period during this phase. We also started conducting phishing campaigns for the first time, which gave us a chance to evaluate whether our employees were effectively retaining the knowledge from our many articles. Although the phishing campaigns were generally well-received, the failure rate was rather high as expected. It was clear that we needed to do something more than just articles about general security, maybe more on the personal side, like home network or online safety for kids since everyone was spending most of the time at home.

3:22So I published a personal security guide that tailored to their home and added a bit about phishing tips for personal email. But guess what? It's the same tips as business emails. Feedback was very positive. People were starting to spot phishing and reporting more. This experience has taught me that the most effective way to engage an audience in any context is to address the question, how does this impact me on a personal level? I'll talk more about this in the later slides. During this phase, this was a time when the employees were getting somewhat virtually fatigued from all the online activities.

4:02Our readership of the security articles had noticeably gone down, and the phishing, clicking, and reporting rate wasn't improving much. People were creating more interactions with their colleagues, especially the new joiners, who never got a chance to socialize with their colleagues. So the first step we took after noticing this was to introduce events that their colleagues can participate together. We use Living Security CSAM package. Big shout out, woo hoo. It provided us with cyber escape room for gamification training, where colleagues can team up and play for a chance to win prizes together.

4:37It also provided us with a mentalist session for family engagement with kids, and a keynote speaker who gave excellent insights on different forms of social engineering. To take things up a notch, from publishing traditional articles, we also introduced Phish Tank, which is a central repository site that displays real phishing emails that were reported by our own colleagues. The goal of this was to introduce, educate employees on how to spot phishing by providing real life examples for reference.

5:12We also started to publish a firm wide monthly newsletter, which combined both corporate and personal security. Remember what I mentioned about answering to a question, how does this personally impact me on the previous slide? It'll reach more audience if the content touches them personally. This newsletter, by the way, is the only communication that has been consistently distributed on a monthly basis to our entire firm for the past two years since we began its publication, Tap Tap. At the end of phase three, we were switching to a hybrid schedule of being in the office part-time, so we decided to do our first in-person event.

5:49We set up a table by the cafeteria, introduced ourselves, and some security tips. We also partnered with our volunteering team to create an event relating to cybersecurity education for kids. Phase four is our current phase, where we introduce risk-based programs. There are two programs that I've implemented based on risk, an improvement program, and a reward program based on phishing campaigns. Over the years of conducting phishing tests, our stats show that it's only a small number of people that repeatedly fail the phishing campaigns and also repeatedly report them.

6:28In our company, it was less than 2% of the firm for each of the behaviors, interestingly. Actually, if we have time, a question for the audience, if you can put it in the chat, is a 2% higher or lower than your organization? I would love to get some baseline. We don't have to stop, but we can, if you guys can put it in the chat. Okay, in terms of these high-risk repeat clickers, it was clear that these 2% that we needed to aim for targeted training. It was also clear that if there are no accountability for failing phishing campaigns, the campaigns are not going to be effective no matter how many times we test them.

7:08I mean, who cares if nobody cares, right? It's an improvement program for these high-risk repeat clickers. I've published a phishing accountability procedure. We called it a procedure instead of a policy, since this is not setting a guideline for what should be done, but rather outlining specific actions to achieve results. I apologize that I can't share what's exactly in the procedure, but I wanted to at least share this template so it'll help you as a starting point. The procedure should state why you're doing this, who's in scope, and how you're going to track the repeat clickers.

7:49Also, list specific actions you will take for the number of fails and clearly define compliance versus non-compliant measures. Now, at the time of implementing these actions to repeat clickers, I was getting nervous. Unlike what we've done in the other phases, this was targeting them directly. We were emailing the users as well as their management for awareness. I was afraid of the potential backlash from the repeat clickers and the potential lack of management support. But to my surprise, the feedback had been very supportive, especially from the managers.

8:25The only inquiry we got from the repeat clickers was to verify which campaigns they had failed. A lot of them didn't even realize that they had failed so many times. I do want to mention that when creating a policy like this, you should consult with different partners for their expertise as well as get their buy-in before publishing the policy. Nobody likes surprises, especially these folks, right? In contrast to the improvement program for the repeat clickers, I also introduced Phish Hall of Fame to recognize the 2% of the repeat reporters who continuously report more than half of the phishing campaigns received.

9:09Unlike the accountability procedure where we've minimized user exposure, I felt the users of this program deserve a wide recognition to their management as well as the entire firm. I published their names on the firm-wide article as well as on our firm-wide newsletter. I've also emailed all of their managers to take a moment to personally congratulate them on their commitment to cybersecurity. This year, we've even published top 10 reporters creating a competition field and also highlighted repeat inductees from the year before, which were about 60% for us. The feedback on this program was phenomenal.

9:46The managers responded back with many kudos for their team members, as well as for us for creating the program. In a typical behavior change model, studies have shown that positive reinforcement tends to be more effective because they enforce preferred behaviors by linking them to positive incentives. As I mentioned in the beginning, the takeaway here is that there's no single model that suits all of us. For my program, I've applied both positive and negative consequence models because both models suited for our risk level. The key thing here is, is that no matter which model you choose or both, you should make sure that it complements your own organizational culture and has the support of the management team.

10:30Before I end the session, I wanted to mention about working with few other partners in your organization that will help you enhance the quality of your work. Aside from the partners I've mentioned already, I wanted to mention two more partners, the internal communications and the design team, if your organization has them. The internal communications team can help you polish your message to the audience and the design team can do wonders to enhance your presentation of your message. I'm going to show you some examples of how the design team in particular came to my rescue.

11:06This is one of the slides in the personal security guide that I mentioned. It shows my text heavy PPT version on the left side and the interactive design version on the right. If you're the user, which one would you prefer to read? Same with the emails. This is an actual email we've sent to the Phish Hall of Fame inductees. Left is a draft I created as a template. The right one is the same message, but with an email and a signature banner, the design team created for us. If you are the recipient of this email, which one would make you more happy?

11:43At the end of the day, users just want security to be easy for them to use and understand. In our line of business, little things like this do matter because we work with people. It'll take us one step close to changing their behavior. Thank you. I hope I did good on time. Sandy, let's open up for questions if there are any. Yes, you did excellent on time. I appreciate. We actually were able to buy some more time. So we have some time for questions. There was some response to the 2% of repeat clickers. It looks like that is pretty low.

12:19That does seem like a pretty good one. On the report side, that's 2% of repeat reporters seems very low to me. So I wonder what it is now. Is it much better? We're in the monitoring stage actually. So we just published, we just actioned the steps in the accountability procedure this year. And we also just published the Phish Hall of Fame for the second year, not too long ago. So we're still in the monitoring stage, but we're hoping to get it up. Awesome. And how often are you doing simulations? We do on a monthly basis, but it's not the same audience that it targets.

12:57It's a targeted audience. So we do firm wide about four times a year and rest are targeted training, targeted testing. Great. There's one request to go back to your gotcha slide, which had a lot of interesting information. Which one is the gotcha slide? Let's see. Which ones? I think a little before you had, you had some things to call out.

13:37Oh, this one, you've been phished? I don't. I think it was more towards the beginning of the presentation. Okay. So this was the first slide. I think, I have a feeling they're referring to the McDonald's one, no? Okay, maybe so, yeah. Okay, so what was the question on that one? By the way, this is not an email of the actual phishing email. We published an article based on the first email, first phishing email we conducted, which was on McDonald's.

14:17And again, this was the combination work of both the internal communications team and the design team, where they created, like as soon as people hovered over this McDonald's sign, they would immediately see the screen on the right. I just captured it both on the same screen. So it made it very eye-catching. Oh, very cool. Very interactive. We do have a question around whether you have any suggestions for scaling to a very large audience. So dealing with, you know, 100,000 or more, a more user, you talked about targeting different groups and how you do that, how would you picture scaling that?

15:01Okay, so if they're referring to the repeat clicker program, an improvement program, I think no matter like, you know, whether your firm has a global presence or even if it's a small business, I think the same logic applies, right? It's on the number of different fails that the action should be stated for, and not necessarily the number of folks or depending on the region or whatnot. It's not the number of people, but I think it's the action per the number of fails that it should apply.

15:38And same thing with Phish Hall of Fame. But now I get the point though, with the whole Phish Hall of Fame, I've listed out 100 and there was about 120 of the inductees this year. So I've listed 120 of their names. So yeah, if you work for 100,000 people firm, I get that. Yeah, I guess there could be other creative ways. Maybe your firm has an automated process where, you know, some companies, you can just bring in people's profile picture or like a little business card onto where they can post the articles for the internet, right? So maybe it can be used that way instead of just printing them out, or you can use the design and creative team like I did to create some kind of, you know, poster.

16:21It could be 10 pages. The important thing here is to give them the recognition. No matter how many people there are, I believe in spelling out their full names so that they can be recognized and also contacting their managers. Now the one bit that I didn't mention in our partners is that in order to contact them, contact the users and the managers, we partnered up with a RPA team. I think they're called robotic process automation teams so that we don't have to manually email those people with copying their managers, but they were able to automate it for us. Maybe your company will have something like that that you're able to email hundreds of thousands of people if need be in an automated way.

17:04Yeah, I don't know if you caught mine in this same track earlier today. We talked about some of that orchestration and as things bubble up, you know, you can trigger automatic messages via Slack or email out, you know, in basically real time to that effect. So yeah, we have early versions of that. We're continuing to build that out. So yeah, we should talk about that more. Okay. - There are some more questions and I think we do have a decent amount of time.

17:39So one is around how you handle escalations within the program around, you know, accountability. So, you know, many of us are probably seen or heard of or been a part of, you know, organizations with punitive, you know, for repeat clickers. How do you handle that accountability piece? And then also on the positive side with recognition. Yeah, so I mentioned before that I was lucky enough to not get the backlash from the users, but we did have, you know, onesies and twosies of like, "Hey, you know, I don't remember clicking on this."

18:18You know, "Are you sure of your stats?" You know, "Are you sure like I'm your repeat clicker?" And they had some complaints about the assigned training, et cetera. Now, my approach was to handle this in a personal level. Like, how does this impact me personally? Like, you know, that seems to be my ongoing message here, but I talked to them, I called them, I set up a meeting with them, and then discussed, "Here are the stats that we pulled. Here are the campaigns that you clicked on on this date." And even had a time. So given the data, they couldn't really say much after that.

18:55But in terms of like, you know, "Hey, this type of training doesn't suit our company," or, you know, "Doesn't suit my line of work," blah, blah, blah. And I said, "Okay, if the assigned training is not suited for you, there are plenty of others that I can assign, but the point is that you finish one of them." And I also tried to take them, get their feedback. I was like, "Okay, so if you don't like this training, why is that?" And if you like this training, the later one I signed, "Why is that one? Why is that you like that better?" So I used it as an opportunity to get the user feedback at the same time. And with the reporter, it was just a lot of, you know, kudos emails from the managers, mostly, then, "Hey, you know, my team member, Joe, has always been an advocate of your program.

19:40You know, I better step up to be more like the team member." Like, you know, that was the reaction that we were getting. So no negative connotations there, because it's not meant to be taken any negatively. And hopefully the reaction is going to be same for your organization as well. Right. In these examples, have you done any correlation, you know, to look at the level of the employee, the role, or the access that they had when they are a repeat clicker or a repeat reporter, to kind of understand the impact that that could have?

20:16Yeah, so going back to my slide here, yeah, this one. So under, in the middle section, where it lists the number of fails, like the actions for the number of fails, you'll see that third time fail with sensitive roles. So people like, people like NIT or accounting that have special access to like the more privileged roles that are heavier targeted for the phishing attacks, right?

20:53So for those, we have separate actions assigned to them. It's not a one training for all method. And the special training for them include like one-on-one session with our security members, such as me, and a targeted training based on their role. Makes sense, that sounds good. Some other questions here. So one around, are you still doing mandatory annual training or have you discontinued that? Yeah, yeah, so we are still doing it because it has a lot of information that's specific to our company. You know, it has like the data classification, it has like a lot of pitch specific things that we want people to know, security wise.

21:37So we still kept it. But I know that the trend is to kind of move away from, you know, one training once a year and kind of move into like micro-training multiple times a year. So that's something that I'm considering. But at the time, these supplemental training is only assigned to the targeted audience such as the repeat clickers, but the annual mandatory training is still being done by the entire company. But we do continuously update them. Great, I think, yeah, and that kind of answers Justine's question around, you know, following and, you know, evolving with changes in behavior and trying to continue to keep your training content changing and very relevant to what's going on.

22:25So that sounds good. I don't think, did I miss any questions? Yeah, thank you for keeping track of them 'cause I can't do two things at once. No, absolutely, this is great. And maybe it looks like your phase four, someone was hoping to see that phase four slide again. Ah, wait, so phase four are just the two programs, the improvement program and the reward-based program. And then I got into the actual slides and the actual content in the other slides.

23:05Excellent, so as you continue to build this out as you're thinking about 2024 and beyond, what are kind of the next behaviors or the next things you're looking to be measuring and tracking and potentially building out in terms of reward and risk-based improvement programs? Yeah, so we're currently in the monitoring stage, as I mentioned. So we rolled out these programs, these targeted trainings that we've never done before. So it'll be interesting to see the results. And based on those results, either we may need to break them down, as you mentioned, maybe into a departmental level, maybe into the regional level, whatnot, but it's to be continued or to be considered after we see the results.