Summary:
Timothy De Block hosts a lively discussion with Maeve Mueller on the perennial challenge of Cyber Security Awareness Month (CSAM). They dive into the logistics, triumphs, and frustrations of planning events that actually engage employees. The conversation covers everything from the effectiveness of different activities (like "watch and win" contests and "pitch a fish" competitions), the delicate balance of fear vs. education in phishing campaigns, and the logistical nightmares of organizing in-person events. They also explore the emerging concept of Human Risk Management and why good security awareness is ultimately just good marketing and relationship building.
Key Takeaways
Logistics
The Struggle is Real: Timothy was "so far behind" on CSAM planning, scrambling to get materials out after October 1st, highlighting the significant time commitment required for impactful programs. Maeve, despite starting planning in June, still feels like she's "running around with like my head cut off" in October.
The Power of Swag and Food: Free food, particularly good quality food (like the Costco lunch spread Timothy plans), is a reliable way to drive attendance to in-person events. Maeve noted the success of handing out donuts to draw people to their booth.
Creative Engagement: Rote training doesn't work. Successful events involve engaging formats:
Watch and Win Contests: Offering prizes for completing training modules, though people often just let videos play in the background.
Cybersecurity Mythbusters: Demonstration-based presentations that disprove common security myths, like showing how a password cracker works.
Pitch a Phish Competition: Encouraging teammates to create their own phishing emails to target a fake persona, which turns the tables and increases participation.
The Booth Approach: Setting up a booth in the office lobby with swag, info cards, and food (like donuts) is effective for broad outreach.
Logistical Challenges: The planning process is fraught with administrative issues, such as setting up registration forms (with Microsoft Forms being preferred over glitchy Microsoft Teams registration) and the time sink of cleaning up after in-person events (like the popcorn machine that takes 30 minutes to clean).
The Human Element and Future of the Field
Marketing Secure Behavior: Security awareness is fundamentally about marketing secure behaviors. Timothy and Maeve agree that the ultimate goal is to figure out how to make people care about security in their personal lives, which will then bleed over into their work habits.
"Department of K.N.O.W.": Maeve highlights the need for the security team to be the "department of KNOW" rather than the "department of NO," as constant negativity leads users to circumvent controls and create Shadow IT.
The Cybercriminal's Target: Cybercriminals have learned it's cheaper and easier to target the individual than to hack an organization's technology. Maeve stresses the need to tell stories about cybercrime compounds and the human element of the attack to shock employees into awareness.
Human Risk Management (HRM): The movement toward HRM involves leveraging AI to look at the "full person"—analyzing phishing results, training completion, and telemetry from other security tools. This data-driven approach positions security awareness to collect overall human risk data.
Building Community: Both hosts emphasize the value of relationships—both with internal business partners and with the external security awareness community. Timothy is launching a Security Advocates Program to pull in non-security employees and champion secure messages.
Support the Podcast:
Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.
Contact Information:
Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.
Check out our services page and reach out if you see any services that fit your needs.