John Wiley & Sons Transformational Security Awareness Cover Expert guidance on the art and science of driving secure behaviors Transformational Security Awaren.. Product #: 978-1-119-56634-2 Regular price: $26.07 $26.07 In Stock

Transformational Security Awareness

What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors

Carpenter, Perry

Cover

1. Edition June 2019
368 Pages, Softcover
Wiley & Sons Ltd

ISBN: 978-1-119-56634-2
John Wiley & Sons

Buy now

Price: 27,90 €

Price incl. VAT, excl. Shipping

Further versions

epubmobipdf

Expert guidance on the art and science of driving secure behaviors

Transformational Security Awareness empowers security leaders with the information and resources they need to assemble and deliver effective world-class security awareness programs that drive secure behaviors and culture change.

When all other processes, controls, and technologies fail, humans are your last line of defense. But, how can you prepare them? Frustrated with ineffective training paradigms, most security leaders know that there must be a better way. A way that engages users, shapes behaviors, and fosters an organizational culture that encourages and reinforces security-related values. The good news is that there is hope. That's what Transformational Security Awareness is all about.

Author Perry Carpenter weaves together insights and best practices from experts in communication, persuasion, psychology, behavioral economics, organizational culture management, employee engagement, and storytelling to create a multidisciplinary masterpiece that transcends traditional security education and sets you on the path to make a lasting impact in your organization.
* Find out what you need to know about marketing, communication, behavior science, and culture management
* Overcome the knowledge-intention-behavior gap
* Optimize your program to work with the realities of human nature
* Use simulations, games, surveys, and leverage new trends like escape rooms to teach security awareness
* Put effective training together into a well-crafted campaign with ambassadors
* Understand the keys to sustained success and ongoing culture change
* Measure your success and establish continuous improvements

Do you care more about what your employees know or what they do? It's time to transform the way we think about security awareness. If your organization is stuck in a security awareness rut, using the same ineffective strategies, materials, and information that might check a compliance box but still leaves your organization wide open to phishing, social engineering, and security-related employee mistakes and oversights, then you NEED this book.

Foreword xxi

Introduction xxiii

I The Case for Transformation 1

1 You Know Why 3

Humans Are the Last Line of Defense 4

Data Breaches Tell the Story 6

Auditors and Regulators Recognize the Need for Security Awareness Training 11

Traditional Security Awareness Program Methods Fall Short of Their Goals 14

Key Takeaways 16

References 17

2 Choosing a Transformational Approach 19

Your "Why" Determines Your "What" 20

Down the Rabbit Hole 21

Outlining the Key Components and Tools of a Transformational Program 24

A Map of What's to Come 28

Part 1 in a Nutshell 30

Part 2 in a Nutshell 30

Part 3 in a Nutshell 31

Key Takeaways 32

Notes and References 32

II The Tools of Transformation 35

3 Marketing and Communications 101 for Security Awareness Leaders 37

The Communications Conundrum 38

The Marketing Connection 40

Defining Marketing 44

Embedding Your Messages 53

Get the Right Message to the Right Person at the Right Time 70

Campaigns: If You Aren't Reinforcing, Your Audience Is Forgetting 76

Tracking Results and Measuring Effectiveness 76

Know When to Ask for Help 77

Key Takeaways 78

Notes and References 78

Additional Reading 81

4 Behavior Management 101 for Security Awareness Leaders 83

Your Users Aren't Stupid, They're Human 85

Thinking, Fast and Slow 87

System 1 Thinking 88

System 2 Thinking 91

Working with Human Nature Rather Than Against 93

The Nuts and Bolts of Shaping Behavior 96

The Fogg Behavior Model 97

The Problem with Motivation 103

Nudge Them in the Right Direction 103

Frames: Why Context Is Everything 109

Designing and Debugging Behavior 117

Being Intentional with Target Groups 117

Debugging Behaviors 118

Design "Power Prompts" Wherever Possible 122

Password Management Example, Continued 123

Habits Make Hard Things Easier to Do 130

Thinking About Guardrails 132

Tracking Results and Measuring Effectiveness 133

Key Takeaways 134

Notes and References 135

Additional Reading 137

5 Culture Management 101 for Security Awareness Leaders 141

Security Culture is Part of Your Larger Organizational Culture 144

Getting Started 147

Understanding Your Culture's Status Quo 149

Go Viral: Unleash the Power of Culture Carriers 156

Cultures in (Potential) Conflict: Remember Global and Social Dynamics 164

Cultural Forces 165

Structures 167

Pressures 167

Rewards 169

Rituals 169

Tracking Results and Measuring Effectiveness 171

Key Takeaways 171

Notes and References 172

Additional Reading 174

6 What's in a Modern Security Awareness Leader's Toolbox? 175

Content Is King: Videos, Learning Modules, and More 176

Big Box Shopping: A Content Analogy 178

Types of Content 181

Experiences: Events, Meetings, and Simulations 186

Meetings, Presentations, and Lunch-and-Learns 187

Tabletop Exercises 188

Rituals 189

Webinars 190

Games 190

Simulated Phishing and Social Engineering 191

Other Simulations and Embodied Learning 192

Interactions with Other Technologies 193

Relationships: Bringing Context to Content and Experiences 194

Be Intentional and Opportunistic, Always 195

Stories and Analogies 195

Tapping into Cultural Trends 195

Opportunistic Campaigns Based on New Organizational Initiatives and Current Events 196

The Critical "At Home" Connection 197

Use Your Metrics and Anecdotes to Help Tell and Reinforce Your Story 197

Key Takeaways 198

Notes and References 198

7 Voices of Transformation: Interviews with Security Awareness Vendors 201

Anna Collard, Popcorn Training 201

Chris Hadnagy, Social Engineer 204

Drew Rose, Living Security 209

Gary Berman, The CyberHero Adventures: Defenders of the Digital Universe 211

Jason Hoenich, Habitu8 214

Jim Shields, Twist and Shout 217

Kai Roar, CLTRe 219

Lisa Plaggemier, InfoSec Institute 221

Masha Sedova, Elevate Security 224

Stu Sjouwerman, KnowBe4 226

Tom Pendergast, MediaPRO 228

Winn Schwartau, The Security Awareness Company (SAC) 231

Reference 236

III The Process of Transformation 237

8 Living Your Awareness Program Through the Eyes and Lives of Your Audience 239

A Learner Journey Map: Awareness in the Context of Life 240

Key Takeaways 248

Notes and References 248

9 Putting It All Together 251

Before You Begin 252

The Five Secrets of Security Awareness Success 252

Tips for Gaining Buy-In 259

Leverage Cialdini's Principles of Persuasion 264

Making Adjustments 269

Thoughts About Crafting Campaigns 269

Thinking Through Target Groups 271

Be Intentional with Recognition and Reward 277

Assembling Your Culture Carriers 277

Measuring Your Success 278

What Does the Future Hold? 279

Key Takeaways 280

Notes and References 281

10 Closing Thoughts 283

Leverage the Power of Community. 283

Be a Lifelong Learner 285

Be a Realistic Optimist 290

Conclusion 291

11 Voices of Transformation: Interviews with Security Awareness Program Leaders 293

Bruce Hallas, Marmalade Box 294

Carlos Miró, MUFG Union Bank 296

Dr. Cheryl O. Cooper, Sprint Corporation 298

Krina Snider, Sprint 302

Mark Majewski, Quicken Loans 305

Michael Lattimore, Independent Consultant 307

Mo Amin, Independent Consultant 311

Prudence Smith, Senior Cyber and Information Security Consultant and Industry Speaker 313

Thom Langford, (TL)2 Security 320

Tory Dombrowski, Takeform 323

Appendix: Seven Key Reminder Nudges to Help Your Recall 329

Index 331
PERRY CARPENTER is the Chief Evangelist and Strategy Officer for KnowBe4, the world's most popular security awareness and simulated phishing platform. A former security awareness researcher and CISO advisor at Gartner Research, he now works closely with Kevin Mitnick, arguably the world's most famous hacker. Perry frequently addresses management audiences at major cybersecurity conferences.