Information Security Awareness - It's Time We Know What Works

Michael G. Carr, CISO, University of Kentucky

Michael G Carr, CISO, University of Kentucky, Mike is the Chief Information Security Officer (CISO) for the University of Kentucky. He earned his Juris Doctor (JD) degree from the Salmon P. Chase ... More >>

For over 3 years now, the National Cyber Security Alliance has worked diligently to “increase and reinforce awareness of cyber security” via its STOP. THINK. CONNECT.™ campaign; however, evidence is lacking that this global awareness program or any other information security awareness program is effective. In fact, since information security training and awareness campaigns have been listed as key ingredients of an overall Cyber Security Program, there has not been a comprehensive analysis of what works and what doesn’t. As a result, information security professionals have taken to “throwing everything at the wall and hoping something sticks.” This has got to stop. If sales and marketing professionals can learn what it takes to convince a consumer to purchase product “A” over product “B”, it is time the information industry knows what it will take to modify behavior so as to increase online safety and security without scaring this same community back to the dark ages.

Unfortunately, making such an assertion is much harder than it sounds: simply identify a cyber security awareness slogan, icon, or training methodology that permeates the airwaves, cuts through today’s online clutter, and results in a workforce that doesn’t fall for phishing emails, understands that financial institutions will never email requests for account owners’ passwords, and is conscientious in applying the latest operating system and client-side application software patches. Just as importantly, we must know why the slogan is effective and why it is able to get consumers and employees to modify their thinking and behavior.

Without understanding “why” a particular awareness campaign works, the information industry will not be prepared for when the next generation of cybercrime and malware is effective on the next generation of Netizens. For this reason, research into cyber security awareness campaign effectiveness is paramount.

Forty years before the personal computer was born, the Advertising Council created the advertising mascot/ icon Smokey Bear (who is, often, incorrectly called Smokey the Bear) to educate Americans about the dangers of forest fires and wildfires. Per the Ad Council, 95% of adults recognize Smokey Bear and his slogan, “Remember… Only YOU Can Prevent Forest Fires”; however, I am unaware of any research and measure of effectiveness that emphatically concludes the U.S. National Park Service’s investment in the Smokey Bear advertising campaign has reduced the number of forest fires or wildfires. This is not to say that our beloved Smokey Bear campaign is not worthwhile. It is just that everyone is extremely cost conscientious and measuring an advertising campaign’s return on investment (and then investing only in effective campaigns) is a necessary evil; however, it implies a correlation between a message or training and something that doesn’t happen. And this “proving of a negative” will also be an issue in an effectiveness measure of just about every cyber security awareness campaign: we might be able to determine why a consumer clicks on a link but will we be able to determine which catchy slogan or training tidbit caused someone not to open a malicious attachment?

CIO Review Clients : Flagship , PCMI

Media Partner : CIO Review | B2B Online 2020

CIO Review Press Releases : CIO Review | One Stop Systems

CIO Review | ComplianceQuest

Top Enterprise Security Consulting Companies