Transformational Security Awareness

PERRY CARPENTER is the Chief Evangelist and Strategy Officer for KnowBe4, the world's most popular security awareness and simulated phishing platform. A former security awareness researcher and CISO advisor at Gartner Research, he now works closely with Kevin Mitnick, arguably the world's most famous hacker. Perry frequently addresses management audiences at major cybersecurity conferences.

• Foreword xxiIntroduction xxiiiI The Case for Transformation 11 You Know Why 3Humans Are the Last Line of Defense 4Data Breaches Tell the Story 6Auditors and Regulators Recognize the Need for Security Awareness Training 11Traditional Security Awareness Program Methods Fall Short of Their Goals 14Key Takeaways 16References 172 Choosing a Transformational Approach 19Your “Why” Determines Your “What” 20Down the Rabbit Hole 21Outlining the Key Components and Tools of a Transformational Program 24A Map of What’s to Come 28Part 1 in a Nutshell 30Part 2 in a Nutshell 30Part 3 in a Nutshell 31Key Takeaways 32Notes and References 32II The Tools of Transformation 353 Marketing and Communications 101 for Security Awareness Leaders 37The Communications Conundrum 38The Marketing Connection 40Defining Marketing 44Embedding Your Messages 53Get the Right Message to the Right Person at the Right Time 70Campaigns: If You Aren’t Reinforcing, Your Audience Is Forgetting 76Tracking Results and Measuring Effectiveness 76Know When to Ask for Help 77Key Takeaways 78Notes and References 78Additional Reading 814 Behavior Management 101 for Security Awareness Leaders 83Your Users Aren’t Stupid, They’re Human 85Thinking, Fast and Slow 87System 1 Thinking 88System 2 Thinking 91Working with Human Nature Rather Than Against 93The Nuts and Bolts of Shaping Behavior 96The Fogg Behavior Model 97The Problem with Motivation 103Nudge Them in the Right Direction 103Frames: Why Context Is Everything 109Designing and Debugging Behavior 117Being Intentional with Target Groups 117Debugging Behaviors 118Design “Power Prompts” Wherever Possible 122Password Management Example, Continued 123Habits Make Hard Things Easier to Do 130Thinking About Guardrails 132Tracking Results and Measuring Effectiveness 133Key Takeaways 134Notes and References 135Additional Reading 1375 Culture Management 101 for Security Awareness Leaders 141 Security Culture is Part of Your Larger Organizational Culture 144Getting Started 147Understanding Your Culture’s Status Quo 149Go Viral: Unleash the Power of Culture Carriers 156Cultures in (Potential) Conflict: Remember Global and Social Dynamics 164Cultural Forces 165Structures 167Pressures 167Rewards 169Rituals 169Tracking Results and Measuring Effectiveness 171Key Takeaways 171Notes and References 172Additional Reading 1746 What’s in a Modern Security Awareness Leader’s Toolbox? 175Content Is King: Videos, Learning Modules, and More 176Big Box Shopping: A Content Analogy 178Types of Content 181Experiences: Events, Meetings, and Simulations 186Meetings, Presentations, and Lunch-and-Learns 187Tabletop Exercises 188Rituals 189Webinars 190Games 190Simulated Phishing and Social Engineering 191Other Simulations and Embodied Learning 192Interactions with Other Technologies 193Relationships: Bringing Context to Content and Experiences 194Be Intentional and Opportunistic, Always 195Stories and Analogies 195Tapping into Cultural Trends 195Opportunistic Campaigns Based on New Organizational Initiatives and Current Events 196The Critical “At Home” Connection 197Use Your Metrics and Anecdotes to Help Tell and Reinforce Your Story 197Key Takeaways 198Notes and References 1987 Voices of Transformation: Interviews with Security Awareness Vendors 201Anna Collard, Popcorn Training 201Chris Hadnagy, Social Engineer 204Drew Rose, Living Security 209Gary Berman, The CyberHero Adventures: Defenders of the Digital Universe 211Jason Hoenich, Habitu8 214Jim Shields, Twist and Shout 217Kai Roar, CLTRe 219Lisa Plaggemier, InfoSec Institute 221Masha Sedova, Elevate Security 224Stu Sjouwerman, KnowBe4 226Tom Pendergast, MediaPRO 228Winn Schwartau, The Security Awareness Company (SAC) 231Reference 236III The Process of Transformation 2378 Living Your Awareness Program Through the Eyes and Lives of Your Audience 239A Learner Journey Map: Awareness in the Context of Life 240Key Takeaways 248Notes and References 2489 Putting It All Together 251Before You Begin 252The Five Secrets of Security Awareness Success 252Tips for Gaining Buy-In 259Leverage Cialdini’s Principles of Persuasion 264Making Adjustments 269Thoughts About Crafting Campaigns 269Thinking Through Target Groups 271Be Intentional with Recognition and Reward 277Assembling Your Culture Carriers 277Measuring Your Success 278What Does the Future Hold? 279Key Takeaways 280Notes and References 28110 Closing Thoughts 283Leverage the Power of Community. 283Be a Lifelong Learner 285Be a Realistic Optimist 290Conclusion 29111 Voices of Transformation: Interviews with Security Awareness Program Leaders 293Bruce Hallas, Marmalade Box 294Carlos Miró, MUFG Union Bank 296Dr. Cheryl O. Cooper, Sprint Corporation 298Krina Snider, Sprint 302Mark Majewski, Quicken Loans 305Michael Lattimore, Independent Consultant 307Mo Amin, Independent Consultant 311Prudence Smith, Senior Cyber and Information Security Consultant and Industry Speaker 313Thom Langford, (TL)2 Security 320Tory Dombrowski, Takeform 323Appendix: Seven Key Reminder Nudges to Help Your Recall 329Index 331