homepage
Open menu
Go one level top
  • Train and Certify
    • Overview
    • Get Started in Cyber
    • Courses
    • GIAC Certifications
    • Training Roadmap
    • OnDemand
    • Live Training
    • Summits
    • Cyber Ranges
    • College Degrees & Certificates
    • Scholarship Academies
    • NICE Framework
    • Specials
  • Manage Your Team
    • Overview
    • Group Purchasing
    • Why Work with SANS
    • Build Your Team
    • Hire Cyber Talent
    • Team Development
    • Private Training
    • Security Awareness Training
    • Leadership Training
    • Industries
  • Resources
    • Overview
    • Internet Storm Center
    • White Papers
    • Webcasts
    • Tools
    • Newsletters
    • Blog
    • Podcasts
    • Posters & Cheat Sheets
    • Summit Presentations
    • Security Policy Project
  • Focus Areas
    • Cyber Defense
    • Cloud Security
    • Digital Forensics & Incident Response
    • Industrial Control Systems
    • Cyber Security Leadership
    • Offensive Operations
  • Get Involved
    • Overview
    • Join the Community
    • Work Study
    • Teach for SANS
    • CISO Network
    • Partnerships
    • Sponsorship Opportunities
  • About
    • About SANS
    • Our Founder
    • Instructors
    • Mission
    • Diversity
    • Awards
    • Contact
    • Frequently Asked Questions
    • Customer Reviews
    • Press
  • SANS Sites
    • GIAC Security Certifications
    • Internet Storm Center
    • SANS Technology Institute
    • Security Awareness Training
  • Search
  • Log In
  • Join
    • Account Dashboard
    • Log Out
  1. Home >
  2. Blog >
  3. Engaging Your Workforce in 2022
370x370_Lance-Spitzner.jpg
Lance Spitzner

Engaging Your Workforce in 2022

As we head into a new year, here are some tips on how to effectively engage, train, and secure a remote workforce.

January 27, 2022

One of the biggest challenges we consistently hear from security awareness professionals is how to effectively engage, train, and secure a remote workforce. Many of us thought remote working would end in 2021, that life would be back to normal. Many of us (including me) were wrong. So, as we head into 2022, what can we as security awareness professionals do? First, let’s better define what the key challenges are with a remote workforce in 2022.

Top Challenges

  • Overwhelmed: Just like the past two years, people in 2022 are overwhelmed as there is constant change. Working from home is just the beginning for many. Spouses' lives are also often changing, with where they work, how they work, or if they travel. People are quitting and starting new jobs. For those with families - school and their children's activities are constantly changing the rules on what is happening when and how. Simple things such as going to the doctor or dentist or getting work done on your house have become far more complicated. As such, people are greatly stressed out and can barely keep up with their daily personal work lives, let alone worry about cybersecurity.
  • Technology: Now that people are working from home, long-term companies are giving people far more access to more systems and more sensitive data. With this access comes more technical challenges, people are in many ways having to become their own help desk. For example, people are having to learn how to securely share files, update and coordinate calendars, request time off or collaborate online with teams using a variety of different Cloud-based tools. Each tool often has a different interface, different configuration options and may need to be maintained by the individual. While these tools may be easy for some of us, they are often confusing for many others. In addition, especially in larger organizations these tools are often changing. Dumping a variety of new, highly-technical / confusing security technologies on people only makes the matters worse, pick the acronym of your choice - FDE, 2FA, VPN, SSO, MDM, IAM, EDR, etc.
  • Under Resourced: Unfortunately, for many organizations managing their human risk is an afterthought, often cybersecurity is perceived as only or primarily as a technical effort. As a result, many security awareness teams are horribly understaffed, often just one person responsible for an organization of ten or twenty thousand people. This means whatever solution awareness professionals come up with has to be simple to plan, build, and manage.

Overcoming Challenges

So how do we overcome these challenges and what are the top tips for awareness professionals as we head into 2022?

  • Keep it Simple: People are overwhelmed, so we need to limit what we ask of them - we need to keep security as simple as possible for people. The first step is identify and focus on only your top human risks and the key behaviors that reduce those risks. Sending people a newsletter with the top 25 steps to secure their home is not going to do anyone good as no one has the time to read or follow all those steps. Explaining that recent APT activity has exhibited TTP’s targeting people’s authentication credentials and that is the reason why all VPNs are moving to 2FA is only going to lose the vast majority of your audience. Focus on the fewest behaviors that have the greatest impact, and communicate them in a simple, concise way that anyone can easily follow. Have someone non-technical write or at least review the training materials (perhaps partner with Communications or Marketing to help), that the materials are written in a way that anyone can understand it. Content created by highly technical people tends to be written for highly technical people.
  • Focus on Personal Benefit / Home: Want to get people's attention? Focus on how they personally benefit, such as how to secure their personal finances, their homes, or their kids. Communicate and engage in a way that people personally benefit. Not only are people far more likely to listen and change behaviors, but the behaviors are the same for both home and work. The top indicators for a phishing attack are the same regardless if you are at work or at home. Strong passwords are the same for work and at home. Updating your systems is important at work and at home. Focus on how people personally benefit and they are far more likely to listen and change.
  • Training & Engagement: Email is only going to get you so far as people are overwhelmed. You need to find an easy way to connect that works with people. Here you have to get a little creative as every organization is different in both its culture and how it operates. Two key concepts to effective engagement; keep it short and make it interactive. Going to do a webcast? Skip the slides and make it a dynamic interview with someone on the security team or do a live stream that supports real-time interaction with your audience and keep it under 30 minutes. People tired of hearing from you? Invite an outside guest speaker. If you are based in the US perhaps someone from the FBI, IRS, FTC or Secret Service. Skip the blog and instead create an interactive online forum using technologies like Slack or MS Teams. If your culture is a good fit, gamify the learning experience with simple events such as online Scavenger Hunts. Looking to push the envelope a little bit? Consider memes, infographics or micro-videos. Ultimately create content you would want to reach / watch.

Learn more about how SANS can help to build and mature your security awareness training program!

Have a tip or lesson learned on how you are successfully engaging? We want to hear from you! Reach out to me at lspitzner@sans.org.

For further ways to ensure your security awareness program stays ahead of this year's threats and challenges, check out our recent Cut Through the Noise conversation! 

Share:
TwitterLinkedInFacebook
Copy url Url was copied to clipboard
Subscribe to SANS Newsletters
Receive curated news, vulnerabilities, & security awareness tips
United States
Canada
United Kingdom
Spain
Belgium
Denmark
Norway
Netherlands
Australia
India
Japan
Singapore
Afghanistan
Aland Islands
Albania
Algeria
American Samoa
Andorra
Angola
Anguilla
Antarctica
Antigua and Barbuda
Argentina
Armenia
Aruba
Austria
Azerbaijan
Bahamas
Bahrain
Bangladesh
Barbados
Belarus
Belize
Benin
Bermuda
Bhutan
Bolivia
Bonaire, Sint Eustatius, and Saba
Bosnia And Herzegovina
Botswana
Bouvet Island
Brazil
British Indian Ocean Territory
Brunei Darussalam
Bulgaria
Burkina Faso
Burundi
Cambodia
Cameroon
Cape Verde
Cayman Islands
Central African Republic
Chad
Chile
China
Christmas Island
Cocos (Keeling) Islands
Colombia
Comoros
Cook Islands
Costa Rica
Croatia (Local Name: Hrvatska)
Curacao
Cyprus
Czech Republic
Democratic Republic of the Congo
Djibouti
Dominica
Dominican Republic
East Timor
East Timor
Ecuador
Egypt
El Salvador
Equatorial Guinea
Eritrea
Estonia
Ethiopia
Falkland Islands (Malvinas)
Faroe Islands
Fiji
Finland
France
French Guiana
French Polynesia
French Southern Territories
Gabon
Gambia
Georgia
Germany
Ghana
Gibraltar
Greece
Greenland
Grenada
Guadeloupe
Guam
Guatemala
Guernsey
Guinea
Guinea-Bissau
Guyana
Haiti
Heard And McDonald Islands
Honduras
Hong Kong
Hungary
Iceland
Indonesia
Iraq
Ireland
Isle of Man
Israel
Italy
Jamaica
Jersey
Jordan
Kazakhstan
Kenya
Kingdom of Saudi Arabia
Kiribati
Korea, Republic Of
Kosovo
Kuwait
Kyrgyzstan
Lao People's Democratic Republic
Latvia
Lebanon
Lesotho
Liberia
Liechtenstein
Lithuania
Luxembourg
Macau
Macedonia
Madagascar
Malawi
Malaysia
Maldives
Mali
Malta
Marshall Islands
Martinique
Mauritania
Mauritius
Mayotte
Mexico
Micronesia, Federated States Of
Moldova, Republic Of
Monaco
Mongolia
Montenegro
Montserrat
Morocco
Mozambique
Myanmar
Namibia
Nauru
Nepal
Netherlands Antilles
New Caledonia
New Zealand
Nicaragua
Niger
Nigeria
Niue
Norfolk Island
Northern Mariana Islands
Oman
Pakistan
Palau
Palestine
Panama
Papua New Guinea
Paraguay
Peru
Philippines
Pitcairn
Poland
Portugal
Puerto Rico
Qatar
Reunion
Romania
Russian Federation
Rwanda
Saint Bartholemy
Saint Kitts And Nevis
Saint Lucia
Saint Martin
Saint Vincent And The Grenadines
Samoa
San Marino
Sao Tome And Principe
Senegal
Serbia
Seychelles
Sierra Leone
Sint Maarten
Slovakia (Slovak Republic)
Slovenia
Solomon Islands
South Africa
South Georgia and the South Sandwich Islands
South Sudan
Sri Lanka
St. Helena
St. Pierre And Miquelon
Suriname
Svalbard And Jan Mayen Islands
Swaziland
Sweden
Switzerland
Taiwan
Tajikistan
Tanzania
Thailand
Togo
Tokelau
Tonga
Trinidad And Tobago
Tunisia
Turkey
Turkmenistan
Turks And Caicos Islands
Tuvalu
Uganda
Ukraine
United Arab Emirates
United States Minor Outlying Islands
Uruguay
Uzbekistan
Vanuatu
Vatican City
Venezuela
Vietnam
Virgin Islands (British)
Virgin Islands (U.S.)
Wallis And Futuna Islands
Western Sahara
Yemen
Yugoslavia
Zambia
Zimbabwe

Recommended Training

  • MGT512: Security Leadership Essentials for Managers
  • MGT521: Leading Cybersecurity Change: Building a Security-Based Culture
  • MGT433: Managing Human Risk: Mature Security Awareness Programs

Tags:
  • Security Awareness

Related Content

Blog
Security Awareness
February 25, 2022
Russian Invasion of Ukraine - What to Communicate to Your Workforce
Focusing on cybersecurity fundamentals is key to protecting both yourself and your workforce at home and at work during these unprecedented times.
370x370_Lance-Spitzner.jpg
Lance Spitzner
read more
Blog
Security Awareness
February 15, 2022
Nation State Threat Actors: From a Security Awareness Perspective
What you should focus on teaching your workforce when defending against nation state threat actors.
370x370_Lance-Spitzner.jpg
Lance Spitzner
read more
Blog
Security Awareness
February 14, 2022
The Annual SANS Security Awareness Report Survey is Now Open
Once a year, every year SANS surveys thousands of awareness professionals from around the world to create a snapshot of our industry.
370x370_Lance-Spitzner.jpg
Lance Spitzner
read more
  • Register to Learn
  • Courses
  • Certifications
  • Degree Programs
  • Cyber Ranges
  • Job Tools
  • Security Policy Project
  • Posters & Cheat Sheets
  • White Papers
  • Focus Areas
  • Cyber Defense
  • Cloud Security
  • Cyber Security Leadership
  • Digital Forensics
  • Industrial Control Systems
  • Offensive Operations
Subscribe to SANS Newsletters
Receive curated news, vulnerabilities, & security awareness tips
United States
Canada
United Kingdom
Spain
Belgium
Denmark
Norway
Netherlands
Australia
India
Japan
Singapore
Afghanistan
Aland Islands
Albania
Algeria
American Samoa
Andorra
Angola
Anguilla
Antarctica
Antigua and Barbuda
Argentina
Armenia
Aruba
Austria
Azerbaijan
Bahamas
Bahrain
Bangladesh
Barbados
Belarus
Belize
Benin
Bermuda
Bhutan
Bolivia
Bonaire, Sint Eustatius, and Saba
Bosnia And Herzegovina
Botswana
Bouvet Island
Brazil
British Indian Ocean Territory
Brunei Darussalam
Bulgaria
Burkina Faso
Burundi
Cambodia
Cameroon
Cape Verde
Cayman Islands
Central African Republic
Chad
Chile
China
Christmas Island
Cocos (Keeling) Islands
Colombia
Comoros
Cook Islands
Costa Rica
Croatia (Local Name: Hrvatska)
Curacao
Cyprus
Czech Republic
Democratic Republic of the Congo
Djibouti
Dominica
Dominican Republic
East Timor
East Timor
Ecuador
Egypt
El Salvador
Equatorial Guinea
Eritrea
Estonia
Ethiopia
Falkland Islands (Malvinas)
Faroe Islands
Fiji
Finland
France
French Guiana
French Polynesia
French Southern Territories
Gabon
Gambia
Georgia
Germany
Ghana
Gibraltar
Greece
Greenland
Grenada
Guadeloupe
Guam
Guatemala
Guernsey
Guinea
Guinea-Bissau
Guyana
Haiti
Heard And McDonald Islands
Honduras
Hong Kong
Hungary
Iceland
Indonesia
Iraq
Ireland
Isle of Man
Israel
Italy
Jamaica
Jersey
Jordan
Kazakhstan
Kenya
Kingdom of Saudi Arabia
Kiribati
Korea, Republic Of
Kosovo
Kuwait
Kyrgyzstan
Lao People's Democratic Republic
Latvia
Lebanon
Lesotho
Liberia
Liechtenstein
Lithuania
Luxembourg
Macau
Macedonia
Madagascar
Malawi
Malaysia
Maldives
Mali
Malta
Marshall Islands
Martinique
Mauritania
Mauritius
Mayotte
Mexico
Micronesia, Federated States Of
Moldova, Republic Of
Monaco
Mongolia
Montenegro
Montserrat
Morocco
Mozambique
Myanmar
Namibia
Nauru
Nepal
Netherlands Antilles
New Caledonia
New Zealand
Nicaragua
Niger
Nigeria
Niue
Norfolk Island
Northern Mariana Islands
Oman
Pakistan
Palau
Palestine
Panama
Papua New Guinea
Paraguay
Peru
Philippines
Pitcairn
Poland
Portugal
Puerto Rico
Qatar
Reunion
Romania
Russian Federation
Rwanda
Saint Bartholemy
Saint Kitts And Nevis
Saint Lucia
Saint Martin
Saint Vincent And The Grenadines
Samoa
San Marino
Sao Tome And Principe
Senegal
Serbia
Seychelles
Sierra Leone
Sint Maarten
Slovakia (Slovak Republic)
Slovenia
Solomon Islands
South Africa
South Georgia and the South Sandwich Islands
South Sudan
Sri Lanka
St. Helena
St. Pierre And Miquelon
Suriname
Svalbard And Jan Mayen Islands
Swaziland
Sweden
Switzerland
Taiwan
Tajikistan
Tanzania
Thailand
Togo
Tokelau
Tonga
Trinidad And Tobago
Tunisia
Turkey
Turkmenistan
Turks And Caicos Islands
Tuvalu
Uganda
Ukraine
United Arab Emirates
United States Minor Outlying Islands
Uruguay
Uzbekistan
Vanuatu
Vatican City
Venezuela
Vietnam
Virgin Islands (British)
Virgin Islands (U.S.)
Wallis And Futuna Islands
Western Sahara
Yemen
Yugoslavia
Zambia
Zimbabwe
  • © 2022 SANS™ Institute
  • Privacy Policy
  • Contact
  • Careers
  • Twitter
  • Facebook
  • Youtube
  • LinkedIn