One of the biggest challenges we consistently hear from security awareness professionals is how to effectively engage, train, and secure a remote workforce. Many of us thought remote working would end in 2021, that life would be back to normal. Many of us (including me) were wrong. So, as we head into 2022, what can we as security awareness professionals do? First, let’s better define what the key challenges are with a remote workforce in 2022.
Top Challenges
- Overwhelmed: Just like the past two years, people in 2022 are overwhelmed as there is constant change. Working from home is just the beginning for many. Spouses' lives are also often changing, with where they work, how they work, or if they travel. People are quitting and starting new jobs. For those with families - school and their children's activities are constantly changing the rules on what is happening when and how. Simple things such as going to the doctor or dentist or getting work done on your house have become far more complicated. As such, people are greatly stressed out and can barely keep up with their daily personal work lives, let alone worry about cybersecurity.
- Technology: Now that people are working from home, long-term companies are giving people far more access to more systems and more sensitive data. With this access comes more technical challenges, people are in many ways having to become their own help desk. For example, people are having to learn how to securely share files, update and coordinate calendars, request time off or collaborate online with teams using a variety of different Cloud-based tools. Each tool often has a different interface, different configuration options and may need to be maintained by the individual. While these tools may be easy for some of us, they are often confusing for many others. In addition, especially in larger organizations these tools are often changing. Dumping a variety of new, highly-technical / confusing security technologies on people only makes the matters worse, pick the acronym of your choice - FDE, 2FA, VPN, SSO, MDM, IAM, EDR, etc.
- Under Resourced: Unfortunately, for many organizations managing their human risk is an afterthought, often cybersecurity is perceived as only or primarily as a technical effort. As a result, many security awareness teams are horribly understaffed, often just one person responsible for an organization of ten or twenty thousand people. This means whatever solution awareness professionals come up with has to be simple to plan, build, and manage.
Overcoming Challenges
So how do we overcome these challenges and what are the top tips for awareness professionals as we head into 2022?
- Keep it Simple: People are overwhelmed, so we need to limit what we ask of them - we need to keep security as simple as possible for people. The first step is identify and focus on only your top human risks and the key behaviors that reduce those risks. Sending people a newsletter with the top 25 steps to secure their home is not going to do anyone good as no one has the time to read or follow all those steps. Explaining that recent APT activity has exhibited TTP’s targeting people’s authentication credentials and that is the reason why all VPNs are moving to 2FA is only going to lose the vast majority of your audience. Focus on the fewest behaviors that have the greatest impact, and communicate them in a simple, concise way that anyone can easily follow. Have someone non-technical write or at least review the training materials (perhaps partner with Communications or Marketing to help), that the materials are written in a way that anyone can understand it. Content created by highly technical people tends to be written for highly technical people.
- Focus on Personal Benefit / Home: Want to get people's attention? Focus on how they personally benefit, such as how to secure their personal finances, their homes, or their kids. Communicate and engage in a way that people personally benefit. Not only are people far more likely to listen and change behaviors, but the behaviors are the same for both home and work. The top indicators for a phishing attack are the same regardless if you are at work or at home. Strong passwords are the same for work and at home. Updating your systems is important at work and at home. Focus on how people personally benefit and they are far more likely to listen and change.
- Training & Engagement: Email is only going to get you so far as people are overwhelmed. You need to find an easy way to connect that works with people. Here you have to get a little creative as every organization is different in both its culture and how it operates. Two key concepts to effective engagement; keep it short and make it interactive. Going to do a webcast? Skip the slides and make it a dynamic interview with someone on the security team or do a live stream that supports real-time interaction with your audience and keep it under 30 minutes. People tired of hearing from you? Invite an outside guest speaker. If you are based in the US perhaps someone from the FBI, IRS, FTC or Secret Service. Skip the blog and instead create an interactive online forum using technologies like Slack or MS Teams. If your culture is a good fit, gamify the learning experience with simple events such as online Scavenger Hunts. Looking to push the envelope a little bit? Consider memes, infographics or micro-videos. Ultimately create content you would want to reach / watch.
Learn more about how SANS can help to build and mature your security awareness training program!
Have a tip or lesson learned on how you are successfully engaging? We want to hear from you! Reach out to me at lspitzner@sans.org.