What’s the single greatest challenge of running a security awareness
program? In November 2015 SANS Securing The Human surveyed 369 security
awareness professionals from around the world and asked them: What is the single biggest challenge you are facing? This
question was part of the larger 2106 Security Awareness Report that
measures the current state of security awareness programs around the
world.
Five security professionals from different industries and roles
volunteered to analyze the survey results, including Bob Rudis (team
lead for 2015 Verizon DBIR), Dr. Lance Hayden (author People Centric
Security) and Dr. Angela Sasse (Professor, University College of
London). This team of community experts analyzed the data to identify
what are the top challenges facing security awareness professionals and
how to overcome them. The end goal of the report is to enable
organizations to create truly mature security awareness programs and
benchmark their program against others. Two critical topics emerged from
the analysis:
1. LACK OF RESOURCES, TIME AND SUPPORT: Security
awareness program professionals are constrained in their ability to
execute. The top three limitations cited were lack of leadership
support, limited budgets and lack of time. Of the three, data shows lack
of leadership support to have the greatest impact on awareness program
maturity. The most surprising number was that the majority of security
awareness personnel spend 25% or less of their time on awareness, the
remaining time is taken with other responsibilities.
2. NOT HAVING AN IMPACT: The
second theme was the inability to engage employees and change
behaviors, indicating that programs are not "sticking" the way their
leaders would like.
Knowing these challenges is only half the battle. Security awareness
professionals also need to know the solutions, which we provide in the
report. Download the 2016 Security Awareness Report now or see the archived webcast with Dr. Lance Hayden, Bob Rudis and Lance Spitzner as they go over the key findings.
About the Securing the Human Security Awareness Report
In its second year, the Securing the Human Security Awareness report is the most comprehensive and credible survey of the state of security awareness. Over 350 security awareness professionals were surveyed to understand their key challenges, goals and roles.
