In the past 18 months we have seen an explosion of interest in both the field of Security Awareness and the role of the Security Awareness Officer. This includes an exponential increase in companies posting job opportunities for awareness officers, a three-fold increase in attendees for the SANS Awareness Summit this year (over 7,000 attendees), and almost 700 people who have completed the SANS Security Awareness Professional (SSAP) credential. As such, today we are going to help define what Security Awareness is all about.
First, both this role and field is still very immature. Unlike other security fields like penetration testing or incident response which have been around for decades, awareness is a comparatively new, immature and not yet fully defined field. In fact, the NIST NICE Cybersecurity Workforce taxonomy has yet to create or define or role for this field (but this is in the works to soon change).
Traditionally, when people discuss Security Awareness they think of compliance, someone responsible for pushing out Computer Based Training (CBT) once a year and then tracking what percentage of the workforce took the training for audit / compliance purposes. This is an extremely outdated and no longer valid description. While compliance is still important, Security Awareness today is ultimately about managing human risk. Organizations can no longer take a purely technical approach to cybersecurity we must also address the human element. In fact, the VZ DBIR 2021 report identified people were involved in over 85% of all breaches globally. This is why organizations establish mature Security Awareness programs, to manage their human risk by changing organizational behavior. In fact, the most mature Awareness programs go beyond just behavior change and build a strong security culture and have the metrics framework to demonstrate that change.
Today’s security awareness officer goes far beyond just annual CBT, in many ways they are experts in managing human risk. Skill sets and responsibilities include:
- RISK: Partnering with your security team to better understand and prioritize your top human risks, and the key behaviors that manage those risks. This often involves working with the Incident Response, Security Operations, or Cyber Threat Intelligence teams. The key to managing human risk is prioritizing and focusing on just your top risks, and not overwhelming your workforce with a huge list of impossible requirements, tasks, processes and responsibilities. The best and most effective awareness officers make security simple for people.
- TRAIN: Reaching out to, communicating, and engaging your workforce. Once you have identified the key behaviors that manage risk, you need to train your workforce on changing / exhibiting those key behaviors. This often requires partnering and working with other departments such as marketing, communications, and human resources. The best awareness officers have excellent people skills, enjoy working with and partnering with others, and a passion for helping people. The challenge is engaging and communicating to people in their terms. One of the most effective ways to engage is start with the Golden Circle.
- MEASURE: Finally, the most mature and effective awareness officers measure the impact of their program and communicate that impact to their leadership in business terms. There are a variety of different metrics types, to include behavioral, cultural, knowledge, and strategic. Ultimately your goal is to align the program with the strategic priorities of leadership.
This is an extremely exciting and fast growing field, as organizations struggle to better understand and manage their human risk. If you are interested in learning more or getting started in this field, I highly recommend you start with the blog post Getting Started in Cybersecurity With a Non-Technical Background and / or Career Path for Security Awareness Professionals.