MGT521: Leading Cybersecurity Change: Building a Security-Based Culture

Build and Measure a Strong Security Culture

Drawing on real-world lessons from around the world, the SANS MGT521 course will teach you how to leverage the principles of organizational change in order to develop, maintain, and measure a security-driven culture. Through hands-on instruction and a series of interactive labs and exercises, you will apply these concepts to a variety of different real-world security initiatives and quickly learn how to embed cybersecurity into your organization's culture immediately.

Apply findings from Daniel Kahnemans Nobel prize-winning research, Thayler and Sunstein's Nudge Theory, and Simon Sinek's Golden Circle. Learn how Spock, Homer Simpson, the Elephant and Rider and the Curse of Knowledge all are keys to building a strong cybersecurity culture at your company.

"This content is helping bring back concepts that get forgotten when you go from a doer to a senior leadership role. It brought back good concepts and a way to utilize them in the Security Context as well as getting leadership to think differently." - Michael Neuman

BUSINESS TAKEAWAYS:

• Create a far more secure workforce, both in their attitudes about cybersecurity and also in employee behaviors
• Enable the security team to create far stronger partnerships with departments and regions throughout the organization
• Dramatically improve the ROI of cybersecurity initiatives and projects through increased success and impact
• Improve communication between the cybersecurity team and business leaders
• Create stronger and more positive attitudes, perceptions and beliefs about the cybersecurity team

SKILLS LEARNED:

• More effectively communicate the business value of cybersecurity to your Board of Directors and executives, improve collaborate with your peers, and more effectively engage your workforce
• Explain what organizational culture is, its importance to cybersecurity, and how to map and measure both your organization's overall culture and security culture
• Align your cybersecurity culture to your organization's strategy, including how to leverage different security frameworks and maturity models
• Explain what organizational change is, identify different models for creating change, and learn how to apply those models
• Enable and secure your workforce by integrating cybersecurity into all aspects of your organization's culture
• Dramatically improve both the effectiveness and impact of your security initiatives, such as DevSecOps, Cloud migration, Vulnerability Management, Security Operations Center and other related security deployments
• Create and effectively communicate business cases to leadership and gain their support for your security initiatives
• How to measure your security culture and how to present the impact of a strong security culture to leadership
• Leverage numerous templates and resources from the Digital Download Package and Community Forum that are part of the course and which you can then build on right away

HANDS-ON TRAINING:

This five-section course includes 16 interactive labs that walk you through exercises and apply the lessons learned to a variety of typical real-world security situations and challenges. Many of the labs are carried out as teams, ensuring that you learn not only from the course materials but from other students and their experiences. Finally, the last section is a capstone event as you work through a series of case studies to see which team can create the strongest security culture. Culture is a very human and global challenge, and as such we want to expose you to as many different situations and perspectives as possible.

No Laptop Required. "Labs" are group case studies with no computers needed.

"Labs are applicable to the coursework and can be used at my workplace immediately." - Jerome C., US Military

"I love the way each lab built on previous topics covered culminating in the last day where we could apply everything we learnt. Everytime we did a lab they were well explained and at no time did i feel rushed, or like we had too much time to complete them." - Helen Bupa, IPLS

"Labs today were fun. Made me think with a focused intent." - Chad Yancey

SYLLABUS SUMMARY:

• Section 1: Learn the fundamentals of organizational culture, security culture and organizational change.
• Section 2: Communicate to, engage with, and motivate your workforce so cybersecurity is perceived as a positive enabler
• Section 3: Train and enable your workforce so cybersecurity is simple for them.
• Section 4: Learn how to build a business case for leadership, gaining their support for your security initiatives
• Section 5: Apply everything you have learned in a series of five case-studies, competing as teams to see which team can build the strongest cybersecurity culture.

NOTICE TO STUDENTS:

The course is recommended for more senior and/or more experienced cybersecurity leaders, managers, officers, and awareness professionals. If you are new to cybersecurity, we recommend some of SANS's more fundamental courses, such as SEC301: Introduction to Cyber Security, SEC401: Security Essentials: Network, Endpoint, and Cloud, or MGT433: Managing Human Risk: Mature Security Awareness Programs.

ADDITIONAL FREE RESOURCES:

• For those of you who are looking to get involved in the human side of cybersecurity, or are already involved but looking to grow, consider reading this blog on how to develop your career path.
• Rekt Casino Hack Assessment Transformational Series: Feeble Security Culture Disconnected from Business Objectives
• Transformational Cybersecurity Leadership Triad

WHAT YOU WILL RECEIVE:

• Printed Course Books
• Digital Download Package: A collection of templates, checklists, matrices, reports, and other resources that will help you in your cybersecurity career. This package is continually updated and is based on resources that real cybersecurity leaders have used in developing their own cybersecurity cultures. Why reinvent the wheel when you can reuse or reshape what has worked for others!
• Community Forum: An opportunity to join the private, invitation-only Community Forum dedicated to the human side of cybersecurity. The forum currently has over 2,000 active professionals from around the world!
• One 90-day license to the entire SANS Security Awareness EndUser content library including sample learning paths. Read the FAQ here.

WHAT COMES NEXT:

• MGT512: Security Leadership Essentials for Managers
• MGT514: Security Strategic Planning, Policy, and Leadership