Join us for the FREE Cyber Defense Forum | Live Online on October 9


Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

Human Resources And Training Departments Key To Securing The Human

Security awareness training must be given more importance as likelihood of human error leading to a security breach increases

  • United Kingdom
  • 1st October 2014

As part of European Cyber Security Awareness Month (ECSM), Lance Spitzner, Director, SANS Institute suggests that human resource departments have a critical role to play in helping their organisations improve information security procedures. "Organisations are beginning to realise that they have to secure the human element as technology can only go so far," says Spitzner, an internationally recognised leader in the field of cyber threat research and security training and awareness.

ECSM is a European Union advocacy campaign that takes place in October. ECSM aims to promote cyber security among citizens, to change their perception of cyber-threats and provide up to date security information, through education and sharing good practices.

"As long as people store, process or transfer information, they too must be secured. One of the most effective ways to secure employees is to change their behaviours through an active, long term security awareness program," adds Spitzner who has spoken to and worked with numerous organisations, including the NSA, FIRST, the Pentagon, the FBI Academy, the President's Telecommunications Advisory Committee, MS-ISAC, the Navy War College and the British CESG.

According to the SANS Director, based on the available evidence, it is extremely likely that every large organisation will experience an information security breach at some point in time. According to the influential Data Breach Investigation Report (DBIR) which has examined over 100,000 security breaches over the last decade, 81% of the incidents can be described by just 4 root causes namely miscellaneous errors (27%), insider misuse (19%), crimeware (19%) and physical theft/loss (16%).

The biggest factor "miscellaneous errors" is, according to the report, simply any mistake that compromises security. The main threat comes from human error, such as accidentally posting private data to a public site, sending information to the wrong recipients, or failing to dispose of documents or assets securely. However, lack of security awareness also has a part to play in insider misuse, physical theft and lost incidents.

"In the past organisations have had security awareness programs, but these were compliance driven programs designed by auditors to ensure their organisation could 'check the box'. These programs consisted of nothing more than a once year Power Point presentation or some very basic Computer Based Training (CBT)," says Spitzner, "In recent years, organisations have begun a fundamental shift on how they approach awareness and training. They are building mature security awareness programs that identify and change high-risk human behaviours."

Spitzner advocates the first task is gaining support of management and answering the key questions of Who?, What? and How? "Once you have a program rolled out you will need the ability to measure it. Measuring provides several things. First it helps you identify where your greatest risks are and where you need to focus your efforts. Second, it can be used to demonstrate the value of the program to senior management, gaining you the support you need to keep the program long term," he adds.

To further support ECSM, Spitzner is running a webinar session offering a step-by-step walk through of how to take your security awareness program to the next level. The session covers key points including how to leverage the Security Awareness Maturity Model, how to effectively engage people, and how to measure change in behaviour and communicate those results to management. Registration for complimentary webinar is available via

SANS 'Securing The Human' is a partner and supporter of ECSM and has also made available a set of community resources on how to build a high-impact security awareness program developed as community projects by hundreds of different security awareness officers available via Details regarding SANS training course, "Building High Impact Security Awareness Programs", can found here:

Media Contact

About SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals in government and commercial institutions worldwide. Renowned SANS instructors teach more than 60 courses at In-Person and Live Online cyber security training events, and more than 50 courses are available anytime, anywhere with our OnDemand platform. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 35 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers a master’s degree, graduate certificates, and an undergraduate certificate in cyber security. SANS Security Awareness, a division of SANS, provides organizations with a complete and comprehensive security awareness solution, enabling them to easily and effectively manage their ‘human’ cybersecurity risk. SANS also delivers a wide variety of free resources to the InfoSec community including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system – the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to support and educate the global information security community. (