10 things disney can teach us about running a security awareness program (download to have gifs...
TRANSCRIPT
10 THINGS DISNEY CAN TEACH US ABOUT RUNNING A
Ashley Schwartau • @AshleySchwartauCreative Director, The Security Awareness Company • @SecAwareCo
TheSecurityAwarenessCompany.com
Creative Director for 6 yearsWorking for SAC for 14 yearsLead developer of all training materialsWorked with over 80 companies75 employees – 75,000 employees
Disney taught me a lot growing upFun, fresh way of presenting same old topics can lead to better retentionInline with our company philosophy of having fun with security awareness
TALE AS OLD AS TIMEEver just the same
Ever a surpriseEver as before
Ever just as sureAs the sun will riseTale as old as time
Don’t reinvent the wheel.
TALE AS OLD AS TIME
Has security changed at all?Common sense (look in the Trojan horse before accepting it)Avoid scams (snake oil salesmen)Protect confidential information (loose lips sink ships)
Forget about the tech.
TALE AS OLD AS TIME
Focus on foundations.
TALE AS OLD AS TIME
Learn to dance.Security Triads.Improve your vocabulary.
HONOR TO US ALLScarier than the undertaker
We are meeting our matchmakerDestiny
Guard our girlsAnd our future
as it fast unfurlsPlease look kindly onthese cultured pearls
Each a perfect porcelain doll
Please bring honor to us
WHY educate users? Why is this program necessary?
HONOR TO US ALL
Understanding WHY helps everyone:Bring honor to your organization.
HONOR TO US ALL
THE WORK SONG
Cinderelly, CinderellyNight and day it's CinderellyMake the fire, fix the breakfastWash the dishes, do the moppingAnd the sweeping and the dustingThey always keep her hopping She goes around in circlesTill she's very, very dizzyStill they holler
Keep a-busy Cinderelly!We can do it, we can do it
We can help our CinderellyWe can make her dress so pretty
There's nothing to it, reallyWe'll tie a sash around it
Put a ribbon through itWhen dancing at the ball
She'll be more beautiful than allIn the lovely dress we'll make for Cinderelly
THE WORK SONG
Remember: Cinderella didn’t do it alone. And neither can you.
THE WORK SONG
Get people to help you.
Interns?Minions?Assistants? Like-minded co-workers?Someone to help spread the word.Someone to help DO THE WORK.
You need mice.
THE WORK SONG
Get people to help you.
C-level support is key!MoneyMoraleMotivation
And a Fairy Godmother.
ONE JUMP AHEAD
One jump ahead of the lawmenThat's all, and that's no joke
These guys don't appreciate I'm broke
ONE JUMP AHEAD
Gotta keep one jump ahead of the…
Reactive vs. PreventativeNot just current problems. Look ahead.
PROBLEMS.
ONE JUMP AHEAD
Gotta keep one jump ahead of the…
Big picture: What do you NEED?Money? Team members? Content?Plan a whole year in advance.
BUDGET.
GO THE DISTANCE
GO THE DISTANCE
Don’t half-ass it.
Commit to educating your users.
Commit to regularity and frequency Commit to changing culture.
GO THE DISTANCE
Why run a marathon if you’re not going to train for it?
Plan ahead.Think about your needs.Help yourself reach the finish line.
GO THE DISTANCE
It’s not going to be easy.
(But neither were the 12 labors of Hercules.)
LES POISSONS, LES POISSONS
Les poissons, les poissonsHow I love les poissons
Love to chop and to serve little fishFirst I cut off their heads
Then I pull out their bonesAh mais oui, ca c'est toujours délice
Your diet should consist of more than just Phish.
Human error. Having (and enforcing) policies.Not knowing what PII is.Using personal devices for company information.Public WiFiPasswords
LES POISSONS, LES POISSONS
Use phishing as a launching point.
Vishing and SmishingTypes of MalwareEmail managementSocial Media ScamsSocial Engineering
LES POISSONS, LES POISSONS
Incorporate phishing/soc eng into other lessons.Cyber: holiday scams, strong unique logins, don’t share TMI, ID theft.
Physical: shredding policies, dumpster diving, USB sticks.
Human: con artists, pretexting & other phone scams, pentesting.
LES POISSONS, LES POISSONS
YOU CAN FLY
When there's a smile in your heartThere's no better time to startThink of all the joy you'll findWhen you leave t he world behindAnd bid your cares good-byeYou can fly! You can fly! You can fly!
YOU CAN FLY
Make your users care by making it about them.
Why should I pay attention to this training?How does this affect ME?I care about: protecting my money, protecting my health data, protecting my kids and family, etc.Teach me how to protect ME and I’ll listen.
YOU CAN FLY
Empower your users through education.Educated users make educated decisions.Educated users make better human firewalls.Human firewalls build your front lines of defense.
YOU CAN FLY
Give them the pixie dust of security awareness.
A SPOONFUL OF SUGAR
In every job that must be doneThere is an element of funYou find the fun and SNAP
The job’s a game.
A SPOONFUL OF SUGAR
How did Mary Poppins get those kids to obey her?Use humor!Sing a song!Short videos!Realistic scenarios.Gamify your training!Contests & Prizes!
A SPOONFUL OF SUGAR
Be a modern day Mary Poppins.
LET IT GO
It's funny how some distanceMakes everything seem smallAnd the fears that once controlled meCan't get to me at all!
It's time to see what I can doTo test the limits and break throughNo right, no wrong, no rules for me I'm free!
LET IT GO
Be prepared to let go of…. PRECONCEPTIONS.
Not every user is the problem.Not all training works for all people.Don’t assume they won’t listen.
LET IT GO
Be prepared to let go of…. EXPECTATIONS.Not an overnight solution. Long game. Won’t be 100% effective.
LET IT GO
Be prepared to let go of….STUFF THAT’S NOT WORKING.
The past is in the past. What problem is most important NOW?Reassess & reevaluate throughout the year.
LET IT GO
Be bold, strong and daring like Elsa.
CIRCLE OF LIFE
CIRCLE OF LIFE
Security Awareness is a delicate balance.
Confidentiality, Integrity, AvailabilityCyber, Physical, HumanPersonal, Professional, MobilePeople, Policies, TechnologyC-Levels, Tech Staff, Users
CIRCLE OF LIFE
Security Awareness is not an end goal.
Not something we “achieve”Not a one time thing.Like exercise, eating healthy, learning to drive, etc.Like advertising: they don’t want you to buy it ONCE but over and over again.
CIRCLE OF LIFE
Security Awareness is a mindset and a way of life.
Tale As Old As TimeHonor to Us AllThe Work Song
One Jump AheadGo the Distance
Les Poissons, Les PoissonsYou Can Fly
A Spoonful of SugarLet It Go
Circle of Life
to help you whistle while you work
@SecAwareCo • #SecurityCatFree.TheSecurityAwarenessCompany.comBlog.TheSecurityAwarenessCompany.com
