led to the theft of reportedly billions of dollars of information and intellectual property. (I gave it all back.)
My “victims” then had me go back to their organizations and tell the stories about what I did, as a form of security awareness. The users were mesmerized by my stories. I heard about some successes in improved awareness, but when I went back for further assessments, the reality was that no real improvement had occurred. Just telling stories and telling people what not to do has limited impact.
Over two decades, I created and supported dozens, if not hundreds, of awareness programs for organizations of all types and sizes. I was able to see what worked best and what didn’t. I found that many of the common beliefs and strategies just didn’t work. They sounded great, but they were specious.
I also learned how to tell when awareness efforts were doomed to failure. More important though, I learned what works and how best to implement awareness programs.
This book shows how to implement the strategy that I found (through decades of experience) actually works. It helps you cut through hype and platitudes and begin doing what actually works. Platitudes and hype sound noble, but they are frequently misleading. Some of what I describe might go against what is considered common practice; however, you must consider that common practice has led to few improvements over decades. With that in mind, consider my perspective and determine what works best for your purposes. No guarantee exists of what will or won’t work in any given situation.
Take this insight into account as you read this book and choose your own path.
To help you choose that path and make the content more accessible, I’ve divided this book into four parts:
Part 1, “Getting to Know Security Awareness”: An overview of the fundamental concepts and philosophies of security awareness
Part 2, “Building a Security Awareness Program”: The building blocks of an awareness program
Part 3, “Putting Your Security Awareness Program into Action”: Creating and implementing your program
Part 4, “The Part of Tens”: Quick guidance for optimizing your program
The appendix provides a sample assessment questionnaire.
Foolish Assumptions
My fundamental assumption is that I have no assumptions except that you are interested in addressing human vulnerabilities. You may be a CISO who wants to get a handle on how to better address the most common attacks against your organization. You may run awareness programs and want to enhance your current efforts. You may have been randomly assigned to run an awareness program and have little idea where to start. Or you may simply be interested in becoming a more well-rounded cybersecurity professional. This book definitely provides a valuable addition to your knowledge base.
Regardless of your role or position in your organization, if you’re interested in addressing human vulnerabilities, you should find value in this book. I hope that you get to apply the information in a practical setting. As I finalize this manuscript, the 2021 Verizon Data Breach Investigations Report (DBIR) has been released, and it again reports that the targeting of users remains the top attack vector. It is my belief that this book can help to address this problem.
Icons Used in This Book
Throughout this book, icons in the margins highlight certain types of valuable information that call out for your attention. Here are the icons you encounter and a brief description of each:
Beyond the Book
In addition to the abundance of information and guidance related to creating a security awareness program that we provide in this book, you gain access to even more help and information online at Dummies.com. Check out this book’s online Cheat Sheet. Just go to www.dummies.com and search for security awareness for dummies cheat sheet.
Where to Go from Here
This book follows a certain flow, but — as I identify in the description of the parts of this book, and as I write in the “Foolish Assumptions” section — you may be anywhere in the process of implementing an awareness program. For that reason, I intend for the chapters to stand alone as much as possible. Part 1 of this book covers my philosophies, biases, and experience, which may help you understand the perspective of the advice I provide, but you should be able to start with any chapter that seems most relevant to you.
If you have a functional program running and want to enhance it, I recommend turning to the chapters on gamification (see Chapter 11), running phishing simulations (see Chapter 12), or metrics (see Chapter 8). Otherwise, you can skim the chapters to see which one is the most relevant to your immediate needs. You may prefer, of course, to follow the flow of the book and read from front to back.
Part 1
Getting to Know Security Awareness
IN THIS PART …
See what makes security awareness work.
Avoid the pitfalls that cause security awareness programs to fail.
Get the most from what science shows about human behavior.
