Three ways to engage your workforce in 2022
One of the biggest challenges we consistently hear from security awareness professionals is how to effectively engage, train, and secure a remote workforce. Many of us thought remote working would end in 2021, that life would be back to normal, but we were wrong. So, as we head into 2022, what can we as security awareness professionals do? First, let’s better define what the key challenges are with a remote workforce in 2022.
Three workforce challenges
-
Workers are overwhelmed: Just like the past two years, people in 2022 are overwhelmed as there is constant change. Working from home is just the beginning for many. Spouses’ lives are also often changing, with where they work, how they work, or if they travel. People are quitting and starting new jobs. For those with families – school and their children’s activities are constantly changing the rules on what is happening when and how. Simple things such as going to the doctor or dentist or getting work done on the house have become far more complicated. As such, people are greatly stressed out and can barely keep up with their daily personal work lives, let alone worry about cybersecurity.
-
Constant technology changes: Now that people are working from home, long-term companies are giving people far more access to more systems and more sensitive data. With this access comes more technical challenges, people are in many ways having to become their own help desk. For example, people are having to learn how to securely share files, update and coordinate calendars, request time off or collaborate online with teams using a variety of different Cloud-based tools. Each tool often has a different interface, different configuration options and may need to be maintained by the individual. While these tools may be easy for some of us, they are often confusing for many others. These tools are often changing, which complicates matters. Dumping a variety of new, highly-technical/confusing security technologies on people only makes the matters worse, pick the acronym of your choice – FDE, 2FA, VPN, SSO, MDM, IAM, EDR, etc.
-
Cybersecurity needs are under-resourced: Unfortunately, for many organizations managing their human risk is an afterthought, often cybersecurity is perceived as only or primarily as a technical effort. As a result, many security awareness teams are horribly understaffed, often just one person responsible for an organization of ten or twenty thousand people. This means whatever solution awareness professionals come up with has to be simple to plan, build, and manage.
Overcoming challenges in 2022
So how do we overcome these challenges and what are the top tips for awareness professionals as we head into 2022?
-
Keep it simple: People are overwhelmed, so we need to limit what we ask of them – we need to keep security as simple as possible for people. The first step is identify and focus on only your top human risks and the key behaviors that reduce those risks. Sending people a newsletter with the top 25 steps to secure their home is not going to do anyone good as no one has the time to read or follow all those steps. Explaining recent APT activity has exhibited TTP’s targeting people’s authentication credentials and this is the reason why VPNs are moving to two-factor authentication (2FA) is only going to lose the vast majority of the audience. Focus on the fewest behaviors that have the greatest impact, and communicate them in a simple, concise way anyone can follow. Also, have someone non-technical write or at least review the training materials and ensure it is written so anyone can understand the message. Content created by highly technical people tends to be written for highly technical people.
-
Focus on personal benefit/home: Want to get people’s attention? Focus on how they personally benefit, such as how to secure their personal finances, their homes, or their kids. Communicate and engage in a way that people personally benefit. Not only are people far more likely to listen and change behaviors, but the behaviors are the same for both home and work. The top indicators for a phishing attack are the same regardless if you are at work or at home. Strong passwords are the same for work and at home. Updating systems is important at work and at home. Focus on how people personally benefit and they are far more likely to listen and change.
-
Training and engagement: Email is only going to go so far as people are overwhelmed. Companies need to find an easy way to connect that works with people. Here you have to get a little creative as every organization is different in both its culture and how it operates. Two key concepts to effective engagement; keep it short and make it interactive. Going to do a webcast? Skip the slides and make it a dynamic interview with someone on the security team or do a live stream that supports real-time interaction with your audience and keep it under 30 minutes. People tired of hearing from you? Invite an outside guest speaker. If you are based in the US perhaps someone from the FBI, IRS, FTC or Secret Service. Skip the blog and instead create an interactive online forum using technologies like Slack or MS Teams. If the culture is a good fit, gamify the learning experience with simple events such as online Scavenger Hunts. Looking to push the envelope a little bit? Consider memes, infographics or micro-videos. Create content you would want to engage in.
– This originally appeared on SANS Institute’s website. SANS Institute is a CFE Media and Technology content partner.