Book Image

Transformational Security Awareness

By : Perry Carpenter
Book Image

Transformational Security Awareness

By: Perry Carpenter

Overview of this book

When all other processes, controls, and technologies fail, humans are your last line of defense. But, how can you prepare them? Transformational Security Awareness empowers security leaders with the information and resources they need to assemble and deliver effective world-class security awareness programs that drive secure behaviors and culture change. If your organization is stuck in a security awareness rut and is using the same ineffective strategies, materials, and information that might check a compliance box but still leaves your organization wide open to phishing, social engineering, and security-related employee mistakes, then you need this book. Author Perry Carpenter weaves together insights and best practices from experts in communication, persuasion, psychology, behavioral economics, organizational culture management, employee engagement, and storytelling to create a multidisciplinary masterpiece that transcends traditional security education and sets you on the path to make a lasting impact in your organization.
Table of Contents (9 chapters)

2
Choosing a Transformational Approach

The methods that will most effectively minimize the ability of intruders to compromise information security are comprehensive user training and education. Enacting policies and procedures simply won't suffice. Even with oversight the policies and procedures may not be effective: my access to Motorola, Nokia, ATT, Sun depended upon the willingness of people to bypass policies and procedures that were in place for years before I compromised them successfully.

Kevin Mitnick, Congressional Testimony, March 2, 2000

Let's start with a simple question: why are you implementing a security awareness training program? That question may seem overly basic, but having helped thousands of security leaders with their programs, I can tell you from experience that most people haven't stopped to analyze what they are really trying to accomplish. Instead, they know that they should “do some security awareness,” but they don't really...