teissTalk: Measuring the effectiveness of your security awareness programme

teissTalk host Geoff White was joined by Dora Ross, Global Information Security Culture Specialist, DAZN Group; Sarah Janes, Behaviour and culture specialist, Layer8; Victoria van Roosmalen, Chief Information Security Officer, Coosto.

Tweaking security messages to different environments

From a security perspective, a mobile is just another computer. But the fact that users have their mobiles in physical proximity may give them a false sense of security, even though the data they store on it is personal and therefore may be more painful to “lose”.

The features unique to mobile phones such as truncated hyperlinks, senders’ addresses not always appearing on the screen, or the extensive use of apps compared to laptops and computers make it more vulnerable to attacks. When new in an information security role, it’s important to make a baseline analysis and have discussions with various business units involved in cyber security to learn about previous breaches, as well as talk to the CISO about their priorities.

Some areas are easier to measure when establishing the security baseline such as compliance, while the effectiveness of communication and engagement is harder and the behaviour side is the trickiest to gauge. Understanding why certain security measures are implemented rather than being told what to do can be key to staff developing some level of security awareness. To assess where the organisation currently is in its security development cycle, assess it against the 5 levels of CMM (Capability Maturity Model).