Security Awareness For Dummies. Ira Winkler

Чтение книги онлайн.

СКАЧАТЬ led to the theft of reportedly billions of dollars of information and intellectual property. (I gave it all back.)

      My “victims” then had me go back to their organizations and tell the stories about what I did, as a form of security awareness. The users were mesmerized by my stories. I heard about some successes in improved awareness, but when I went back for further assessments, the reality was that no real improvement had occurred. Just telling stories and telling people what not to do has limited impact.

      Over two decades, I created and supported dozens, if not hundreds, of awareness programs for organizations of all types and sizes. I was able to see what worked best and what didn’t. I found that many of the common beliefs and strategies just didn’t work. They sounded great, but they were specious.

I also learned how to tell when awareness efforts were doomed to failure. More important though, I learned what works and how best to implement awareness programs.

      This book shows how to implement the strategy that I found (through decades of experience) actually works. It helps you cut through hype and platitudes and begin doing what actually works. Platitudes and hype sound noble, but they are frequently misleading. Some of what I describe might go against what is considered common practice; however, you must consider that common practice has led to few improvements over decades. With that in mind, consider my perspective and determine what works best for your purposes. No guarantee exists of what will or won’t work in any given situation.

      Take this insight into account as you read this book and choose your own path.

      To help you choose that path and make the content more accessible, I’ve divided this book into four parts:

       Part 1, “Getting to Know Security Awareness”: An overview of the fundamental concepts and philosophies of security awareness

       Part 2, “Building a Security Awareness Program”: The building blocks of an awareness program

       Part 3, “Putting Your Security Awareness Program into Action”: Creating and implementing your program

       Part 4, “The Part of Tens”: Quick guidance for optimizing your program

      The appendix provides a sample assessment questionnaire.

Foolish Assumptions

      My fundamental assumption is that I have no assumptions except that you are interested in addressing human vulnerabilities. You may be a CISO who wants to get a handle on how to better address the most common attacks against your organization. You may run awareness programs and want to enhance your current efforts. You may have been randomly assigned to run an awareness program and have little idea where to start. Or you may simply be interested in becoming a more well-rounded cybersecurity professional. This book definitely provides a valuable addition to your knowledge base.

Regardless of your role or position in your organization, if you’re interested in addressing human vulnerabilities, you should find value in this book. I hope that you get to apply the information in a practical setting. As I finalize this manuscript, the 2021 Verizon Data Breach Investigations Report (DBIR) has been released, and it again reports that the targeting of users remains the top attack vector. It is my belief that this book can help to address this problem.

Icons Used in This Book

      Throughout this book, icons in the margins highlight certain types of valuable information that call out for your attention. Here are the icons you encounter and a brief description of each:

      

The Tip icon marks tips and shortcuts you can use to make creating and running awareness programs easier.

      

Remember icons mark the information that’s especially important to know. Frequently, paragraphs marked with this icon reiterate information that is presented previously in the book but bears repeating in the current context.

      

The Technical Stuff icon marks information that is specifically practical in implementing awareness programs. It involves information specific to the execution of programs.

      

When you see the Warning icon, you know to watch out! This icon marks important information that may save you headaches, or at least let you know when those headaches might pop up (and why).

Beyond the Book

      In addition to the abundance of information and guidance related to creating a security awareness program that we provide in this book, you gain access to even more help and information online at Dummies.com. Check out this book’s online Cheat Sheet. Just go to www.dummies.com and search for security awareness for dummies cheat sheet.

Where to Go from Here

      This book follows a certain flow, but — as I identify in the description of the parts of this book, and as I write in the “Foolish Assumptions” section — you may be anywhere in the process of implementing an awareness program. For that reason, I intend for the chapters to stand alone as much as possible. Part 1 of this book covers my philosophies, biases, and experience, which may help you understand the perspective of the advice I provide, but you should be able to start with any chapter that seems most relevant to you.

      If you have a functional program running and want to enhance it, I recommend turning to the chapters on gamification (see Chapter 11), running phishing simulations (see Chapter 12), or metrics (see Chapter 8). Otherwise, you can skim the chapters to see which one is the most relevant to your immediate needs. You may prefer, of course, to follow the flow of the book and read from front to back.

Part 1

      Getting to Know Security Awareness

IN THIS PART …

      See what makes security awareness work.

      Avoid the pitfalls that cause security awareness programs to fail.

      Get the most from what science shows about human behavior.

СКАЧАТЬ