Yesterday began like all others, a good morning to my Twitter followers and a quick scan through the topics of others I follow. The topic of discussion that stood out, dividing our industry more often than any others got started; the belief, or lack thereof, in Security Awareness Training Programs being a benefit to organizations. The sides step back, stand in their respected corners, the bell rings, and both sides come out swinging. The first round went to Bruce Schneier, @DarkReading, with his article entitled “On Security Awareness Training – The focus on training obscures the failures of security design” and then the fire built inside and the opposing side came back, not only stronger, but direct. Dave Kennedy, @dave_rel1k, the founder of TrustedSec,@TrustedSec, and co-founder of DerbyCon, @DerbyCon , came back with the argument in direct contradiction to Bruce’s statements with his blog post entitled “The Debate on Security Education and Awareness”. Along with Dave, Ben Mauch, @Ben0xA, wrote “Security Awareness Education”, where he references a talk, “Creating a Powerful User Defense Against Attackers”, he did this talk at the 2012 DerbyCon security conference in which he describes user education and the pitfalls many educators fall into when trying to build these awareness programs.
Under our code of full disclosure, I will say that my respect for Bruce is very high not only as a security practitioner but as a writer, Dave is a dear friend and is absolutely dedicated to our craft, and Ben, another person I highly respect and consider a friend. However, none of my opinions regarding the topic of user awareness or education are being swayed in any direction because of friendships or respect for any single person. My words here are coming strictly from experience with training people in numerous different industries. I have trained on topics ranging greatly, but the one thing that has stayed constant has been the people’s reactions and responses to the experience, the final evaluations, and personal observations interacting with people during these training sessions. That being said let’s get to why I believe that there is error in Bruce’s article…
I could go back and rehash the points made by Dave and Ben, which are spot on, but what does this serve to better our community or the topic at hand? Let’s look at training in general. I have found that if you throw material at a group of people who have no stake in the game, whether it is Information Security, Nuclear, Biological, or Chemical warfare, the end result is still the same. Some will pick up a little, retain even less, and after a few months their ability to recall the information is virtually gone. Humans in general can only retain so much information in a given time frame, and if the case is not made that this information is just as important to them personally, it will most likely be put into a small data store tucked away in a deep dark corner of their brain. Due to this I have to sit back and look at both sides of this fence and try to calculate where Bruce fell short in his article. I do believe that the Security Awareness Training as we know it, as it stands across the board, in the majority of organizations, has failed and failed horribly. That statement being said, one might believe Bruce’s story and run out with the money saved to buy the next “check box” compliant appliance, to fight the onslaught of Cyber, APT, nation state, attack vector because our sales monkey told us that it would prevent this type of attack. Yes, that was a total of three over used buzz words, so take three drinks! The truth is that every government in the world builds technology into their schema for war, but every person I have ever spoke to regarding warfare has said that HUMINT, Human Intelligence, is what wins the battles. The key here being “Human”, it is the human element not the technology that is going to give us the leading edge in this war against the attackers.
As the defending blue team you need to face that fact that you have lost! What’s the old saying, “Admitting you have a problem is the first step” or something like that. So once you have come to the fact you lost what’s left to do? Give up, go home, change career fields, maybe stick your head in a hole, NO, the next step is to figure out how to reduce the impact of an event. Blinking lights, new appliances, and awesome sales pitches from the monkeys, are all great; but ultimately they are reaction based solutions. YES, I know there are proactive steps that these methods do apply, but keep in mind many of these items are found to be misconfigured, misunderstood, or simply don’t do what the monkeys claim they did. The fact remains that the very first line of defense, in an industry that prides itself on multiple layers of defense, IS the users.
So how do we utilize the assets that we already have?
Utilize these users as our first line of defense, but how?
EDUCATION!
STOP, please STOP, treating users like dumb, mindless, morons, who couldn’t understand the difference between the flux capacitor and a firewall! People are NOT stupid, uneducated yes, stupid no. If you take the time to develop training around the people, and not around the “check boxes” you WILL get a return on the investment. For example, why do awareness programs always have to focus on how to handle email attacks in relationship to the XYZ Corporation? Isn’t a phishing attack, at its core, the same as a user who is sitting in their home checking their personal email account? The answer is simple, YES! Going back to my original thought for a moment, what does it take to make humans, in our case users, retain and actually learn something from the awareness program? Make it about THEM! EDUCATE the users on how to spot a phishing attack and use their personal email as examples. Explain the implications of such things as the loss of money in their bank account, or how their computer could become a node on a huge botnet, maybe, just maybe, you will find that these same people will be able to better associate the discussions about the corporate phishing attacks once they can relate that attack to something they see in their personal life. Just maybe, the programs shortcomings don’t lay with the users but instead with the manner in which the material is structured and delivered.
We all say it over and over, that security must be done in layers. This is done not because a “check box” told us to, or a sales monkey sold us each layer of the defensive ring and they said it would achieve god like results; it’s being done so that if the first layer fails the second is there to help reduce the risk. The idea is that as the attacker moves from one layer to another some red flag is raised as to the abnormal behavior a device, system, or user account is taking and will be seen by admins, security staff, or the key master watching out for the abnormalities that occur. So look at the organizations out there, most are under staffed, over worked, and miss a great deal of things that should have truly been caught. Take a well EDUCATED user base and you have just increased the number of people who are your first line of defense in catching these abnormalities. Will some users fail this task and still allow attackers in, of course they will; but isn’t that why we have layers. If the first fails, the remaining layers should alert on the activity. On that same mindset of layers, wouldn’t it be beneficial then to have an extra layer to help catch these things? The thought that Bruce is taking would throw out this layer in lieu of a new shiny, blinky light, sales monkey’s appliance or service; we all know how these products and services are working not working for us currently!
So in closing, if your program is failing, you have a great deal of attacks coming from your user base, and you feel that the failure stems from the program, you may be absolutely correct. To say you are throwing the program out in lieu of something else is WRONG! Look at the program and see if the program is “teaching” by throwing material and facts out to the users or is it “educating” the users by relating to them. If you relate to the user and show them how the same methods can protect them in their personal life as it does in their professional life you will see better results. More so you will see a much stronger, better educated, and more aware user base as your first line of defense!
Now go out and EDUCATE people instead of treating them like dumb, mindless, morons, who couldn’t understand the difference between the flux capacitor and a firewall!
