Security Awareness Program

Organizations around the world wants to follow good security practices. And because of several cases of data breach that is seen in the news every day, Executives often keep security awareness program as a process and a priority. The awareness program consists of things like employee on-boarding, trainings, Cybersecurity Awareness activities, policy notifications, newsletters and more. These are well-intended and all good stuffs, but because many cases of reported breaches, it seems these are not well designed. Program looks good, but either it is not enough or not effectively/correctly deployed.

Why awareness program fails?

• Gap between knowledge and behavior: Having information about something doesn’t mean that you’ll act on that knowledge. Just because I’m aware doesn’t mean that I care.
• Gap between knowledge and the intention to act: Information alone doesn’t lead to caring or the intent to act on the information. If you try to work against human nature, you will fail.
• Gap between intention and action: Even when someone cares and intends to act on the information they’ve received, there is no guarantee that they will act on that information at the moment of behavior. What your employees do is way more important than what they know.

This is called knowledge-intention-behavior gap.

Reference: (SC)2 Magazine May/June edition. Article "OH NO, HE DIDN’T?!" by PERRY CARPENTER, chief evangelist and strategy officer at KnowBe4 USA.