The Security Awareness Cycle

The second step in the Security Awareness Cycle is all about identifying and understanding your audience. This involves recognizing the different groups within your organization and outlining their unique security awareness needs.

Each group, and sometimes individuals within those groups, has distinct needs. For example, executive leadership or senior management, who are responsible for accepting residual risks on behalf of the organization, have different security awareness needs compared to departments like Accounting or Human Resources. The Human Resources department, which deals with health insurance and other Personally Identifiable Information (PII), will have different requirements than the Information Technology department.

Once you understand who your audience is and what their specific needs are, it’s important to also understand how they learn best. Drawing from Educational Psychology, we know that people have different cognitive skills, learning styles, and mental models. Some people prefer spatial learning with images and visual aids, others prefer aural learning through spoken information, and some prefer logical learning with reasoning and logic.

By understanding these differences, you can develop security awareness materials that cater to all learning styles, ensuring that each group within your organization receives the information they need in the way that suits them best.

The third step in the Security Awareness Cycle focuses on identifying behaviors. Security Awareness aims to change high-risk behaviors and reinforce desired behaviors to reduce and mitigate security risks to the organization.

The fourth step in the Security Awareness Cycle is to identify solutions to mitigate risks or facilitate behavioral changes. This step involves deciding how to address the risks identified in the previous steps. Solutions typically take the form of policies, procedures, or guidelines. In some cases, they may be supplemented by hardware implementations or software deployments.

The fifth step in the Security Awareness Cycle is to create the Security Awareness material, which could take form as email templates, newsletters, posters, screensavers, PowerPoint presentations, and others. The chief purpose of this material is to support the delivery of Security Awareness and training. This is also where the topic is chosen. What topics will the material support? Traditional examples include Viruses and Malware, Phishing Attacks, and Social Engineering attacks; but equally important, topics are chosen based on the analyses conducted as part of the previous phases of the Security Awareness cycle. Phase 1 “Metrics” will determine areas that need attention and improvement. Phase 2 “Understanding your Audience” will determine training needs that are unique to the various groups within the organization. Phase 3 “Identifying Behaviors” will determine topics based on employees high-risk behaviors we want to reduce, or mitigate, and it will identify desired behaviors we want to reinforce. The topics identified in these initial phases are often unique to each organizations depending on their size, industry, and structure.

The sixth and final step in the Security Awareness Cycle is to deliver the message. In this phase Security Awareness material is delivered to the audience, i.e. your employees. The delivery can take place via many different mediums such as via email, newsletters, computer based training (CBT), presentations, group sessions, and so forth. It is important that mediums are chosen across all spectrums in order to accommodate the various learning styles and it is important to choose mediums that are not already saturated.