Foreword |
|
xxi | |
Introduction |
|
xxiii | |
I The Case for Transformation |
|
1 | (34) |
|
|
3 | (16) |
|
Humans Are the Last Line of Defense |
|
|
4 | (2) |
|
Data Breaches Tell the Story |
|
|
6 | (5) |
|
Auditors and Regulators Recognize the Need for Security Awareness Training |
|
|
11 | (3) |
|
Traditional Security Awareness Program Methods Fall Short of Their Goals |
|
|
14 | (2) |
|
|
16 | (1) |
|
|
17 | (2) |
|
2 Choosing a Transformational Approach |
|
|
19 | (16) |
|
Your "Why" Determines Your "What" |
|
|
20 | (1) |
|
|
21 | (3) |
|
Outlining the Key Components and Tools of a Transformational Program |
|
|
24 | (4) |
|
|
28 | (4) |
|
|
30 | (1) |
|
|
30 | (1) |
|
|
31 | (1) |
|
|
32 | (1) |
|
|
32 | (3) |
II The Tools of Transformation |
|
35 | (202) |
|
3 Marketing and Communications 101 for Security Awareness Leaders |
|
|
37 | (46) |
|
The Communications Conundrum |
|
|
38 | (2) |
|
|
40 | (36) |
|
|
44 | (9) |
|
|
53 | (17) |
|
Get the Right Message to the Right Person at the Right Time |
|
|
70 | (6) |
|
Campaigns: If You Aren't Reinforcing, Your Audience Is Forgetting |
|
|
76 | (1) |
|
Tracking Results and Measuring Effectiveness |
|
|
76 | (1) |
|
Know When to Ask for Help |
|
|
77 | (1) |
|
|
78 | (1) |
|
|
78 | (3) |
|
|
81 | (2) |
|
4 Behavior Management 101 for Security Awareness Leaders |
|
|
83 | (58) |
|
Your Users Aren't Stupid, They're Human |
|
|
85 | (2) |
|
|
87 | (6) |
|
|
88 | (3) |
|
|
91 | (2) |
|
Working with Human Nature Rather Than Against |
|
|
93 | (3) |
|
The Nuts and Bolts of Shaping Behavior |
|
|
96 | (7) |
|
|
97 | (6) |
|
The Problem with Motivation |
|
|
103 | (14) |
|
Nudge Them in the Right Direction |
|
|
103 | (6) |
|
Frames: Why Context Is Everything |
|
|
109 | (8) |
|
Designing and Debugging Behavior |
|
|
117 | (16) |
|
Being Intentional with Target Groups |
|
|
117 | (1) |
|
|
118 | (4) |
|
Design "Power Prompts" Wherever Possible |
|
|
122 | (1) |
|
Password Management Example, Continued |
|
|
123 | (7) |
|
Habits Make Hard Things Easier to Do |
|
|
130 | (2) |
|
Thinking About Guardrails |
|
|
132 | (1) |
|
Tracking Results and Measuring Effectiveness |
|
|
133 | (1) |
|
|
134 | (1) |
|
|
135 | (2) |
|
|
137 | (4) |
|
5 Culture Management 101 for Security Awareness Leaders |
|
|
141 | (34) |
|
Security Culture Is Part of Your Larger Organizational Culture |
|
|
144 | (3) |
|
|
147 | (17) |
|
Understanding Your Culture's Status Quo |
|
|
149 | (7) |
|
Go Viral: Unleash the Power of Culture Carriers |
|
|
156 | (8) |
|
Cultures in (Potential) Conflict: Remember Global and Social Dynamics |
|
|
164 | (1) |
|
|
165 | (6) |
|
|
167 | (1) |
|
|
167 | (2) |
|
|
169 | (1) |
|
|
169 | (2) |
|
Tracking Results and Measuring Effectiveness |
|
|
171 | (1) |
|
|
171 | (1) |
|
|
172 | (2) |
|
|
174 | (1) |
|
6 What's in a Modern Security Awareness Leader's Toolbox? |
|
|
175 | (26) |
|
Content Is King: Videos, Learning Modules, and More |
|
|
176 | (10) |
|
Big Box Shopping: A Content Analogy |
|
|
178 | (3) |
|
|
181 | (5) |
|
Experiences: Events, Meetings, and Simulations |
|
|
186 | (8) |
|
Meetings, Presentations, and Lunch-and-Learns |
|
|
187 | (1) |
|
|
188 | (1) |
|
|
189 | (1) |
|
|
190 | (1) |
|
|
190 | (1) |
|
Simulated Phishing and Social Engineering |
|
|
191 | (1) |
|
Other Simulations and Embodied Learning |
|
|
192 | (1) |
|
Interactions with Other Technologies |
|
|
193 | (1) |
|
Relationships: Bringing Context to Content and Experiences |
|
|
194 | (1) |
|
Be Intentional and Opportunistic, Always |
|
|
195 | (2) |
|
|
195 | (1) |
|
Tapping into Cultural Trends |
|
|
195 | (1) |
|
Opportunistic Campaigns Based on New Organizational Initiatives and Current Events |
|
|
196 | (1) |
|
The Critical "At Home" Connection |
|
|
197 | (1) |
|
Use Your Metrics and Anecdotes to Help Tell and Reinforce Your Story |
|
|
197 | (1) |
|
|
198 | (1) |
|
|
198 | (3) |
|
7 Voices of Transformation: Interviews with Security Awareness Vendors |
|
|
201 | (36) |
|
Anna Collard, Popcorn Training |
|
|
201 | (3) |
|
Chris Hadnagy, Social Engineer |
|
|
204 | (5) |
|
Drew Rose, Living Security |
|
|
209 | (2) |
|
Gary Berman, The CyberHero Adventures: Defenders of the Digital Universe |
|
|
211 | (3) |
|
|
214 | (3) |
|
Jim Shields, Twist and Shout |
|
|
217 | (2) |
|
|
219 | (2) |
|
Lisa Plaggemier, InfoSec Institute |
|
|
221 | (3) |
|
Masha Sedova, Elevate Security |
|
|
224 | (2) |
|
|
226 | (2) |
|
|
228 | (3) |
|
Winn Schwartau, The Security Awareness Company (SAC) |
|
|
231 | (5) |
|
|
236 | (1) |
III The Process of Transformation |
|
237 | (92) |
|
8 Living Your Awareness Program Through the Eyes and Lives of Your Audience |
|
|
239 | (12) |
|
A Learner Journey Map: Awareness in the Context of Life |
|
|
240 | (8) |
|
|
248 | (1) |
|
|
248 | (3) |
|
9 Putting It All Together |
|
|
251 | (32) |
|
|
252 | (17) |
|
The Five Secrets of Security Awareness Success |
|
|
252 | (7) |
|
|
259 | (5) |
|
Leverage Cialdini's Principles of Persuasion |
|
|
264 | (5) |
|
|
269 | (1) |
|
Thoughts About Crafting Campaigns |
|
|
269 | (9) |
|
Thinking Through Target Groups |
|
|
271 | (6) |
|
Be Intentional with Recognition and Reward |
|
|
277 | (1) |
|
Assembling Your Culture Carriers |
|
|
277 | (1) |
|
|
278 | (1) |
|
What Does the Future Hold? |
|
|
279 | (1) |
|
|
280 | (1) |
|
|
281 | (2) |
|
|
283 | (10) |
|
Leverage the Power of Community |
|
|
283 | (2) |
|
|
285 | (5) |
|
|
290 | (1) |
|
|
291 | (2) |
|
11 Voices of Transformation: Interviews with Security Awareness Program Leaders |
|
|
293 | (36) |
|
Bruce Hallas, Marmalade Box |
|
|
294 | (2) |
|
Carlos Miro, MUFG Union Bank |
|
|
296 | (2) |
|
Dr. Cheryl O. Cooper, Sprint Corporation |
|
|
298 | (4) |
|
|
302 | (3) |
|
Mark Majewski, Quicken Loans |
|
|
305 | (2) |
|
Michael Lattimore, Independent Consultant |
|
|
307 | (4) |
|
Mo Amin, Independent Consultant |
|
|
311 | (2) |
|
Prudence Smith, Senior Cyber and Information Security Consultant and Industry Speaker |
|
|
313 | (7) |
|
Thom Langford, (TL)2 Security |
|
|
320 | (3) |
|
Tory Dombrowski, Takeform |
|
|
323 | (6) |
Appendix: Seven Key Reminder Nudges to Help Your Recall |
|
329 | (2) |
Index |
|
331 | |