Laurianna Callaghan presented on developing a security awareness program from simple to mature. She outlined the SANS maturity model, which ranges from non-existent programs to mature programs that incorporate metrics and a security awareness lifecycle. Callaghan discussed key elements of simple, compliance-focused, and promoting awareness programs before focusing on the characteristics of a mature program, including measuring impact through metrics in areas like compliance, incidents, culture and technology. She emphasized changing perspectives to see humans not as a liability but as stakeholders and concluded by offering next steps organizations can take to advance their programs.

1. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
Security Awareness Program
From 0 to Maturity
Laurianna Callaghan, CISSP, CCNA Security
Information Security
11/11/2017

2. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
AGENDA

3. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
AGENDA
• Why bother with the human?
• Simple program.
• Mature program.
• Next steps.
3

4. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
WHY BOTHER WITH THE HUMAN?
4

5. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
STATISTICS
• Statistics against the human are
daunting.
• Humans are the prevalent
enabler of attacks from the
outside.
• The stronger your security, the
more humans will become
targets.
5
Technology
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr
Compliance
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr
Culture
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr

6. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
“JUST ONE CLICK”
• Fallacy: If one person in a company clicks, we
might as well not teach anyone.
• If enough people report spam, Security may be able to
take quick action.
• Less devices would get infected by malware.
• If using an anti-virus, other companies will benefit.
• Security Awareness saves time, effort and money.
6

7. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
LACK OF CONTROL
7
• For the most part, you can control
technology through proper
configuration and prevention.
• Humans are unpredictable
and cannot be configured.
They require a different
method of security.
Some don’t care.
Some don’t understand.
Some don’t know.
Some just want to be left alone.

8. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
SLEEP
• A truly mature security awareness
program can help you sleep.*
• From security awareness alone, a
mature dashboard can help
determine which technology is “in
danger.”
• Think of what can be done when
consolidating metrics with other
secure applications and AI programs.
*This statement not evaluated by the FDA. 
8
KEEPS YOU UP AT
NIGHT

9. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
SIMPLE PROGRAM
9

10. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
SANS MATURITY MODEL
10

11. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
NON-EXISTENT
• Smaller companies.
• Small home-grown companies.
• No perceived need for PCI-DSS or HIPAA, etc.
• Companies that don’t know what to do.
• Companies that don’t follow regulations.
11

12. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
COMPLIANCE FOCUSED
• Most simple programs include
just 1 or 2 projects.
• Trinkets and training only.
• Newsletter or other form of
sending tips and information.
• Humans chose whether they
participate, and many don’t.
• Forgo the Security Awareness
Life Cycle.
“Be Secure”
Button

13. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
PROMOTING AWARENESS
• Understands behavior change.
• Teaches home and travel security.
• Program consistent annually.
• Targets specific behaviors.
• Continual reinforcement.
• Learn by example.
• Changes behavior.
13

14. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
CULTURE CHANGE
• Focuses beyond training with
multiple delivery methods.
• Follows the Security Awareness
Life Cycle.
• Consistent review of program
with updates.
• Executive buy-in.
• Budge resources.
14

15. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
MATURE PROGRAM
15

16. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
SANS MATURITY MODEL
16

17. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
MATURE PROGRAM
• Metrics track progress and
measure impact.
• Each project is planned,
analyzed, designed,
implemented and continually
maintained.
• Given a technology, the
dashboard can show which
human and insecure activity
poses the greatest danger.
• Awareness programs
continually improve with time.
• A culture is built inherently that
humans want to participate in.
• Program and projects are
robust.
17

18. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
CHANGE
• Change our need for control when it
comes to the human factor.
• Change will bring more than you’ve
ever dreamed of to your whole
security program and team.
18
• Customer service is key.
• Your department’s reputation has
everything to do with it.
• Have “honey” at the ready.
• You can catch more flies with
honey than you can with vinegar.
• Plan fun activities.
• What do they know about the
Security Dept.?

19. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
BUY IN
• Humans must have a
stake in the game.
• “What’s in it for me?”
• Protect your family.
• Protect your
401k/retirement
funds.
• Gain useful items.
• Gain fun prizes.
• Share with others
(knowledge).
• Resume builder for
some.
19

20. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
DASHBOARD
• Includes metrics:
• Compliance
• Incident
• Culture
• Technology
• Others
20

21. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
COMPLIANCE METRICS
• Regulations not followed.
• Internal Audit
• Outside Audits
• Specialized Audits
• Training course completions.
• Remote employee attestations.
• Non-compliancy reports
received to audit/security.
• Policy not followed.
21
Training Completions
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr
Attestations
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr
Non-Compliant
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr

22. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
INCIDENT METRICS
• SPAM and phishing reported.
• Social engineering phone calls
reported.
• Phishing texts reported.
• Number of brute forced
passwords cracked.
• Screen viewable area checks.
• Confidential data printed and
left unattended checks.
• Screen lock checks.
22
SPAM
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr
Security Check
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr
Passwords Cracked
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr

23. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
CULTURE METRICS
• Number of respondents to SA
surveys.
• Number of attendees at road
shows.
• Number of newsletter readers.
• Number of complimentary
emails to program.
• Number of badge warnings.
• Number of visits to intranet
site.
23
Road Show
Attendance
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr
Newsletter Unique
Views
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr
Intranet Unique
Views
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr

24. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
TECHNOLOGY METRICS
• Phishing and other SA metrics go much, much
further than a simple program.
• Learn which databases, which machines, etc. are
at the greatest risk.
24
Server Z
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr
Database A
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr
Data Store 3
1st Qtr 2nd Qtr
3rd Qtr 4th Qtr

25. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
AWARENESS LIFE CYCLE
• Follow the Security
Awareness Life Cycle (SALC)*.
• Requirement analysis
• Design
• Implement
• Test and integrate
• Maintain and Evolve
• SALC applies to each project.
*Software/Systems Development Life Cycle (SDLC)
25

26. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
NEXT STEPS
26

27. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
NEXT STEPS
• Discuss a Security Awareness program with your CSO.
• Get executive buy-in. Present or invite FBI, Police or
other authoritative speaker(s).
• Navigate to SANS Securing the Human.
• Discuss the importance of human security to your
CISO and/or CSO. Use real examples.
• Follow the SANS maturity model to find your
company’s level and challenge them to move
forward.
27

28. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
QUESTIONS
28

29. NTXISSA Cyber Security Conference – November 10-11, 2017
@NTXISSA #NTXISSACSC5
Laurianna Callaghan, CISSP, CCNA Security
29
Thank you