A Primer on Risk and Security Awareness

We talk a lot about human risk in the world of security awareness, but rarely have I seen it defined, especially at a high level that anyone can understand. As such, I wanted to take a step back and give you a simple overview of what exactly risk is, and the role security awareness plays in enabling organizations to manage it.

1. Security: Let’s start with the basics,what exactly is security? Simply stated, security is managing risk.
2. Managing: So, what do we mean by managing? There are three ways you can manage risk; you can reduce risk, you can accept risk or you can transfer risk (think insurance). Security vendors help you reduce risk. Acceptance of risk is primarily an internal process, while transfer of risk is an entirely different field (think insurance). One thing you can never do is eliminate risk.
3. Risk: So what is risk? At the most general level risk is defined as the probability of an incident times the harm of an incident. The greater the likelihood something bad will happen, the greater the risk. The greater the impact from an incident, the greater the risk.
4. Cyber Security Risk: In the world of cyber security we use the same model but break it down one-step further. Specifically we define risk asVulnerabilities x Threats x Impact. Its the same model, all we did is break down probability into two variables, vulnerabilities and threats. The more vulnerabilities you have, the more likely you will have an incident. The more threats you have, the more motivated they are, the more skilled they are, and/or the more resources they have the more likely you will have an incident. If you are looking for a more precise definition of cyber security risk, I recommend the FAIR model.
5. Security Awareness: So where does security awareness fit in? Security awareness is the specialty of managing human cyber risk. Instead of using technology to manage risk, we leverage employees. Keep in mind, security awareness does not only address deliberate threats (i.e. hackers) but also accidental threats, in other words trusted employees and staff that accidentally cause harm (i.e. auto-complete in email).
6. Behaviors. So what do we train people on, how does security awareness manage human risk? By changing peoples’ behaviors. Through behavior change you can reduce any one of the three variables that create risk. For example, teach people how to identify a phish, they become less vulnerable. Teach people how to spot an insider, you reduce threats. Teach people how to use encryption, you reduce impact. The goal of awareness is to reduce human risk, and we do that by changing peoples’ behaviors. To learn more about behaviors I highly recommend the BJ Fogg behavior model.
7. Culture: Where does culture fit in to this? Culture is not just how people behave, but their attitudes, perceptions and norms. This is not only more difficult to change, but more difficult to measure. Ultimately you want an organization that has both secure behaviors and secure culture. However focus on behaviors first. Not only are behaviors easier to change and easier to measure, but as the infamous John Kotter documented in his book Leading Change and more recently Accelerate, changing behavior is the path to changing culture. Finally, just because an organization has a secure culture does not mean it has secure behaviors. For example, you can have employees who believe and understand that security is important, so they focus on locking the front door to the building while happily sharing passwords with the person from ‘tech support’ on the phone.

So there you have it, a short, simple primer on what security awareness is and the role it plays in helping organization’s manage risk.