Cybersecurity awareness month is just around the corner, and all over the country, CISOs and security program owners are gearing up for their annual security awareness training. While October is an ideal time for companies to talk with their end users about security, it shouldn’t be the alpha and omega of your security awareness program. Educating your users about cybersecurity for one month out of the year is like only brushing your teeth on Tuesdays (i.e., not consistent enough to be effective).
Realistically, a “Hey, it’s fall, let’s talk security” approach may succeed in getting your users to recognize certain threats, but it’s unlikely to help users build the kind of habits that will minimize your organization’s risk of accidental exposure. Science bears this out: according to a study published in the European Journal of Social Psychology, it takes anywhere from 18 to 254 days to establish a habit, with the average being 66 days.
So, how do you transform your security awareness program from a once-a-year booster shot into a recurring monthly program that helps your users develop smart, lasting habits around cybersecurity?
It’s easier to build habits when you don’t have to consciously think about choosing one action over another. Take a cue from behavioral science and make cybersecurity the default by employing things like MFA, password managers, and zero-trust architecture at the enterprise level.
High-performance workplaces focus on values, not compliance. Make cybersecurity an ideal to live up to instead of a rule to be followed (with the implied threat of “or else”). This shifts the conversation from telling users what they can’t or shouldn’t do to empowering them to make smart decisions.
One study showed that hotel guests are more likely to reuse their towels when told that 75% of their fellow guests do so than they are when told that reusing towels is good for the environment. This makes sense: we’re social creatures, after all. We judge our behavior and performance based on what our peers are doing. One way you can use peer pressure to reinforce positive cyber hygiene is by telling them how your training program has impacted other users’ knowledge or behavior. For example, our Fortune 100 telcom client split up their users to test the new Living Security training. The result: those that took the training had a 43% lower click rate on phishing simulations than their peers who didn’t take the training. Be sure to frame your statements in terms of what your users are doing right instead of what they’re doing wrong; people are more likely to continue a negative behavior if they think everyone else is doing it, like in this journal article on the success of managing social norms for persuasive impact. Another way to appeal to social norms is to show your users how their skills stack up against their peers. Our comprehensive security awareness training platform includes a leaderboard (we find that a healthy dash of competition makes training more fun!).
Research shows that breaking lessons up into small pieces can improve learners’ interest in and retention of the material. Living Security makes it fun and easy for your users to incorporate security awareness into their schedule with engaging, Netflix-style videos and micro- and nano-lessons.
Consistency is key to building and maintaining habits. That said, it can be hard for program owners to keep up a steady drumbeat of relevant, interesting, fun security awareness content for their users. Our Campaign in a Box solves that problem, instantly improving your security awareness program with a month’s worth of content and education for your end users, pre-packaged and made easy to share across email, Slack, or any communication method that works best for your organization. We launch a new topic every month, allowing you to keep security awareness top of mind all year round.
Want to stay up-to-date on human risk management trends and best practices? Download the 7 Essential Trends Of Human Risk Management for 2021 guide today.