How do you overcome staff resistance to security awareness?

It is important to understand that people do not resist security awareness out of malice. Rather, they focus primarily on their job responsibilities and productivity, with security often not at the top of their agenda. Instead of treating people's time as expendable, we should aim to respect their time and find ways to work within their constraints. Security is just one of many business priorities, along with safety, regulatory compliance, and others, all competing for employees' attention. To address this, we should move away from a "one size fits all" approach and instead implement adaptive security interventions that provide tailored security awareness to individuals based on their specific roles, responsibilities, and needs.

Non-Security staff employees need to be integrated into Security’s mission. Once they realize that the Security Department depends on their additional “eyes and ears”, they see themselves as a force multiplier and a valuable Security asset. With cyber crime, active shooter incidents and workplace violence on the rise, employee involvement is essential in detecting suspicious behavior.

These are good points and too often our security programs seem to be built on things you are required to do. Yes...there is a requirement aspect but more importantly you want to have staff understand why the security program exists and why it has the requirements that are in place. A good part of this is to understand the potential consequences to individuals and to the company. When this is understood and security program measures stress the "why" you are likely to have more buy in on the part of staff.

In addition to all that have been stated, copious examples from impact on other operators drives home the exposure. Regular reminders of the risk and what can be done to minimise or avoid the risk will help in inculcating the culture. This will also eliminate complacency. From my experience, avoidance becomes the norm for most workers who are not knowledgeable and conversant with technology. As has been stated by other contributors, simplification and familiarity with the system will go a long way in engendering interest and adaptability.

One thing I've found helpful is to show people how useful security awareness is to them individually, which they can activate and use even with family and friends. Personalising the awareness messaging to show how it benefits people personally turns out effective. This way, the organisation comes off as caring and empathetic to people rather than just trying to secure corporate assets. To achieve this, people working in the organisation need to be like-minded so that their individual goals somewhat align with corporate goals.

Make it personal. Show them how they can apply what you’re teaching them at home and at work. Demonstrate you’re educating them on how to protect both themselves and your organization at the same time. The behaviors they learn will become engrained in how they act in both environments.

Overcoming staff resistance to security awareness often hinges on effectively communicating the tangible benefits of such initiatives. For instance, during a recent security awareness campaign rollout, we emphasized how adopting secure practices could not only safeguard sensitive data but also protect the organization's reputation and financial well-being. By highlighting real-world examples of security breaches and their impact on similar organizations, we were able to demonstrate the relevance and urgency of security awareness to our staff, and by showcasing success stories of employees who successfully thwarted phishing attempts or identified suspicious activity, we instilled a sense of empowerment and ownership in our security culture.

- I try to demonstrate 'real world' examples through video presentations. When you show someone a couple true life examples they can view themselves in a situation. - Additional pressure can be applied through other department heads in the form of participation credit in semi-annual/annual performance evaluations.

As cyber crime has become more common, I think the benefits of security awareness is also becoming common knowledge. There can be push back when people perceive the proposed solutions carry disproportionate restrictions to living versus the risk. For example, some responses to 9-11 were disproportionate to the risks of hijacking a plane. Confiscating water bottles and nail clippers for destruction being some examples of the foolish knee jerk reaction. In cyber, I think telling people to stop posting content is not as useful as people make it out to be. I think this knee jerk reactions to deep fakes is not helpful. I think we need to improve the detection and response to deep fakes.

You have to make it engaging. It’s no different than trying to get them to do anything else. You have to make it clear why they should care. Often framing it around their personal life will give added benefit. For example, if someone uses different passwords in the personal life they’ll be more likely to use them in their work life too. The key is to make it engaging, even fun. At my organisation the infosec team have created a little superhero called “Captain Compliance” who engages directly with us all via our internal comms channel and makes it fun and engaging. I love it when “Captain Compliance” calls me “Super Syd” when I successfully complete the quizzes, it makes me more engaged. Let me know if you'd like to learn more.

Overarching theme: “security is a team sport”. Make all staff feel included in the mission, and then provide staff easy-to-implement actions to implement the security strategy. So, you’re part of this, and this is exactly what you can do to help!

Engaging and empowering staff in the security awareness process is key to fostering a culture of vigilance and accountability. In a recent initiative aimed at bolstering security awareness, we implemented interactive workshops and training sessions that encouraged active participation and collaboration among employees. By incorporating elements of gamification and scenario-based simulations, we transformed mundane security training into an engaging and immersive experience. Furthermore, by providing avenues for staff to share their insights, concerns, and best practices, we cultivated a sense of community and collective responsibility towards security.

Acknowledging secure behaviors in your staff and keeping track of who you're acknowledging is an organic way to build a network of super-aware staff. These super-aware staff are not security specialists, like you are. However, they "are in the trenches" in the business unit(s) and will echo to their peers your feedback.

I think the most effective approach to make sure that employees strict to security awareness program, content and guidelines, is by rewarding their achievements and notify the violation. #Awareness #motivation

Building trust and credibility in security awareness initiatives is crucial for overcoming staff resistance. In a recent endeavor to revamp our security awareness program, we prioritized transparency and accountability in our communication efforts. By openly addressing past shortcomings and soliciting feedback from staff, we demonstrated our commitment to continuous improvement and responsiveness to their needs. Additionally, we invested in sourcing content from reputable industry sources and subject matter experts, ensuring that our training materials were accurate, relevant, and up-to-date.

How do you build trust and credibility when facing resistance? Try to approach every difficult conversation with a negotiation mindset. There are valuable insights to be gained from the practice. For example, active listening, mirroring, and labeling, or calibrated questions are all powerful ways to break through barriers and start the "real" talk. Chris Voss's "Never split the difference" is a great resource for inspiration. These techniques allow you to showcase that you understand and appreciate resistant people, which in turn will help you to build trust and credibility.

Specificity and localisation! People can sniff out out of the shelf, generic training from a mile away. Create content that is specific to their organisation, it's culture and their day-to-day operations. If it feels tailored to them, it feels relevant to them.

Establishing trust and credibility within a security department begins with the management team. As the primary role models for their employees, it is essential for them to demonstrate their competence to ensure the success of their staff. Supporting your team consistently and honoring your commitments are key factors in building a strong foundation of trust.

At work, basically people want to finish their work and stay calm, and security is often seen as an obstacle. So the main issue is that security needs to be made simple, automated as much as possible, and made to be perceived as an ally and not a problem. For example: for password management, provide a solution as an organization and make it simple, as well as any hardware tokens for authentication.

Content and conversations should do as many of these as possible: *Build on previous learning *Be relevant to the organization itself - how it operates. *Be communicated in story form, ideally real-world examples *Include industry-specific content at least some of the time. *Incorporate the organization's values and risks

Staff not participating in security awareness practices could stem from two areas. The first could be a disconnect in staff's understanding of why security awareness is important to them. Many employees are unaware of a security breach's impact on their employment and physical well-being. The second area might be a training issue. As stated in the topic prompt, we are all under time constraints and workload issues. As security professionals, we must ensure we emphasize security awareness. If the training is of poor quality and the time committed to it is minimal, staff will not be invested in the program. High-quality, engaging training will help staff invest themselves in the security awareness programs.

If users are resistant, this is a sign of a rotting security culture. But frankly, if your organization doesn't have an elevated responsibility to protect the public's trust in the data you you hold, such as with financial services and Healthcare, it may not be necessary to remediate.

Security and convenience are often contradicting goals. Increasing complexity to counter the inconvenience to security will often make a system less secure. Increasing security will often introduce inconvenience. An example, that Dr. Mark Burgess used is securing the doors to a home. There was a time when people did not lock their doors. Locks were created when doors were found to be insufficient. However, locks require keys. Keys that can be forgotten, which makes the door a barrier to getting home. Thus locked doors can be a barrier and an inconvenience. However, I doubt there are many people who would oppose having locks on the doors to their home.

Points: 1. Education and Training: 2. Clear Policies and Guidelines: 3. Leadership Support: Buy Mgmt support 4. Incentives and Recognition: 5. Simulated Phishing Exercises: 6. Regular Updates and Reminders: Consistently update employees 7. User-Friendly Tools: 8. Tailored Training: Customize 9. Feedback Mechanisms: listen 10. Culture of Security: Foster to ingrained into the organization's values and everyday operations. 11. Consequences: Clearly communicate the consequences of security breaches and policy viloation 12. Continuous Improvement: Regularly evaluate and update your security awareness program to adapt to evolving threats and technologies. It's important to be patient and persistent in promoting security awareness.

The reality is we’re talking about a minority of employees. Most people are on board but need reminders along the way. That’s called training. The “few” just don’t care. It’s not that there is lack of understanding. It’s almost passive aggressive. Those should be fired if counseling is ineffective. Yeah…supervisors must be willing to address. You are constantly trying to influence the few and there is no metric to gauge success. It is the hamster wheel of security.

Another consideration is the need to empower the staff beyond their participation in the security awareness training alone. What happens next? Most corporate inboxes have a button to Report A Suspicious Email, but does your personnel know how to report a security incident unfolding in the office? What about in the parking lot? Security is everyone's responsibility, and staff needs to be given tools, tactics, and effective communication channels to report suspicious incidents, engage (safely and politely) with their peers, and de-escalate conflict, if necessary, to play their part in the security of a workplace.

Overcoming staff resistance to security awareness involves aligning organizational priorities with security measures. Identifying security as a top priority ensures compliance, as employees recognize its mandated nature and its impact on evaluations, especially in sectors like banking and defense installations. My opinion aligns with the view that organizational commitment plays a pivotal role in fostering a culture of security awareness.

It is better to train employees how to secure remote offices or home offices rather than bullying them. There is still some catching up to do, especially for small and medium-sized companies that are not necessarily technology-savvy. A password manager procured by the company itself - and not just one from Google, which may worryingly be linked to the private account - or its own professional VPN speaks for the company and also creates additional, controlled and accepted security. This prevents blind spots from emerging due to shadow IT - for example, if a user has a bad experience with the capacity of conventional office communication tools while on the move and uses his private Dropbox for business content.