Ira Winkler and Samantha Manke just wrote a great article at the CSO site about why security awareness programs fail.
They started out with: "There is a great dichotomy in Security Awareness. Just about all of the CSOs we talk to believe that one of their top priorities is to improve their organization's security culture — in other words, the behavior of their users. Similarly, we see article after article and study after study talking about how humans are the primary attack vector for advanced attacks. Some studies indicate that human exploitation is the key enabler in as many as 90 percent of attacks. Buzzphrases, such as protecting and attacking "Layer 8" have emerged.
Yet we periodically see the media entertain notions that challenge the value of security awareness. While there are notable security awareness failings, awareness, like all security efforts, is about risk mitigation not complete prevention and needs to be implemented properly."
The Seven Awareness Failures are:
- Not understanding what security awareness really is
- Reliance on checking the box
- Failing to acknowledge that awareness is a unique discipline
- Lack of engaging and appropriate materials
- Not collecting metrics
- Unreasonable expectations
- Relying upon a single training exercise
