{"version":1,"type":"rich","provider_name":"Libsyn","provider_url":"https:\/\/www.libsyn.com","height":90,"width":600,"title":"Episode 202: -Evaluating Your Security Program : Awareness & Education","description":"Episode 202 - Evaluating Your Security Program: Awareness & Education   Why Evaluate Your Program Part of annual policy review If you don\u2019t evaluate you will never improve Continual review will help protect your budget Awareness and Education is how most people in your org know the program Threat Mapping maps the outside threats to your inside controls & tech Communications is that final turn from the inside out Start At The Outside and Move Your Way In What do you think you do? Mandatory CBLs CyberCyberCyberStuff (Posters, Email, Swag) Briefings and Classes Phishing Awareness $NOVEL_IDEA How many people is it designed to engage? Not how many people took the awareness, how many people were ENGAGED? How many people were actually engaged? How did they do? (CBL completions, % phished, reviews, etc) If CBL_Completion = 15(clicks) then you may want to rethink that 0% phished is not a sign of a great security program...more likely a sign of a bad phishing program If there is no way to allow for anonymous reviews of training\/briefings\/etc then you\u2019re not likely to get fully honest reviews (Who wants to piss off security?) Are you being honest with yourself? How do you measure it? Measuring Awareness & Education Don\u2019t change the measurement...change the program The key to long term success is consistently measuring the same thing over time You may want to update goals (up or down) but be able to explain why especially if you are making the test easier Big changes in delivery will skew the numbers in ways you likely will not like Constant large turmoil is counter to most corporate cultures Small changes take advantage of previous investments best \u201cIterate small and grow larger\u201d - doing too much too fast almost always ends is highly suboptimal results over time Don\u2019t make drastic changes until Year 3 unless you have to make drastic changes Clearly failing components should be axed and replaced and not tweaked around the edges - especially if there\u2019s a compliance or safety aspect Adjusting The Program If this feels like \u201cWash, Rinse, Repeat\u201d it\u2019s because is it \u201cWash, Rinse, Repeat\u201d ","author_name":"The Southern Fried Security Podcast","author_url":"http:\/\/www.southernfriedsecurity.com","html":"