People who are not in cyber security aren’t necessarily obsessed with the latest attacks and the impact they are having. That’s because they already have other difficult projects they are working on or are dealing with difficult personal issues. This is the first thing that any security team should understand before rolling out a security awareness email.
They should avoid being overly technical and dramatic in communicating trending or successful attacks. Instead, they should simplify what they want to communicate to make it possible for non-IT staff to understand. This empathetic approach can be improved by adding a non-IT person to the security team.
Our guest today is Lance Spitzner, Director of SANS Institute and founder of the Honeynet Project. He has over 20 years of security experience in cyber threat research, security architecture, and awareness training. He has published three security books, consulted in over 25 countries, and helped over 350 organizations build awareness programs to manage their human risk.
In this episode, you will learn why simplifying security is the best approach to protecting the most vulnerable attack vector, the people. You’ll also learn why security teams need to have someone with a communication background. Additionally, you’ll learn how to determine if the security team is empathetic.
In this episode, you will learn:
- Why simplifying security is the best approach to secure people (02:24)
- Why security teams need to have somebody with a communication background (10:20)
- The importance of having an empathetic security team (18:13)
- Lance shares an empathetic security approach success story (28:37)
Resources:
- Book - Thinking, Fat and Slow
- Lance Spitzner and Carolyn Crandall at RSAC 2019
- Lance Spitzner - Securing the Human Being
Connect with Lance:
- Website
Let’s connect!
- Website