Security-Awareness on Rishipal Yadav · not your CISO

Security Awareness Training: A Design Thinking Project

Sat, 27 Apr 2024 00:00:00 +0000

This article was originally published on not your CISO on Medium. Read the full post →

During the last semester (Spring 2024) of my Master of Engineering in Cybersecurity at the University of Maryland, College Park, I joined the Innovation Fellowship cohort at the Academy for Innovation and Entrepreneurship. The project: apply design thinking to security awareness training.

Security awareness training has a reputation problem. Compliance teams love it. Employees hate it. And the data on whether it actually changes behaviour is, at best, mixed. The question I started with was: what would security awareness training look like if you designed it the way a product designer would — starting with the user, not the policy?

You Must Remove Text Message Two-Factor Authentication

Sat, 18 Feb 2023 00:00:00 +0000

This article was originally published on not your CISO on Medium. Read the full post →

Last night, just before I went to sleep, I decided to check Twitter. The first thing I saw was the announcement that Twitter was removing SMS-based two-factor authentication for non-Twitter Blue users. The reaction was predictably split — some celebrated, some panicked.

Both reactions missed the point.

SMS-based 2FA is not secure. It is better than a password alone, but SIM-swapping attacks have made it a weak link that sophisticated attackers exploit routinely. The Twitter decision — however poorly communicated — is directionally correct. The question for security teams and individuals alike is: what replaces it?

Educate Your Team — Do Not Chase When It Comes to Security

Mon, 05 Sep 2022 00:00:00 +0000

This article was originally published on not your CISO on Medium. Read the full post →

“Hey, could you please complete the security training, it was due two days ago?”

If that message sounds familiar — either as the person sending it or the one ignoring it — your security awareness program has a problem. And the problem isn’t that people are lazy or don’t care about security. The problem is that you’ve built a compliance exercise and called it a culture.

Back to Office: But What About Security?

Thu, 28 Jul 2022 00:00:00 +0000

This article was originally published on not your CISO on Medium. Read the full post →

Things are back to normal, and everyone is returning to their offices. Some are ecstatic about free food, coffee, and office gossip. Others are dragging their feet. And most security teams are somewhere in between — quietly aware that two years of remote-first work has created some habits that don’t translate well to shared physical spaces.