Security-Awareness on Rishipal Yadav · not your CISO

Security Awareness Training: A Design Thinking Project

Sat, 27 Apr 2024 00:00:00 +0000

This article was originally published on not your CISO on Medium. Read the full post →

During the last semester (Spring 2024) of my Master of Engineering in Cybersecurity at the University of Maryland, College Park, I joined the Innovation Fellowship cohort at the Academy for Innovation and Entrepreneurship. The project: apply design thinking to security awareness training.

Security awareness training has a reputation problem. Compliance teams love it. Employees hate it. And the data on whether it actually changes behaviour is, at best, mixed. The question I started with was: what would security awareness training look like if you designed it the way a product designer would — starting with the user, not the policy?

Educate Your Team — Do Not Chase When It Comes to Security

Mon, 05 Sep 2022 00:00:00 +0000

This article was originally published on not your CISO on Medium. Read the full post →

“Hey, could you please complete the security training, it was due two days ago?”

If that message sounds familiar — either as the person sending it or the one ignoring it — your security awareness program has a problem. And the problem isn’t that people are lazy or don’t care about security. The problem is that you’ve built a compliance exercise and called it a culture.

Back to Office: But What About Security?

Thu, 28 Jul 2022 00:00:00 +0000

This article was originally published on not your CISO on Medium. Read the full post →

Things are back to normal, and everyone is returning to their offices. Some are ecstatic about free food, coffee, and office gossip. Others are dragging their feet. And most security teams are somewhere in between — quietly aware that two years of remote-first work has created some habits that don’t translate well to shared physical spaces.