We’re hosting a new series highlighting members of our Security Awareness Manager community and their lessons learned while creating and running awareness programs that go beyond checking the box, they make an impact.
Our kick off started with the power team at Carrier led by Dennis Legori and Paula West to learn some of the lessons learned that they see as contributing to their successful - and award-winning - security awareness program.
Being tasked with building a security awareness training program at the height of the pandemic when everyone went into crisis mode, they realized they needed to change the focus from what traditional, on-prem engagements looked like to complete digital campaigns while keeping in mind cyber security was far from top of mind at the time.
One identified tipping point for their security culture came as a result of a phishing competition during October’s Cybersecurity Awareness Month. Along with it being voluntary participation, a Teams channel was opened to provide friendly sparring during the event. This channel unexpectedly became a place for two-way communication between the security team and employees that went beyond the friendly trash talking. Participants began sharing questions or other scams received outside of the competition through this channel of communication open to them as a fun and safe environment - user engagement and heightened awareness exploded among participants.
(One quick pro-tip provided by Dennis if you’re using Teams with a large organization is to create a distribution list and then upload to the channel - this helps to get around the 500 user limit per channel.)
What’s more, many of these participants naturally became security awareness ambassadors to their colleagues which is a great indicator of a successful program!
The phishing competition was gamified as a custom story of the fictitious Golden Nickel Hacking Group trying to attack Carrier through ransomware delivered via email. Participation was voluntary and the event was marketed through different internal social channels. The initial response was over 2000 participants for their first competition! Through the established Teams channel, competitors engaged along with the SOC team who also competed. As mentioned in the interview, this was one layer which helped humanize the SOC / employee relationship and contributed to more open communication and approachability.
One surprise result was the competitors themselves began asking for harder and harder phishing tests which opened up the opportunity to run campaigns that were usually off limits by HR. In other words, during the competition, they ran campaigns spoofing managers' emails and getting permission from some of their leadership as well to simulate a compromise with their email address to create more advanced phishing sims.
In most businesses, a phishing simulation is usually scheduled either monthly or quarterly but for this particular campaign during October's Security Awareness month, the team slated daily phishing emails for a period of two weeks. The combination of an engaged and competitive atmosphere, the knowledge of higher difficulty of phishes and the daily challenge to not be phished resulted in employees who were on high alert. As such, Dennis and Paula saw a huge jump in reporting of phishing emails not only thanks to the competition but in real-life reporting as well. What previously was 40-50 phishing emails reported daily by employees jumped to 60-70 reports from increased awareness and positive engagement.
""Our message is 'if you click on it, report it to the SOC'" - Carrier's focus - or KPI - is not on the number of people who clicked on a phishing message but rather on the proactive steps taken by a user - reporting it! "Because we had the SOC on the call (during the competition) our greatest success was people confessing 'oh I clicked on it, I feel bad' or 'I clicked on a real email but our SOC was so helpful - the SOC provided this great customer experience' and it was immersive. At the end of the competition users were already clamouring for the next one - definitely a KPI in itself to the success of an engaged community.
Carrier had 2000 employees who experienced intense and sophisticated training (happily!) that it carried over after the training ended. The team also noticed not only was there an increase in the quantity of reported phishing after the event, there was also an increase in the quality. This was evidenced through one story of a sales team member in France who received an email from a customer and identified a business email compromise and notified the customer to speak with their security team. She reported it and while it was confirmed, she already spoke with the client and took care of it. This was one of many real incidents and helped change the culture of the team as more employees view themselves as "Enterprise Defenders" and a critical piece in the security firewall for their company.
Below are a few more insights from their security awareness training program evolution:
In short, Paula summarizes the underlying theme to their program’s success, “We’ve created an environment where we understand that each of us can make a difference.”
Dennis -
Paula -
While there is no magic bullet for “THE” way to do security awareness training, Dennis and Paula’s insights and innovative approach certainly provide some great ideas to consider.
If you wear the hat for managing the security awareness program for your organization, we’d love to have you as part of our community, join us here to get more updates for future interviews and our virtual meetups.
Looking for awareness training that is short, relevant and engaging? Check out Wizer’s free video library.