Raising Employee Awareness: Which Training Strategy To Go For? by Eric Bärenzung

### Overview In this talk, Eric Bärenzung addresses the strategy and methodologies behind raising employee cybersecurity awareness. While human beings are often described as the "weakest link" in enterprise security, Bärenzung rejects this characterization. Instead, he highlights findings such as the Verizon Data Breach Investigations Report—which attributes 85% of breaches to human error—to argue that people are simply easy, frequent targets for cybercriminals. Consequently, the primary goal of security training must be to transform employees into an organization’s best allies and strongest security controls. Effective training requires explaining the fundamental "why," adapting content to institutional and regional culture, leveraging gamification, and establishing continuous, positive measurement rather than punitive practices.

### Key Topics - **Establishing the "Why" and Executive Support**: Effective training starts by conveying why the company is at risk and why each person's role matters biologically and motivationally. Bärenzung stresses that security teams must approach company leadership not just with complaints, but with concrete solutions and specific asks to gain proper executive backing. - **Content Formats and Cultural Fit**: Awareness programs should adopt varied delivery mechanisms—such as newsletters, booklets, lunch-and-learn sessions (e.g., at IWC), awareness months (European Cyber Security Month in October, Singapore in May), and branded physical items (mugs, mouse pads). When designing presentations, he references the 10/20/30 rule (10 slides, 20 minutes, large font) and optimal video lengths of 3 to 6 minutes. Furthermore, messaging and humor must respect distinct cultural contexts (e.g., France vs. Japan) and varying corporate environments (e.g., private banking vs. medtech startups). - **Gamification and Modern Formats**: Incorporating friendly competition, escape rooms (e.g., ITV in the UK), and machine-learning-driven adaptive scenarios (such as an initiative at ZKB in Switzerland or kits by ANSSI in France) fosters voluntary participation and long-term engagement. - **Measurement and Metrics**: Key Performance Indicators (KPIs) justify budgets and evaluate maturity (such as the SANS maturity model). Metrics should focus on positive outcomes—such as the frequency of incident reporting, quiz completion, user satisfaction, and questions raised to the security team—rather than solely phishing click rates, which can be noisy and discouraging. Bärenzung advocates running regular simulations (e.g., around eight phishing campaigns per year) without overloading users.

### Technical Details Core training curriculums should balance classic hygiene topics with specialized engineering domains: - **Primary Hygiene**: Phishing identification (accounting for an estimated 80% of threats in financial industries), password hygiene, avoiding malicious removable media/USB drives (noting cases of malware-laden USB drives mailed via postal services and historic incidents involving uranium facilities), mobile application security, and system patching. - **Data Leak Prevention (DLP)**: Educating users on data classification schemes, proper file encryption, and steering staff away from unsecured internal emailing toward approved secure repositories (e.g., restricted SharePoint). - **Advanced Subjects**: Specialized training where appropriate, including secure software development, IoT/embedded systems, quantum security, and crisis management exercises (referencing ITU exercises, such as one held in Moldova).

### Takeaways - **No One-Size-Fits-All Approach**: Security awareness must be tailored to organization size, industry sector, regional culture, and individual employee expertise levels. - **Avoid a Blame Culture**: Shaming or penalizing employees who fail phishing simulations discourages incident reporting and damages trust. Organizations should instead reward vigilance and positive reporting, comparing it to lottery-based positive reinforcement mechanisms rather than punitive ticketing. - **Security Teams as Problem Solvers**: Rather than acting strictly as rigid enforcers who block tools or blacklist applications, security practitioners must explain risks clearly using real-world breach examples, offer direct alternatives, and engage through concise, personal meetings rather than repetitive broadcast emails.