Security Built on Fear Failed Until Children Redesigned It as Comics | An On Location Conversation at ISC2 Security Congress with Joseph Carson, James McQuiggan and vCISO and Human Risk Management advisor at Apparent Security
A security program built on enforcement and fear creates friction, and people stop paying attention. At ISC2 Security Congress in Denver, Joseph Carson, Chief Security Evangelist & Advisory CISO at Segura, tells Sean Martin what happened when his team at a large transportation car manufacturer admitted its approach was not working.
Carson describes the team putting enforcements and policies in place, then realizing a couple of months in that the program rested on fear: you need to patch, reboot, update, take this course. Noise from the next conference room turned out to be a bring-your-kid-to-the-office day, and the team sat with the children for an hour, an hour and a half, asking what they would suggest.
Two ideas came out of that room. One child asked about comic books, which meant less text and fewer translations. Another suggested bathroom doors, because everyone goes at least once a day. Each quarter the awareness training now carries a new four-panel message on not plugging in USBs, using multi-factor authentication and patching systems, posted on bathroom doors, in elevators and at the canteens.
Carson calls it a redefining moment in his career. It changed how he views security: be an enabler and a promoter, so people see it as a good thing. That is why he prefers zero friction to zero trust, meaning security that just works and helps people meet the metrics they are measured on.
The conversation also touches on career disruption, internal security evangelists and using AI with guardrails, and it matters for anyone whose awareness program is being ignored.
Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=a-security-program-built-on-fear-failed-until-children-redesigned-it-as-comics
Cybersecurity Courses on Udemy | https://www.udemy.com/topic/cyber-security/?p=28
AI Act | Shaping Europe's digital future | https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
The NIST Cybersecurity Framework (CSF) 2.0 | https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20