- [Instructor] Security education is an important component
of any organization's information security program.
If employees don't know their security responsibilities,
you can't depend upon them to do their part
to protect information and systems.
It's important that organizations take steps to measure
the effectiveness of their security education efforts.
In an earlier video, we looked at one way
to measure security awareness through the use
of simulated phishing campaigns.
That certainly is a valid way to measure
the effectiveness of anti-phishing education programs.
But you don't need to go to those great lengths to measure
the effectiveness of your security education program.
Security awareness measuring efforts
don't need to be complicated.
One easy way to measure the effectiveness of your program
is simply to ask users how they feel
about security education in a survey.
You might simply ask, how well do you think
our organization prepares you to deal
with information security threats?
Or, do you know your information security responsibilities?
You can also measure how well you're educating
users about incident response practices by asking,
do you know where to report a security incident?
These survey-based measures give you
a good perspective on how well prepared
your workforce is to deal with security issues.
This approach to measuring security education is most
effective if you look at how answers change over time.
You might insert a few security related questions
into a quarterly employee survey
and then watch how the answers change as you try
different security awareness and training initiatives.
You should use the results of security awareness surveys
to help select new training and awareness tools,
as well as tailor the message
to answer changing user questions.
The metrics that you collect on security awareness
should complement other security metrics initiatives
designed to evaluate your security and compliance posture.