Do “cybersecurity awareness” campaigns have an actual impact on your organization?

These have been very helpfull for us and they certainly help. As an organization, we have seen a dramatic decrease in successful fishing attacks after running cybersecurity awareness campaigns.

In a general sense, October as cybersecurity month remind a lot of companies to run awareness campaign, that reminded their employees to be vigilant, not click on email links from unknown senders etc. Over the years this has been perhaps less effective as the threat actors adapted new more sophisticated methods, but in my opinion humans (employees) are still the weakest link so cybersecurity awareness campaigns are beneficial.

We are still having the same conversations that we had 10 years ago. As a professional in the security organization, it starts with taking accountability and ownership. We are past a point in time where awareness is even acceptable. We need engagement, ownership, and accountability because we already know that the actors understand how to leverage architecture in a way that's much more advanced than what we demonstrate with consistent adherence as industry practitioners. It's almost like when we get to a security awareness October each year, it's the same conversations we had the year before. As leaders in the industry, we should say, "Enough's enough—this year we're going to target X, Y, and Z."

When I was in the Health-ISAC several years ago, as leaders in the industry, we said, "For all the members in this group, we're going to attack DMARC. You're going to hit your target, update your controls and your configuration around email management practices, and we're going to address consistency in this area.” That's what we have to do as security professionals to set a path. 

Cybersecurity awareness is interesting, because as much as you read and hear about cybersecurity, there is always a gap in terms of taking it seriously, applying it in your day-to-day job, and making sure that it's always a background consideration. That's how we get into all the ongoing cybersecurity issues that we see everyday.