Boura, A. (2015, December 8). Advocating the rise of the Security Awareness Marketing function. andy.boura.uk. https://andy.boura.uk/blog/security-awareness-marketing/
MLA (9th edition)
Boura, Andy. “Advocating the rise of the Security Awareness Marketing function.” andy.boura.uk, 8 Dec. 2015, andy.boura.uk/blog/security-awareness-marketing/.
Chicago (17th edition, bibliography)
Boura, Andy. “Advocating the rise of the Security Awareness Marketing function.” andy.boura.uk, December 8, 2015. https://andy.boura.uk/blog/security-awareness-marketing/.
Harvard
Boura, A. (2015) Advocating the rise of the Security Awareness Marketing function. Available at: https://andy.boura.uk/blog/security-awareness-marketing/.
IEEE
A. Boura, “Advocating the rise of the Security Awareness Marketing function,” andy.boura.uk, Dec. 8, 2015. [Online]. Available: https://andy.boura.uk/blog/security-awareness-marketing/
BibTeX
@misc{boura2015advocating,
author = {Boura, Andy},
title = {Advocating the rise of the Security Awareness Marketing function},
year = {2015},
month = {dec},
howpublished = {\url{https://andy.boura.uk/blog/security-awareness-marketing/}}
}
A panel at the Computing ESRM summit was asked about the biggest risk to organisational information security, and the answer was people.
So how to address the people issue? Well automation can go some way to addressing it, as can appropriate technical controls. But ultimately security needs embedding in the thought processes of anyone handling sensitive information, directly or indirectly.
Aren't most good security awareness "campaigns" with many of the hallmarks of marketing anyway? I would normally be first in line to advocate focussing on the goal (awareness), rather than the mechanism (marketing). However a lot of current security awareness feels like posters and banner adverts, or painful sermons. Things that are all too easily missed in the age of brand relationships and social media. What's needed is creativity, humour, and techniques to engage and build communities around great content.
Different intent and metrics follow from the paradigm shift: Marketing metrics like social engagement, conversion rates, and effectiveness of calls-to-action come to the fore. The need for multimedia and multi-channel strategies becomes clearer. As does the drive for engaging content. These metrics can even be shared and benchmarked; by pooling resources and best practice everyone can win together - even fierce competitors (book recommendation: Friend and Foe).
Segmentation, acknowledging the different needs of different groups, and targeting content appropriately; naturally follows from this. As does ensuring that value is delivered to those being reached. My favourite security awareness content is the XKCD at the top of this article; though it's only going to work for a technical audience.
So what should the future of Security Awareness Marketing look like? People with deep knowledge of the security domain identifying the core messages; targeted at specific audiences; that are then produced and delivered by specialists in marketing and analytics. This may be too much to ask of SMEs but is within reach of many enterprises, and could readily be packaged as a service, or shared, for smaller organisations and the general public.
There's a case for saying this shift is already underway; my hope is that by calling for a change of terminology, this progress might accelerate and attract marketers into the field. It's time for the rise of the Security Awareness Marketing function.
Regards Andy Boura
xkcd.com/327xkcd's Exploits of a Mom: a school loses its records to a pupil named Robert'); DROP TABLE Students;--, a joke about SQL injection.
en.wikipedia.org/wiki/Security_awarenessSecurity awareness is what people in an organisation know about security threats and how to act on them, and the training that builds it.
en.wikipedia.org/wiki/Conversion_marketingA conversion rate is the share of people reached who go on to take the action wanted, such as signing up or completing a course.
en.wikipedia.org/wiki/Call_to_action_(marketing)A call to action is a prompt that tells the reader exactly what to do next, such as “Report it” or “Sign up”.
amazon.co.uk/dp/1847940838Friend & Foe (2015) by Adam Galinsky and Maurice Schweitzer, on when to compete and when to cooperate.
en.wikipedia.org/wiki/Market_segmentationMarket segmentation divides an audience into groups with similar needs or traits, so each group can be reached with messages that suit it.
en.wikipedia.org/wiki/Small_and_medium_enterprisesSmall and medium-sized enterprises (SMEs): businesses below a size threshold, in the UK generally fewer than 250 staff.
Thanks for reading. For more on cyber security, technology and leadership, subscribe to the mailing list, follow me on LinkedIn or subscribe to this blog's RSS feed.
By Andy Boura