# Presentation: 677775

## IT Security Awareness, Training and Education Trends

- Dan Costello
- Policy Analyst
- OMB

**Notes:**
We’re talking about IT security Awareness and training – EDUCATION – and began wondering what education really was in the big picture

## What is Education?

- Webster’s Third New International Dictionary: the act or process of educating or of being educated; a conditioning, strengthening.
- Harvard Graduate School of Education: 5,782 hits on the search first of which provides files on how to reflect on your teaching practice.
- Web definition: the activities of educating or instructing or teaching; activities that impart knowledge or skill.

**Notes:**
When I googled this question I found 131,000,000. Search took 2.49 seconds 

Didn’t look at the Department of Education

None of these get to the purpose of Education.  The purpose of Education is not easy to find.  

easier to talk about what Education is and how to do it effectively – harder to discuss the value in it

You’ve all been here for a few days and have heard a lot about IT security awareness, training, and education.  Does anyone have ideas of what those missing parts are?  Look no further than NIST 800-16

## Education is:

- 	NIST 800-16: Education integrates all of the security skills and competencies of the various functional specialties into a common body of knowledge, adds a multidisciplinary study of concepts, issues, and principles (technological and social), and strives to _***produce IT security specialists and professionals capable of vision and pro-active response***_***.***

**Notes:**
Education does something, For IT Security purposes.Training shows users how to respond and how to get help. Education isn’t just a requirement, it also has a purpose

## Agenda

- FISMA & A-130 Security Training Concepts
- Findings from FY03 FISMA Reports
- Some Key Ingredients for Success

## FISMA

- _Head of each agency shall:_
- Ensure the agency has trained personnel sufficient to assist the agency in complying with related policies, procedures, standards, and guidelines needed to secure information systems.
- Delegate to CIO authority to ensure compliance with the requirements imposed on the agency including training.
- _The agency information security program shall include:_
- security awareness training to inform personnel, including contractors and other users of information systems supporting the operations and assets of the agency, of:
- security risks, their responsibilities in complying with agency policies, _***and procedures designed to reduce these risks***_.

## A-130 Concepts

- 1) Every new user of a system introduces a risk to all other users. AND
- 2) Over time, attention to security tends to dissipate.  Concurrently, changes to a system may necessitate a change in the rules or user procedures.
- _SO:_
- 	Training is required for all users (including contractors) prior to access and should be periodic to refresh and update users.

**Notes:**
Rules and training expectations can be included in contract language to ensure contractors are trained.

## A-130: Rules of the System

- Establish a set of rules of behavior concerning use of, security in, and the acceptable level of risk for, the system.
- Rules are based on the needs of various users of the system.
- The security provided by the rules should only be as stringent as necessary to provide adequate security.
- Rules delineate responsibilities and expected behavior of users.
- Rules articulate consequences of behavior not consistent with the rules.
- System rules are basis for training.

**Notes:**
Potential consequences include the loss of system privileges

## A-130: Training

- Training required for all users prior to access to the system.
- Training is tailored to what a user needs to know to use the system securely, _***to respond and think proactively & preventatively***_.
- Training can be presented in stages, as more access is granted.
- Training can vary from formal classroom to clearly written brochures depending on the type of access allowed and the risk that access represents to the security of the system and the information in it.

**Notes:**
Training shows users how to respond and how to get help

## Complementary Guidance

- NIST IT Security Training Requirements – A Role & Performance Based Model (800-16)
- NIST Guide for Developing Security Plans for Information Systems (800-18)
- NIST Building an Information Technology Security Awareness and Training Program (800-50)
- OMB FISMA Reporting Instructions (M-03-19)

## C.3 Has the agency CIO ensured security training and awareness of all agency employees, including contractors and those employees with significant IT security responsibilities?*

| a. Total number of agency employ-ees in FY03 | b. Agency employees that received IT security training in FY03
 |  | c. Total number of agency employees with significant IT security responsi- bilities
 | d. Agency employees with significant security responsibilities that received specialized training
 |  | e. Total costs for providing training in FY03 |
| --- | --- | --- | --- | --- | --- | --- |
|  | Number | % |  | Number | % |  |
| 4,335,518 | 3,468,404 | 80% | 61,721 | 53,010 | 86% | $26,482,988  |

- *Aggregated governmentwide data provided by Agency FY03 FISMA reports

## Findings from FY03 FISMA Reports

- _B. Security Awareness Training:_ 10 agencies provided security awareness training to 95% or more agency employees, 5 agencies with 50% or less.
- _D. Specialized Security Training:_ 6 agencies provided specialized security training to more than 95% of agency employees with significant security responsibilities. The remaining agencies fell between 60-95%.
- Agencies identified 1%-6% of agency employees as performing significant security responsibilities.
- Average cost to train one agency employee was $7.64, however there was a wide range of average cost by agency.

**Notes:**
4) Indicates varying relationships btwn agency and group providing training; as well as variance in how training costs are accounted for

## Findings from FY03 FISMA Reports

- OIG and agency reports hilited lack of or achievement of security awareness training.
- Agencies have designed and implemented a security awareness program.
- Most agencies are monitoring and assessing training programs to track compliance to agency requirements and modify the programs.
- Some agencies require employees to fulfill security awareness training once per fiscal year, seeing spike in September after most agencies have closed out data for reporting purposes.

**Notes:**
1) Often as material weakness or great achievement

## Key Ingredients for Successful Training and Awareness Programs

- Is senior management involved/sponsoring?
- Is training aligned to support your agency’s mission?
- Does training account for various working environments (home, office, contractors)?
- Is training varied to address evolving challenges and dynamic to stimulate interest (i.e. flyers, regular emails, formal classroom, IT security awareness day)?
- Is training monitored to track employees and linked to HR systems to view who has/has not fulfilled agency training requirements?

**Notes:**
2) Because if so, employees can more easily see relevancy

5) Building competency profile

## IT Security Education Drives Mission Performance

- Awareness & Training

- Education

- Proactive & Preventative & Responsive

**PERFORMANCE**

**Notes:**
To mitigate risk and increase performance

## QUESTIONS

- Dan Costello
- _[dcostell@omb.eop.gov](mailto:dcostell@omb.eop.gov)_
- 202-395-7857