February 14, 2023 

1:00pm – 4:00pm ET

#FISSEA2023 | nist.gov/fissea

Federal Information Security Educators (FISSEA) 

Winter Forum
#FISSEA2023

Welcome and Opening Remarks

Kendra Henthorne

FISSEA Co-Chair

IT Cybersecurity Specialist

Social Security Administration 
#FISSEA2023

Get Involved

Subscribe to the FISSEA Mailing List 

FISSEAUpdates@list.nist.gov

Volunteer for the Planning Committee

https://www.nist.gov/itl/applied-cybersecurity/fissea/meetfissea-planning-committee

Serve on the Contest or Award Committees for 2023

Email fissea@list.nist.gov

Submit a presentation proposal for a future FISSEA Forum 

https://www.surveymonkey.com/r/fisseacallforpresentations
#FISSEA2023

Dr. Aunshul Rege

Associate Professor/ Director of the Cybersecurity in 

Application, Research, and Education (CARE) Lab

Temple University

Why Social Engineering Should Be Part of The Cybersecurity 

Education Discourse

Keynote
FEBRUARY 2023 FISSEA MEETING

Why Social Engineering Should Be Part of The 

Cybersecurity Education Discourse

Dr. Aunshul Rege

Director, CARE Lab

rege@temple.edu
FEBRUARY 2023 FISSEA MEETING 6

Acknowledgements

Office of Enterprise Risk Management

College of Liberal Arts Marketing Team

CISA NICE SentinelOne
FEBRUARY 2023 FISSEA MEETING 7

The CARE Lab

Aunshul Rege Katorah Williams Rachel Bleiman

@prof_rege @KatorahW @rab1928

7

• Human, socio-behavioral focus

• Funded by NSF + DoE/INL

• Critical infrastructure, ransomware, privacy, surveillance, 

disinformation, social engineering (SE), cybersecurity education

@drspenceloading

Gabrielle Spence

• CARE = Cybersecurity in Application, Research, and Education
FEBRUARY 2023 FISSEA MEETING 8

Agenda

• Why teach students Social Engineering (SE)?

• What does SE education look like?

• What are the challenges in (and responses to) teaching SE?

• (How) does SE education benefit students?

• So... why teach students SE?
FEBRUARY 2023 FISSEA MEETING

Why teach students Social Engineering (SE)?
FEBRUARY 2023 FISSEA MEETING 10

Current training for next generation workforce

• Global cybersecurity workforce shortage

• 3.4 million workers needed

• Computer science & engineering already investing heavily

• Hands-on/experiential learning

• Capture the flag (CTF) competitions 

• Too small and homogenous for holistic solutions

• Enlarge & diversify to foster creative potential

• Human factor in cyberattacks/security
FEBRUARY 2023 FISSEA MEETING 11

What is social engineering (SE)?

• Manipulating human behavior/psychology to get individuals to:

• Reveal information

• Provide access

• Perform an action

Why address SE?

• Consequences1: 

• Direct financial loss

• Recovery cost

• Productivity loss

• Operation disruption

• Reputation damage

1 https://www.graphus.ai/blog/the-five-agonies-of-social-engineering-cyber-attacks/ https://www.ic3.gov/Media/PDF/AnnualReport/2021_IC3Report.pdf
FEBRUARY 2023 FISSEA MEETING

What does SE education look like?

In the classroom
FEBRUARY 2023 FISSEA MEETING 13

CARE Lab’s efforts to teach SE

• This educator’s concern

• Liberal arts students feel they can’t contribute to cybersecurity

• Computer science students not exposed to human aspects

• Several SE projects mapped to NICE Framework

• Pretexting, OSINT, privacy, shoulder surfing

• https://sites.temple.edu/care/social-engineering/course-projects/

• Ethics

• IRB approved; student training

• > 1,000 downloads worldwide

• Educators, students, industry, government
FEBRUARY 2023 FISSEA MEETING 14

What is shoulder surfing?

• Using direct observation

• Looking over individuals’ shoulders at their device

• Surfing with them without their knowledge or consent

• Gather sensitive information for malicious purposes

• Personal information/conversations

• Passwords

• PINs
FEBRUARY 2023 FISSEA MEETING 15

Shoulder surfing

Action Shot

Rege, A., Mendlein, A. (+) & Williams, K. (+) (2019). "Security and Privacy Education for STEM Undergraduates: A Shoulder Surfing Course Project". Proceedings of the IEEE 

Frontiers in Education.

1 2
FEBRUARY 2023 FISSEA MEETING 16

Shoulder surfing: Student thoughts

• Strategies (Offense)

• In Class

• Remember seating arrangement & what devices used

• Honeypots 

• Outside Class

• Follow rival team members after class: persistence

– Keep a good distance (10-15 feet minimum)

– Blend in (hats, sunglasses, etc.); remain stealthy

• Cross-reference rival team members for shared classes

• Overall

• Patience, quick action
FEBRUARY 2023 FISSEA MEETING 17

Shoulder surfing: Persistence

• Followed rival team 

member

• 20 minutes

• Persistence paid off!

1

2
FEBRUARY 2023 FISSEA MEETING 18

Shoulder surfing: Student thoughts

• Strategies (Defense)

• High alert

• Turn off devices

• Sabotage (photobombing)

• Change seating location (back, by walls) and position (sideways)
FEBRUARY 2023 FISSEA MEETING

What does SE education look like?

Beyond the classroom
FEBRUARY 2023 FISSEA MEETING 20

2021: SE penetration test

• The CARE Lab “hired” student teams to conduct a SE pen test 

on the CARE Lab and its employees

• OSINT, phishing, and vishing

• Formal report: findings + security recommendations
FEBRUARY 2023 FISSEA MEETING 21

2022: Ransomware and SE

• The CARE Lab was hit with ransomware and “hired” student 

teams to serve as negotiators

• Interface with client + negotiate with ransomware group

• Formal report: negotiation summary + outcome/standing + 

security recommendations
FEBRUARY 2023 FISSEA MEETING 22

2023: Romance scams and SE

• Inspired FTC Report

• 2021 ~ $547 million1

• 2022: $1.3 billion2

• CARE Lab has been brought in to help the elderly who are 

falling victim to catfishing scams

• 70+: individual median loss $9,000

• Intergenerational emphasis

• Registration opens today! 

• CISA, NICE, AARP, PBGC

• G: May 19-21 | UG: June 2-4 | HS: June 9-11 

• https://sites.temple.edu/socialengineering/

1 https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/02/reports-romance-scams-hit-record-highs-2021

2 https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2023/02/romance-scammers-favorite-lies-exposed
FEBRUARY 2023 FISSEA MEETING

What are the challenges in (and responses to) teaching SE?
FEBRUARY 2023 FISSEA MEETING 24

• “Aren’t you teaching students how to deceive others?”

• “Isn’t what you’re doing ethically wrong?”

Challenges: Deception & ethics
FEBRUARY 2023 FISSEA MEETING 25

• Hacking CTFs

• Not teaching it is worse

• Best defense is a good offense

• Ethics & code of conduct

• NICE framework success story

• Broadening participation in STEM

Responses
FEBRUARY 2023 FISSEA MEETING 26

NICE Framework Success Story 

https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/nice-framework-success-story-social
FEBRUARY 2023 FISSEA MEETING 27

Broadening participation: Gender

2021 2022
FEBRUARY 2023 FISSEA MEETING 28

Broadening participation: Race & ethnicity

2021 2022

Hispanic: 5% 

Not Hispanic: 66% 

Prefer not to disclose: 29%

Hispanic: 7% 

Not Hispanic: 65% 

Prefer not to disclose: 28%
FEBRUARY 2023 FISSEA MEETING 29

Strategic partners
FEBRUARY 2023 FISSEA MEETING 30

• Innovative thinking & different perspectives that cater to a global threat landscape

• Adversaries aren’t homogenous, so our workforce shouldn’t be either.

Why diversity (gender, race, ethnicity) matters
FEBRUARY 2023 FISSEA MEETING

(How) does SE education benefit students?
FEBRUARY 2023 FISSEA MEETING 32

What are we measuring?

• Relevance of SE to cybersecurity career

• Confidence in SE ability pre-post event

• A supplementary take on diversity, equity, and inclusion (DEI)
FEBRUARY 2023 FISSEA MEETING 33

Relevance of SE to cybersecurity career

2021 2022
FEBRUARY 2023 FISSEA MEETING 34

Confidence in being an effective SE pre/post

2021 2022
FEBRUARY 2023 FISSEA MEETING 35

• Diversity

• A different way of thinking/approaching cybersecurity

Diversity, equity and inclusion

“It doesn’t matter how much we are hardening our technical systems. If 

we still haven’t [addressed the] human element... then the system will 

still be weak.

You learn how to do the offense, and when you learn that, you learn 

about the defense, and you learn that people are susceptible to [SE]”.

- Competition participant
FEBRUARY 2023 FISSEA MEETING 36

• Skills equity = Relatability

• Everyone has experienced SE

Diversity, equity and inclusion

“Cybersecurity is something that everyone can do and be aware 

of and it doesn’t have to be super technical. It can be 

psychological and emotional manipulation”

- Competition participant
FEBRUARY 2023 FISSEA MEETING 37

Diversity, equity and inclusion

“[one team member] studies ...Chemistry , [which] will help us to 

come up with scientific-based solutions when we are faced with a 

challenge... studies in Nursing and ... minor in psychology [would help 

them] figure out how the ... lab employees [thought, and another 

team member’s] background in Global Studies & Italian [would help 

them] come up with persuasive language that ... lab [employees 

would] respond well to. 

The interdisciplinary nature of [our] team [was] a strength that 

[would] help us throughout the competition.”

- Competition participant

• Inclusion: all disciplines are welcomed and valued

• Not about conversion!
FEBRUARY 2023 FISSEA MEETING 38

Disciplinary backgrounds of participants

2021 2022
FEBRUARY 2023 FISSEA MEETING

So... why teach students SE?

Closing thoughts
FEBRUARY 2023 FISSEA MEETING 40

Why teach SE?

• Cybersecurity >> hard sciences

• Exposure to an often-downplayed attack vector

• Ethics and cyber hygiene

• Well-rounded next generation workforce

• For social science

• Empower | change mindset  they CAN contribute

• For hard science

• Better designer | Better defender

• For all

• Break silo-based thinking

• Holistic and multidisciplinary | Respect + value other perspectives

• Employers want SE as part of their employees’ skills set

• Nonprofits, industry, government
FEBRUARY 2023 FISSEA MEETING 41

Nonprofits: Why teach SE? 

“The more eyes we can get on this problem, and the more 

thoughts we can put into this [SE] space, maybe we can 

produce something [that is meaningful]... cybersecurity is a 

shared problem... when you see how the real world works, 

you realize it’s all connected. You can either play in your 

silo and lose the battle or you can open up to new ideas 

and realize you can’t solve the problem by yourself”
FEBRUARY 2023 FISSEA MEETING 42

Industry: Why teach SE? 

“Social engineering has definitely gotten picked up more 

and more; higher profile targets have been attacked via 

social engineering and I think it’s a big blind spot that a lot 

of schools and companies don’t think about as much; they 

are concerned with the technical controls and not with the 

people controls”
FEBRUARY 2023 FISSEA MEETING 43

Government: Why teach SE?

“Social engineering is a part of our everyday lives and we are 

seeing a huge uptick in misinformation and disinformation... 

and we don’t have a grasp on [SE] yet... and if you don’t 

understand it, you’re going to get hit by it”

“I recognized that hardly anyone is doing [SE]... it’s rare to be 

able to exercise and practice this skill ethically... [it] is hard to 

teach... it needs to happen, we need more of it”
FEBRUARY 2023 FISSEA MEETING 44

Shared responsibility

• Educators

• Think outside the box

• Experiential learning with application value

• Subject matter experts

• Government: CISA, NICE (NIST), PBGC

• Non-profit: MITRE (ATT&CK), AARP

• Industry: SentinelOne

• Sponsors

• Validation that SE is relevant
FEBRUARY 2023 FISSEA MEETING

Why Social Engineering Should Be Part of The 

Cybersecurity Education Discourse

Dr. Aunshul Rege

Director, CARE Lab

rege@temple.edu

Thank you. 

Comments/Questions?
#FISSEA2023

Are There Any Questions?

Q&A
#FISSEA2023

Dr. Stephanie Carter

Principal

Coalfire Systems

Security Anime Training
Security Anime 

Training

Dr. Stephanie Carter

Principal, Coalfire Systems
Workforce Statistics By Age

Age Groups Total Population 

(noninstitutionalized)

Total of Total Population 

in the Workforce

Percent of Total 

Population for each Age 

Group in Workforce

Percent Of Total 

Population Employed of 

all Age Groups

16-19 263,973 164,287 62.2% 51%

20-24 20,886 14,817 70.9% 4.6%

25-54 127,162 104,837 82.4% 32.5%

55-64 42,145 27,460 65.2% 8.5%

65 and over 56,710 10,897 19.2% 3.4%

All Age Groups 510,876 322,298 63.1% 100%

• The Baby Boomer Generation (1946 – 1964) – ages 58 to 76

• Generation X (1965 – 1979) – ages 43 to 57

• Millennials (1980-1994) – ages 28 to 42

• Generation Z (1995 – 2012) – ages 10 to 27

• Gen Alpha (2013 – 2025) – ages 0 - 9

*US Bureau of Labor Statistics
Incorporate Various Learning Styles in Security Training

*Training Humans to be Machines, Dr. S. Carter
Elements to Effective Learning 

Effective 

Learning

Attention 

and Focus

Cognition

Concentration

Critical Thinking

Connections 

and 

Associations

Relevant

Relatable

Real

Emotions

Agility 

Reward

Ethical Principles

Innovation 

Room to grow

Room to contribute

Room to express

Diversity

Differences

Norms

Inclusion
Roadblocks to Learning

When you look alike, think alike, feel alike, 

you also share all perceptions in common to 

include:

• Biases

• Blind spots

• All or nothing thinking errors

• In the box thinking and 

performance

• No change

• No innovation

• No perspective

• No diversity
Statistics on Anime

0%

10%

20%

30%

40%

50%

60%

Ages 18-29 Ages 30-44 Ages 45-54 Ages 55-64 Ages 65+

Anime Watched at Leisure

Favorable Unfavorable No Opinion

*statista.com
What Can Be Learned From Anime

Study conducted in 2020 for Capella University 

showed the following themes relating to Anime:

Traits Needed to Promote Security 

in the Workplace:

• Engagement

• Resilience Building

• Attention to Detail

• Flexibility

• Open Mindedness

• Positivity

•Engagement

•Academic Success 

Strategies

•Transition Adaptability

•Resilience Building

•Attention to Detail

•Flexibility

•Open Mindedness

•Positivity

•Facing Obstacles

•Self Advocacy

The Value of Anime in Building Resilience in College Students During Transition, J.M. Reyes
Lessons Learned from Anime that Supports a Security Culture

• Engagement – maturity, real-world relation, manages stress, personally relate

• Resilience Building – learn to advocate for self, characters imitate real-world for them and made them stronger to face those situations, 

learned to offer understanding, learned “how” to explain things

• Attention to Detail – learned how to set priorities, looked at things differently, learned to not be afraid to ask questions for clarity, asking 

questions are important, learn to do what is needed to succeed

• Flexibility – do not have to conform to a one size fits all

• Open Mindedness – if something I like is a part of something we all have in common (school) I am more open to share ideas

• Positivity – easier to connect to what is being talked about by showing a clip of anime, would grab their attention and keep them 

watching, lessons are real in anime despite characters are not, a lot of anime show characters working together even if they don’t like 

each other to accomplish a common goal

The Value of Anime in Building Resilience in College Students During Transition, J.M. Reyes
Summary

Anime is a tool to use to grab the attention and focus of the younger professionals that make up most of the workforce today.

Security training, to be effective, must be relatable to the intended audience; since the audience will 

vary greatly, there must be a balance of tools used to present the training. 

Everyone digests information drastically different depending on the generation they grew up in. 

Learning styles should always be incorporated into all trainings, 

regardless of additional tools used such as anime, video games, etc.

Security doesn’t have to be boring; it can be fun. 

Incorporating fun does not automatically weed out 

significance and importance. 
Questions
#FISSEA2023

Dr. Tania Peitzker

Adjunct Professor of Metaverses and Interfaces

University of Silicon Valley

How to Build Safer Proto-Metaverses with Conversational AI & 

Extended Reality

FISSEA Ignite
How to build safer 

proto-metaverses 

with Conversational 

AI & Extended 

Reality

A brief overview of current and potential measures

Dr. phil. Tania Peitzker, Adjunct Prof. Uni Silicon Valley (Cogswell College)
Questions you might be asking yourself:

• What are proto-metaverses?

• Why could they be unsafe?

• Does this affect me now or in the near future?

They exist already like in this 

Interpol video

Created in Lyon, France, HQ of 

Interpol

Visit them with your avatar and 

talk with their avatars

Officers show you In Real Time 

what they do and how they 

combat crime online and offline

 metaverses

“The Metaverse”

XR - Extended 

Reality (VR/AR)

Conversational AI 

(artificial 

intelligence apps)

cognitive interfaces
Proto-metaverses? Immersive platforms you enter with or 

without VR headsets
Rise of cybercrime

“As the number of metaverse users grows, more possible crimes will emerge, Interpol said, citing "crimes against children, 

data theft, money laundering, financial fraud, counterfeiting, ransomware, phishing, and sexual assault and harassment".

Cybercrime, from ransomware to online child sexual exploitation and abuse, is expected to rise in the coming years, 

according to its latest Global Crime Trend report.”

https://www.euronews.com/n

ext/2022/10/20/interpol-setsup-its-own-metaverse-tolearn-how-to-police-thevirtual-world
What if you could talk with 

“recorded” Interpol officers? 

Using Conversational AI, 

they could interact with you 

in a “spontaneous” way...

The future of security within 

metaverses has already arrived...
Gaming examples inworld.ai 

THE WALT DISNEY COMPANY EXPLORES THE FUTURE OF IMMERSIVE 

EXPERIENCES AT 2022 DISNEY ACCELERATOR DEMO DAY (prnewswire.com)
Potential for live 

interactive

“policing” or 

“community 

officers” avatars to 

create safe 

metaverses

Conversational AI to the 

rescue!
Niantic – Meet You Out There & Campfire VR/MR UX

Magic Leap extension with Augmented Reality

Potential for 

XR to regulate 

the protometaverse 

building over 

the next 5-10 

years
South 

Korea

In New Technologies – let’s get 

the foundation right and make 

sure the infrastructure serves 

the ideals & visions of the 

“builders” of Web 4.0

We are 

immersing 

ourselves

Interoperability as per Davos 

WEF report & the metaverse 

standards alliance *

* https://initiatives.weforum.org/defining-andbuilding-the-metaverse/home
https://metaverse-standards.org/news/press-releases/leading-standards-organizations-and-companies-unite-to-drive-open-metaverse-interoperability/
If we can agree on metaverse safety standards, then we will succeed in creating a better web for all – the “evolution of the internet”

www.linktr.ee/taniapeitzker

Interoperability Safety (Cyber) Security –

stop hacking Identity – stop theft Governance – private + public sectors

International 

Standards

Child Protection

Protection of minors 

& vulnerable people 

of all ages

Anti-sexual 

harassment/assaults Law Enforcement Anti-money laundering

Anti-fraud and other 

financial crimes

Stopping phishing Data protection Privacy like the GDPR Right to be forgotten Privacy by Design Privacy by Default
BREAK

The Forum will resume at 2:45pm ET

#FISSEA2023 | nist.gov/fissea

Federal Information Security Educators (FISSEA) 

Winter Forum
#FISSEA2023

Welcome Back!

Brooke Crisp

IT Cybersecurity Specialist

Social Security Administration 
#FISSEA2023

Christopher M. Schmigel

Vice President

M&T Bank

How to Spruce Up Your Cybersecurity Awareness Program
How to Spruce Up 

your Cybersecurity 

Awareness Program

February 14, 2023
First: The Numbers*

...

 74

2022: 1,802 Data Breaches Reported in US 

Impacting 440 million individuals

* BankInfoSecurity, “Reported Data Breaches in US Reach Near-Record Highs”, 1/25/23
First: The Numbers*

...

 75

2022: 1,802 Data Breaches Reported in US 

Impacting 440 million individuals

2021: 1,862 breach notifications in US

60 breaches higher than 2022

* BankInfoSecurity, “Reported Data Breaches in US Reach Near-Record Highs”, 1/25/23
Now, The Targets...

 76

222 

69 

23 8 

Breaches - In Millions

Twitter Neopets AT&T Data Cash App Investing
Cybersecurity Awareness Training

 77

Isn’t it like doing laundry?
Training Journey...

 78

Good

Better

Best
Training Program: Maturity Progression

 79

Good

Better

Best
Good

Training

Simulated Phishing

 80
Good

Training:

 Once a Year

 Compliance Based

Lengthy, dry & non-interactive

 81
Good

Simulated Phishing:

 Periodic

Manual processes involved

Wordy Education pages

 82
Training Program: Maturity Progression

 83

Good

Better

Best
Training

Simulated Phishing

Cybersecurity Awareness Month

Better

 84
Training:

 Once a Year

 Compliance Based

 Rebranded

 Less text 

 Better presentation

Better

 85
Better

Simulated Phishing:

 Increased phishing cadence  Added targeted groups  Improved education pages  Better metrics & reporting  Remedial training on 3 hits  86

Recipient Response%

Susceptible 0 Times 87.6%

Susceptible 1 Time 10.4%

Susceptible 2 Times 1.6%

Susceptible 3 Times 0.3%

Susceptible 4 Times 0.1%

Susceptible 5+ Times 0.0%

Grand Total 100.0%

TLP: GREEN
Better

Cybersecurity Awareness Month:

 Weekly articles

 Hosted on our intranet site

Nice idea, but no one knew of them

Tips good, but too much and wordy

 87
Better

Cybersecurity Awareness Month:

 Dedicated intranet page

 Leveraged existing articles

Intent was good, 

but not our site’s traffic

Too busy, long and wordy

 88
Training Program: Maturity Progression

 89

Good

Better

Best
 90

Best

Training

Targeted Training

Simulated Phishing

Periodic Awareness

Cybersecurity Champions

Cybersecurity Awareness Month
 91

Best

Targeted Training:

 Board of Directors

Training:

 Compliance Based

 Enterprise wide
 92

Best

Targeted Training:

 Board of Directors

 Privileged Users

Training:

 Compliance Based

 Enterprise wide
 93

Best

Simulated Phishing:

 Include contingent workers

 Annual remedial training refresh

 Share with Risk Officers
 94

Best

Simulated Phishing:

 Include contingent workers

 Annual remedial training refresh

 Share with Risk Officers
 95

Best

Simulated Phishing:

 Include contingent workers

 Annual remedial training refresh

 Share with Risk Officers
 96

Best Phishing: Carrot or the Stick?
 97

Best

Simulated Phishing:

 Include contingent workers

 Annual remedial training refresh

 Share with Risk Officers

Recipient Response %

Susceptible 0 Times 87.6%

Susceptible 1 Time 10.4%

Susceptible 2 Times 1.6%

Susceptible 3 Times 0.3%

Susceptible 4 Times 0.1%

Susceptible 5+ Times 0.0%

Grand Total 100.0%

TLP: GREEN
 98

Best

Simulated Phishing:

 Include contingent workers

 Annual remedial training refresh

 Share with Risk Officers

 Enhanced training reporting

Recipient Response %

Susceptible 0 Times 87.6%

Susceptible 1 Time 10.4%

Susceptible 2 Times 1.6%

Susceptible 3 Times 0.3%

Susceptible 4 Times 0.1%

Susceptible 5+ Times 0.0%

Grand Total 100.0%

• Remedial phishing training to employees after 3rd click

• Enhanced WBT Reporting & Escalations for Past Due Employees

TLP: GREEN
 99

Best

Simulated Phishing:

 Include contingent workers

 Annual remedial training refresh

 Share with Risk Officers

 Enhanced training reporting

 Repeat clicker escalation

Recipient Response %

Susceptible 0 Times 87.6%

Susceptible 1 Time 10.4%

Susceptible 2 Times 1.6%

Susceptible 3 Times 0.3%

Susceptible 4 Times 0.1%

Susceptible 5+ Times 0.0%

Grand Total 100.0%

• Remedial phishing training to employees after 3rd click

• Enhanced WBT Reporting & Escalations for Past Due Employees

• Share Repeat Clickers with Risk Officers

• CISO email to employee’s supervisor

TLP: GREEN
 100

Best

Simulated Phishing:

 Include contingent workers

 Annual remedial training refresh

 Share with Risk Officers

 Enhanced training reporting

 Repeat clicker escalation

TLP: GREEN
 101

Best

Simulated Phishing:

 Include contingent workers

 Annual remedial training refresh

 Share with Risk Officers

 Enhanced training reporting

 Repeat clicker escalation

 Inform HR of offenders

Recipient Response %

Susceptible 0 Times 87.6%

Susceptible 1 Time 10.4%

Susceptible 2 Times 1.6%

Susceptible 3 Times 0.3%

Susceptible 4 Times 0.1%

Susceptible 5+ Times 0.0%

Grand Total 100.0%

• Remedial phishing training to employees after 3rd click

• Enhanced WBT Reporting & Escalations for Past Due Employees

• Share Repeat Clickers with Risk Officers

• CISO email to employee’s supervisor

• Employee Relations: Address with Employee & Manager

• Educate them of the risk

• Determine if additional training/coaching is required

• Add to the employee’s Annual Performance Objective

TLP: GREEN
 102

Best

Periodic Awareness:

 Increased the frequency

 Partnered with Marketing & 

Communications

 Expanded the channels

 Used alternate delivery formats
 103

Best

Periodic Awareness:

 Increased the frequency

 Partnered with Marketing & 

Communications

 Expanded the channels

 Used alternate delivery formats
 104

Best

Periodic Awareness:

 Partnered with Marketing & 

Communications

 Expanded the channels

 Used alternate delivery formats

 Increased the frequency

 Created Cybersecurity Champions 

program
 105

Best

Cybersecurity Awareness 

Month:

 Acquired licenses for animation 

software & graphics library

 Created short weekly 1 1⁄2 minute 

videos

Be Careful with Your Assumptions
 106

Best

Cybersecurity Awareness 

Month:

 Acquired licenses for animation 

software & graphics library

 Created short weekly 1 1⁄2 minute 

videos

 Launched contest to win swag
 107

Best

Cybersecurity Awareness 

Month:

 Acquired licenses for animation 

software & graphics library

 Created short weekly 1 1⁄2 minute 

videos

 Launched contest to win swag

 Hosted live panel discussion
 108

Best

Cybersecurity Awareness 

Month:

 Acquired licenses for animation 

software & graphics library

 Created short weekly 1 1⁄2 minute 

videos

 Launched contest to win swag

 Hosted live panel discussion
 109

Best
 110

Best

Customer

Awareness

Training:
 111

Best

Cybersecurity Awareness Training Summary:

Cybersecurity Training WBT: All Employees & Contingent Workers, Annual & upon Hire

Targeted Cybersecurity Training & Awareness: EVPs & Board of Directors, Managers, Privileged Users

Internal Communications: Periodic Security Awareness Articles

Panel Discussions

Periodic Video Training

Phishing Simulation Testing & Training Program: Monthly Enterprise Scenarios, bi-monthly Targeted Scenarios & Remedial Training

Cybersecurity Awareness Month: Weekly Internal & External Articles, Videos and Social Media Posts

Cybersecurity Champions Program: Collaboration with Employees of Technology, Product Teams & Cybersecurity

Cybersecurity Intranet & Internet Site Content: Security Tips, Best Practices , Articles and FAQs

Customer Awareness Training: Security Center Tips on mtb.com/security & wilmingtontrust.com/security

Periodic Customer Emails to Communicate High Risk Threats

Customer Training via Email, Webinars and Onsite Meetings
 112

Best

Lessons Learned:

 Think like a Hacker

 Sell like a Salesperson

 Market like a Marketer

- BUT -

 Always Think Like your Employees

 People Learn Differently – Switch it Up!

 Less is More

 Keep it Short and Relevant

 Make it Fun!
Questions / Comments?

 113

Chris Schmigel

Senior Cybersecurity Risk Analyst

Vice President

M&T Bank 

cschmigel@mtb.com
#FISSEA2023

Dr. Pranshu Bajpai

Principal Staff Security Architect

Motorola Solutions

A Mile in the Shoes: Considerations for Developer-centric 

Security Training and Awareness
A Mile in the Shoes

Considerations for Developer-centric Security Training and Awareness

NIST FISSEA Winter Forum 

February 14, 2023

Dr. Pranshu Bajpai

Security

Functionality
About

amirootyet.com in/pranshubajpai/ @amirootyet

PhD, Computer Science, Michigan State University

Principal Security Architect, Motorola Solutions Inc

Speaker: Defcon, Grrcon, Toorcon, APWG eCrime, 

IACP, CascadiaJS, Bsides, IEEE SecDev, Lascon etc.

Research: Malware, Threats, Forensics, Applied 

Crypto, DevOps, Cloud Security, Data Science
1

Automated 

Testing

2

Build

3

Deploy Test Env

4

Further Testing

5

Deploy Prod

Modern DevOps

Continuous and Seamless Software Delivery

CI/CD Pipeline
1

Pre-Commit 

Hooks

2

Pre-Build 3

Post-Build

4

Deploy 

Test Env

5

Deploy Prod

Enter DevSecOps

Shift Security Left

CI/CD Pipeline

Secrets Management SCA & SAST DAST IaC Security
Pragmatists 

Unmotivated 

but Highly 

Resourced

Champions

Highly motivated 

& Highly Resourced

Optimists 

Unmotivated & 

Not Resourced

Heroes 

Highly Motivated 

but Not Resourced

Ryan, I., Roedig, U., & Stol, K. J. (2021, June). Understanding developer security 

archetypes. In 2021 IEEE/ACM 2nd International Workshop on Engineering and 

Cybersecurity of Critical Systems (EnCyCriS) (pp. 37-40). IEEE.

Pragmatists are not particularly interested in 

security but will utilize the tools locally 

available

Champions have anatural interest in security 

that is supported by their organizations

Optimists are heavily dependent on 

the security toolchain

Heroes' interest and drive towards security 

helps secure development

Developer Security

Archetypes

Support from environment

Personal security interest
Psychological

Heuristics

Heuristics require less cognitive effort

Humans have ashort working memory

Humans will use the least amount of effort 

necessary and arrive at a sub-optimal solution

Security solutions should reach the developer as 

and when they are needed, not the other way 

around

Oliveira, D., Rosenthal, M., Morin, N., Yeh, K. C., Cappos, J., & Zhuang, Y. (2014, 

December). It's the psychology stupid: how heuristics explain software 

vulnerabilities and how priming can illuminate developer's blind spots. In 

Proceedings of the 30th Annual Computer Security Applications Conference (pp.
Developer Biases

Preconceptions

Ownership

Fixation Resort to Default

Optimism

Convenience

Subconscious 

Action

Blissful 

Ignorance

Superficial 

Selection Memory Bias

Chattopadhyay, S., Nelson, N., Au, A., Morales, N., Sanchez, C., Pandita, R., & 

Sarma, A. (2020, June). A tale from the trenches: cognitive biases and software 

development. In Proceedings of the ACM/IEEE 42nd International Conference on

Software Engineering (pp. 654-665).
Ease of access

Ephemeral elements 

Conceptual versus actionable 

Veracity of claims

Completeness Search Engines

Solutions Search

Patterns
Listen. Don't preach.

Understand developer perspectives and 

constraints

Suggest viable solutions within those constraints

Provide implementation details to enable 

devsecops

Create and support asecurity champions program

Partnership (Security DevOps)

Thou shalt 

sign thy code
Financial resources

Time allocations during sprint cycles

Internal documentations detailing security solutions 

Easy access to effective security toolchain

Periodic targeted security training and support

Developer Incentives
Documentation

Encourage and incentivize teams to 

document

Little documentation is better than

no documentation Do not seek

perfection while documenting
The Golden Order of

Impact

People

Buy-in from stakeholders

Process

Well-defined and easily adopted

Tools

Effective, efficient, and fast execution
Questions

NIST FISSEA Winter Forum: February 14, 2023

Dr. Pranshu Bajpai

Security

Functionality
#FISSEA2023

Brooke Crisp

IT Cybersecurity Specialist

Social Security Administration 

Closing Remarks
THANK YOU

https://www.surveymonkey.com/r/2023FISSEAWinterForum

We look forward to receiving your feedback via the post-event survey!

#FISSEA2023 | nist.gov/fissea
#FISSEA2023

Get Involved

Subscribe to the FISSEA Mailing List 

FISSEAUpdates@list.nist.gov

Volunteer for the Planning Committee

https://www.nist.gov/itl/applied-cybersecurity/fissea/meetfissea-planning-committee

Serve on the Contest or Award Committees for 2023 

Email fissea@list.nist.gov

Submit a presentation proposal for a future FISSEA Forum 

https://www.surveymonkey.com/r/fisseacallforpresentations
Federal Information Security Educators 

(FISSEA) Conference

May 16, 2023

#FISSEA2023 | nist.gov/fissea

SAVE THE DATE