1. Are you really serious about improving Information Security? Patrick McGuire, CISSP Information Security Officer State Board of Equalization Patrick.McGuire@boe.ca.gov 916.322.3819

2. Are you really serious about improving Information Security? Unless you’re spending much of your time on people, you’re not really serious. AttentionISOs: Attention ISOs:

3. Is Defense in Depth an accepted best practice? Yes, but it’s much more than that, it’s the only sane strategy. Defense in Depth is: -- Policies, procedures, and standards -- People and processes -- Architecture and design -- Machines (computers, firewalls, etc.) Information Security Basics

4. Defense in Depth is the foundation from which to build a quality Information Security program. The human-computer interface is the most essential layer in your Defense in Depth. We spend too little time and money on the human side of the interface. Defense in Depth

5. People … … build and test the application … configure the host … design and build the network … monitor the system … respond to stimuli … recover from incidents … improve the process People in Depth

6. Improve people and you improve Information Security. How? By changing hearts, minds, and habits. How do we change people’s habits? People are Information Security

7. “For our purposes, we will define a habit as the intersection of knowledge, skill, and desire. Knowledge is the theoretical paradigm, the what to do and the why. Skill is the how to do. And desire is the motivation, the want to do. In order to make something a habit in our lives, we have to have all three.” - Stephen R. Covey "The Seven Habits of Highly Effective People" Security Can Be Habit Forming

8. Habit Knowledge SkillsDesire (what to, why to) (how to)(want to) Security Can Be Habit Forming

9. Information Security Knowledge Deep down, people want to do the right thing but they need knowledge. Make people aware of what to do and why it’s important.

10. Information Security Skills Deep down, people want to do the right thing but they need the skills. Some people need specialized skills to do the right things, skills that can only be acquired in training.

11. Information Security Desire Deep down, people want to do the right thing but they need motivation. What motivates people? -- Reward and punishment -- Fulfillment -- Achieving mission -- Recognition

12. Pick a Theory Maslow’s Hierarchy of Needs Skinner’s Behaviorism Alderfer’s Tripartite Theory Herzberg’s Approach McLelland’s 3 Needs

13. People are Information Security If you’re providing Information Security awareness training only because SAM requires it, you’re missing a great opportunity. If you’re just going through the motions to satisfy the regulations, then you’re not really serious about Information Security.

14. END