2014_01

Assurance Workforce Improvement Program, Chapter 6,which includes the following:ÊÊThe trained and aware user is the first and most vitalline of defense.ÊÊIT users need to maintain a degree of understandingabout IA policies and doctrine commensurate with theirresponsibilities. They must be capable of appropriatelyreporting and responding to suspicious activities, andknow how to protect the information and IT systems towhich they have access.ÊÊIA training must be current, engaging, and relevant tothe target audience to enhance its effectiveness. Its primarypurpose is to educate and influence behavior. Thefocus must be on education and awareness of threatsand vulnerabilities so users do not perform actions thatlead to or enable exploitations of the DOD ISs [informationsystems]. Authorized users must understand thatthey are a critical link in their organization’s overall IAsuccess. 4If the annual IA training is not meeting expectations, thenhow can the Army develop “trained and aware users?” Thebest approach is establishing andmaintaining an enterprise-wideawareness program, supported bysenior leaders, that builds upon andcomplements defensive cyberspaceoperations and network operationsperformed by the cyber workforce.However, developing an effectiveuser awareness program can presentits own challenges, as evidencedby lessons learned through otherprior and ongoing efforts across thewhole of Government and withinindustry. Several analyses regardingnetwork user awareness have been conducted over thepast three to four years, and common conclusions highlightfive main traits that are essential for success, each of whichis discussed in more detail in the following sections. 5 Thefive traits are:ÊÊPersistence. Provides awareness and training throughoutthe year, not just once annually.ÊÊTimeliness. Uses the “teachable moment” and immediatefeedback to maximize training, ensures informationis updated frequently and quickly distributed to end usersafter discovery.ÊÊRelevance. Provides applicable information in a contextthat resonates with network users.ÊÊPresentation. Uses both active and passive approaches,as well as various methods, modes and media, to deliverinformation and remain engaging. 6,7ÊÊEffectiveness. Includes integrated assessment methodologiesand analysis to determine whether awarenessactivities are meeting program goals and to then adjustas needed.PersistenceThe current guidance provided in DOD 8570.01-M onlyaddresses a single “annual” training evolution, the DefenseInformation Systems Agency (DISA) produced annual IAtraining. This training alone does not provide enough exposureto relevant and timely information throughout theyear that would help to build and maintain an end user’s cyberawareness. Although a ramp-up in awareness of cyberthreats may occur throughout the year (e.g., supplementaltraining before a deployment, training rotation, Tier 1 exercise),the overall mean level of cyber threat awareness isgenerally lower than desired. This effect is graphically displayedin Figure 1 as the lower sine wave and the associated“mean” average of performance.Figure 1. Overall Performance Expectancy based on Persistent Cyber Threat AwarenessIn some cases, organization-wide awareness informationis provided and training conducted as a reaction to a networkincident, such as a data breach or network policy violation.While this approach is sometimes necessary, it isreactive in nature. Instead, a proactive approach to userawareness is more effective.To raise overall performance and ensure proactive awareness,end users must be provided additional cyber threatawareness in a fashion that is unobtrusive yet impactful.Only through routine, persistent awareness activities, enabledby technology, can individuals’ mean levels of “performance”start to shift upward and a culture of cybersecuritystart to take hold (as depicted in Figure 1 by the upper sinewave and “adjusted mean” level of performance).34 Military Intelligence