Human risk management vs security awareness: What’s the difference?

Human Risk Management (HRM): The newest buzzword in the cyber security world. Unlike other trends, this one is here to stay – and it’s a game changer for protecting businesses and improving security culture.

If you’re heavily involved in the cyber security world, you’ve probably already heard the rumblings about HRM replacing the term Security Awareness. If you’re not involved in the security world, maybe this is your first time hearing of it. But it won’t be your last. 

Either way, businesses must understand why Human Risk Management is becoming more valuable and more important than security awareness, how it applies to you in creating better outcomes, and how to implement it in your business.  

Why does knowing the difference matter? 

Although both terms address what can be a business’s biggest pitfall or protector, their employees, Human Risk Management is starting to replace Security Awareness as it offers a more valuable expected outcome.

Photo by Timon Studler on Unsplash

For just $325 USD, you can run a 6 week, automated program for gamified phishing awareness training and challenges.  (Limited time offer. Normally valued at $999 USD)

Use Promo Code: 6WEEKS

What is Security Awareness?

Security Awareness is only one part of Human Risk Management. Its goal is to give employees enough information to help them recognize that they are vulnerable, and to exercise more care in spotting and avoiding attacks. A security awareness program can include hanging up posters and screensavers to remind your employees about working securely. However, the question is: Is being aware enough?

The answer is no; Advancements in AI are making attackers’ technology too hard to spot. An employee who is aware of the potential attacks is still just as vulnerable to them. For example, not long ago an employee who was educated on phishing emails could easily spot one due to the grammar and spelling errors most attackers left behind. Now, AI has made phishing emails even harder to spot and even employees who are aware they exist can’t always identify which emails are malicious and which are not. 

Simply put, Security Awareness is a great start, but it’s no longer sufficient to protect your business. 

What is Human Risk Management? 

Moreover, what is human risk? Human risk refers to any adverse outcome caused by a person’s vulnerability or poor decisions, that can lead to a breach or attack, including phishing, social engineering, online tracking, insider attacks, and more. The term can also go beyond cyber security, to include risks related to harassment and discrimination.

Human Risk Management in the cyber security context identifies, assesses, and educates employees about these threats and how to fight against them, with a real goal of reducing vulnerability, and creating more productive outcomes. Rather than having your employees simply know they need to be more careful in trying to avoid threats, they can now actively become a protective wall for your business.

According to Phishing Box, there are five key steps to Human Risk Management: 

1. ASSESS: Identify the human risks in your organization. 
2. PLAN: Develop policies and procedures to address the identified human risks. 
3. INSTALL: Install other technical security controls to address these human risks.
4. REVIEW: Like any good program, review your progress and address any issues. 
5. CONTINUOUSLY IMPROVE: As new hires and technologies develop, you will need to continuously add improvements.

Most security professionals are changing their jargon to include Human Risk Management because of the identified end goal, which is to work with employees to fight against these risks rather than just check some boxes by making them aware. 

The main differences

In summary, Security Awareness is a small part of Human Risk Management, but can not be seen as being the only element. Security Awareness includes security awareness training, seminars, and posters to make employees conscious of the risks. Your program should still include those things, but to cover Human Risk Management, you also need:

• Interactive Training – Customized to each user’s possible risks. 
• Dark Web Monitoring – To see if data has been leaked (then trace from there)
• Policy Management – With a process and system set up to implement and notify of new policies
• Firewalls & Other Technologies – Any technologies needed to protect you from human errors
• Human Risk Monitoring – Regular check-ins to monitoring systems and processes 

All of these tools should be targeted at protecting your business from any human error. However, Human Risk Management recognizes that human error is impossible to eliminate and Security Awareness is not the one-fix-all. So, if your business currently focuses on Security Awareness, you’re not on the wrong track, you just need to do more. Continue to assess your human risks and include more in your program to achieve Human Risk Management.  

How to implement Human Risk Management in your organization

ASSESS

To implement Human Risk Management effectively, first recognize the scope of your employees’ risks and their traits and behaviours. Identifying the full potential scope requires a deep understanding of each employee’s position, access level, and potential impact on the organization’s data. Therefore, IT or security professionals must establish regular security audits and periodic threat assessments to identify all employee risks. This is crucial in identifying potential breaches and threats that may compromise data, assets or systems. 

PLAN & INSTALL

The key to beginning Human Risk Management is to do more than just security awareness training. This means taking the identified risks to each employee or each team that your company has and creating customized training on all possible threats. It also means setting up procedures for employees to follow when each threat approaches and occurs. 

Click Armor allows you to customize training based on the needs of each employee’s level, department, and access. Contact us to try our customized groups training. 

Consider also implementing policies, monitoring systems, firewalls, and other human error tools to assist your employees in protecting the business. 

REVIEW & IMPROVE

A crucial part of your Human Risk Management program will be the ability to review progress and quickly update policies or training to reflect any findings. The worst thing you can do is to set up training, policies, and technologies to protect your business, and then never assess if they work. 

During this review period, you will also want to assess any newly evolved technologies or threats from the external world. How can we help employees counter the threats from AI advancements? Was a competitor breached in a way you didn’t think possible? Has your business created new positions or teams? What are their threats?

As technology and the security world advance, professionals must understand the differences between Security Awareness and Human Risk Management to establish an effective security system. Extending your Security Awareness Program to become Human Risk Management, creates a robust security-conscious culture that fosters a secure environment within an organization.

Scott Wright is CEO of Click Armor, the gamified simulation platform that helps businesses avoid breaches by engaging employees to improve their proficiency in making decisions for cyber security risk and corporate compliance. He has over 20 years of cyber security coaching experience and was creator of the Honey Stick Project for Smartphones as a demonstration in measuring human vulnerabilities.