Presentation by ESET experts David Harley and Sebastian Bortnik about the importance of security education.

2. Lemming Aid and Kool Aid: Helping the
Community to help itself through Education
David.Harley (@eset.com)
Sebastian.Bortnik(@eset.com)

3. ‘Education is the most
important weapon in the
security professional's armoury’
‘If education was ever
going to work, it would
have done so by now’

5. A brief history of security education

6. First seen
1991
‘to raise community awareness to confidentiality
and possible legal requirements in treatment
of sensitive University information’.

7. First seen
2000’s
‘The central goal of any security awareness
program is to influence people to change
their behavior and attitudes’
‘A strong IT security program can not be put
in place without significant attention given to
training users on agency IT security'.

8. Channels of information (and misinformation)

9. Several channel to raise awareness..
• Books
• Blogging
• Social media
• Discussion forums
• Academic and governmental initiatives
• Private initiatives (from organization to its employees)
• Inter-organizational community projects
• CERTs, CIRTs, WARPs
• Educational and informational coalitions

10. A few initiatives
• PCI Security Standard Council
• Best Practices for Implementing
a Security Awareness Program

11. A few initiatives
• Cyber Street https://www.cyberstreetwise.com/

12. A few initiatives
• Securing Our eCity http://www.securingourecity.org/

13. A few initiatives
• European Computer Driving Licence

14. A few initiatives
• European Computer Driving Licence

15. A few initiatives
• European Computer Driving Licence

16. Ethics, marketing, and information

17. Main problems
[ETHICS]
SALESMAN
[MARKETING]

18. Is there a right way for raise awareness from an Information
Security Company?
FUD (Fear, uncertainty and doubt)

19. Our limited role 

20. We can reach our customers… and a bunch of other people
• Access to educational material built into a software package
• Informational apps for mobile devices
• ‘Tips’ web sites and blogs
• Discussion forums
• Consumer-oriented informational newsletters
• Podcasts, videos and so on
• Sponsored books

21. We are not the solution, we are just part of it.

22. Conclusion

23.  … that awareness works, that users can learn how to protect themselves
from cyber threats.
 … that we can raise awareness from an Information Security company…
 … but we should be careful on how we do it.
 … that the problem is not how good we are but who are we reaching with
our initiatives.
 … that it is not possible to reach the masses without other society actors
like the government.
 … that we ‘must start ethical computer education at a much earlier age.
We strongly believe…

24.  … that it is too early to think that awareness does not work.
 … that we are raising awareness in quite a good way.
 … that we can do it better.
We strongly believe…

25. If you believe that, do not waste your time
discussing whether it works.


26. Thank You
David.Harley (@eset.com)
Sebastian.Bortnik(@eset.com)