Using intervention mapping to breach the cyber-defense deficit

It sometimes seems that every IT user is a com- batant, engaged in a battle with multitudes of hackers across the globe. This battle is unevenly biased in favor of the hackers, because people routinely act in ways that open doors for hackers, thereby enabling their nefarious activities. If current approaches to raising security awareness were working the hackers would not be having as much success in attacking systems. It is time to reconsider how we design, formulate and deliver security awareness training. In this paper we propose using a technique borrowed from the health arena, "Intervention Mapping," to target security awareness training more effectively. We detail the different phases of the methodology and give an example to show how it was applied to an SME. The purpose of this paper is to open a discourse in the community about how we can arrive at more effective awareness-raising endeavors.