An incident is a “risky behaviour” such as clicking on links in phishing emails and/or entering your login credentials into a fake landing page. They make up 31% to 38% of the risk score.

An exposure refers to your MRU login credentials being found in a list of confirmed compromised login credentials by haveibeenpwned.com. If you have been using your MRU email address as a username for non-MRU accounts for awhile, your email will likely have exposures. If you haven’t been using it very much, you may not have any. Exposures make up 4% to 10% of the risk score.

Awareness training

Taking a course lowers your risk score. How much depends on how soon you completed the course after it was assigned and the score you received. 

Everyone will be assigned required training annually. Those new to MRU will have to complete a more thorough training course. In subsequent years, the required training commitment will not exceed 30 minutes. Those who handle payment card data and/or are high value targets are at a higher risk and will be assigned additional training aligned with their role.

Once you have completed your required training, you can enroll in additional courses. To view what is available, click on the Education tab in your dashboard and click the Add More button in the courses section. Cybersecurity awareness training makes up 21% to 28% of the risk score.

Rewards

Each reward you earn lowers your risk score. Rewards are issued for completing training courses, completing surveys, reporting phishing training emails and participating in cybersecurity themed events. 

Although your risk score demonstrates your preparedness to deal with a cyber attack in a transparent, real-time fashion, it is not static. The effects of training, exposures, incidents and rewards degrade over time, ceasing to have any effect at all after a year. To ensure you are always prepared to deal with a cyber attack, check your risk score regularly to ensure it hasn’t gone over the 650 level. 

In the CIRA Security Awareness Training platform, departments are called Divisions. The Division scores are calculated differently than individual risk scores to give leaders a better understanding of how to support their teams. They are marked out of 60. The closer to 60 a team is, the less of a risk they pose to the University. Division risk scores consist of metrics from three domains; knowledge, attitudes and behaviours. 

Knowledge

This domain evaluates how a team performs in, and engages with, the cybersecurity awareness platform. It is scored out of 10. Those who self enroll in courses, have high course scores and complete all their courses score high in this domain. 

Attitudes

This domain evaluates the attitudes and perceptions about cybersecurity seen in a team. It uses responses from the Cybersecurity Survey to generate a score out of 15. Those who are personally motivated, have threat awareness and aren’t overly trusting of technology score high in this domain. 

Behaviours

This domain evaluates how the behaviours of a team impacts the University’s cyber risk. It is scored out of 35.Those with low click rates, high report rates and who complete their courses on time score high in this domain.