Succeeding With Security Awareness Programs
Security Awareness Programs should be geared toward changing end-user behavior in ways that should minimize security issues. CBT (Computer Based Training) is just one aspect of this, as it may only address one area of concern, such as Phishing. Some additional areas that you should consider are.
Distributed Materials
Having tools such as newsletters, blogs, and internal communications go a long way towards helping ramp up the awareness. Having media that is geared towards a targeted age demographic within your organization such as short blogs, and twitter updates for younger employees and traditional newsletters for older employees.
Campaign Posters
Create physical campaign posters that can be strategically placed around the facility, such as in the office, the break rooms, warehouses, and even the bathrooms. These would be pointed reminders to be security conscious such as: "Think before clicking on that link!
Some other examples of this would be programs created during World War II that involved posters with such slogans as "Shhh! The enemy is listening", and "Loose Lips Sink Ships!"
Computer Based Training
Generally involves short interactive training sessions that would emphasize such things as "How To Spot Phishing Scams", "Spotting and Cleaning-up Junk Mail", "Keeping your security service packs up to date", "Maintaining Your Anti-virus Software"…
Well Executed Events
Creating brief theme based company or departmentalized events that reinforce the desired behavior that you want to see. This could involve something as short, simple, and informal meeting in the company break room, or a something more involved such as a catered event in your conference room, or having a entire month dedicated as "Security Awareness Month"
Internal Security Portal
Provide a company database of knowledge base that contains informative data on such things as:
- Securing mobile devices.
- Creating strong passwords.
- Travel Security.
- Securing BYOD (Bring Your Own Devices) that are also used in the home.
- Securing Social Media Accounts.
Teaching Events
Create teaching events that coordinate with the other various activities mentioned above using either a lab or real time. This might involve such things as examples of Phishing, USB Drive based attacks, or social engineering examples, etc.
If you need assistance with any creating any of the above programs, please contact the
CCS Retail Systems Support Department.
– John