Security awareness tips: Making programmes more effective

As a research study by mail security company Clearswift found last November, few organisations tackle the awareness agenda with enthusiasm. Half of the employees polled said they had never received any awareness training, and two-thirds had never had training in their current role. That led the researchers to conclude that most workers were “IT freestyling:” working with little or no guidance about what was and was not permitted.

So what are the keys to making an awareness programme effective, and ensuring it produces a long-term impact on the behaviour of the people using systems?

The best way is to ask security pros who have been through the process. And what better way to find out than to ask members of security groups on the LinkedIn social networking site? We at SearchSecurity.co.UK recently did just that, and, within hours, professionals from around the world began to offer up their suggestions.

Here is a summary of some of their security awareness tips :

Targeting A corporate security policy can be long and complicated, and much of it will be irrelevant to individual workers, so security pros suggest tailoring training to each group of users.

“The message and the language must be crafted to the audience: Speak in the audience's language. Never use ‘security-speak’ except to other security folk,” wrote Brook Schoenfield, a senior security architect for US-based Cisco Systems.

Nick Baskett, managing director of Matta Group in London, echoed that view: “Teaching someone something they don't see as relevant to their job is a sure way to encourage amnesia. Security awareness to the [Personal Assistant] for the CFO has different elements than training someone in a call centre.”

Michael Krausz, an information security consultant based in Austria, made the point that training has to be engaging if it is to register with people. “The training should be inspiring and interesting. There's nothing worse for increasing awareness than a boring training session,” he wrote. “What usually works is to include practical elements that contain an element of surprise to keep a class interesting.” In one session, Krausz showed people the source code of a virus, for example, and in another, he showed a hardware keylogger and asked people to think about how much of their typing such a keylogger could hold in its 2GB of memory.

He also emphasised the need for face-to-face sessions in addition to any computer-based training (CBT). “Using CBT neither creates nor increases awareness. If people do not have in-person training sessions, they will simply learn the answers, but their awareness will not change,” Krausz said.

IMC Major Melissa Buck Wins Prize for Information Security Awareness

IMC major Melissa Buck, '13, recently won the bronze prize in the 2011 Computer Security Awareness Poster and Video Contest in the poster category. The host of the contest, EDUCAUSE, is a non-profit organization that focuses on the intelligent use of technology in higher education. EDUCAUSE stated: “Surveys of colleges and universities have shown that a significant percentage of security breaches are caused by the carelessness of a student or staff member.” Therefore, the organization is excited to use Melissa’s poster design to heavily promote its message concerning Internet security.

Melissa said: “I am passionate about graphic design and I take every opportunity I can to develop and showcase my skills. When I entered the competition, I was not expecting much to come out of it; I just thought of it as another chance to have fun doing what I love and get my work out there.”

Starting in early May, Melissa’s poster, as well as the other winning entries, can be found at http://www.educause.edu/SecurityVideoContest2011

EDUCAUSE is a nonprofit association whose mission is to advance higher education by promoting the intelligent use of information technology. EDUCAUSE helps those who lead, manage, and use information resources to shape strategic decisions at every level.

No tech hacking, a guide to social engineering, dumpster diving, and shoulder surfing

The ethical hack, a framework for business value penetration testing

Security education, awareness, and training, from theory to practice

AVL systems for bus transit, update

Information security management handbook