It's become one of the great debates within information security: Do information security awareness programs actually work? The naysayers believe training workers to be more security conscious is tantamount to throwing away money because users neither are incentivized enough to care, nor advanced enough to recognize today's sophisticated attacks. Not to mention, it only takes one foolhardy employee to spawn a potential compromise (or none if they surf upon a drive-by-download website).
On the other hand, supporters argue that a majority of security incidents can be traced back to a single employee, thus making workers an organization's weakest link. Awareness training is a reliable way to stymie the insider threat and alter user behaviors. It's not a silver bullet, but it will help reduce organizational risk, which - after all - should always be the goal of security defenses.
No matter which side your allegiance lies with, the reality is that most regulations and requirements mandate that you implement a security education program. Thus, it's in your best interest to make the most of it. That starts with thinking of it less as a compliance checkbox exercise and more as a pathway to improved security and reduced risk.
But creating something that sticks is tough. In honor of National Cybersecurity Awareness Month in the United States, we prepared a list of recommendations to help you erect a program that employees will embrace and lead to improved security outcomes.
You should start by gaining support for your initiative and developing key objectives. That starts with the very top, of course, but it will really materialize when you assemble a steering committee consisting of champions from various departments. Be sure to include your company's marketing and communication professionals, who can help craft clear messaging.
There are scores of security topics you can cover in your program, but people can retain only so much knowledge. Instead, identify themes that matter most to your organization and will result in the greatest reduction of risk - keeping in mind that different departments face different risks. Companies like Trustwave can help customize training materials for specific needs.
Breaches and other security headlines are an everyday occurrence, so there are certainly enough concrete examples you can use to add legitimacy to your security awareness education efforts. Some companies even show live attacks happening on their networks to further hammer home the message.
Many of the topics you will be addressing will be things employees are also familiar with when they're off the clock, such as using passwords, mobile devices and social media sites. If they feel they can apply what they learn at the office to their personal life, they'll be less likely to tune the message out.
A generally perceived strike against awareness programs is that organizations struggle to quantify how successful they are. One way to overcome this is by staging simulated social engineering attacks (penetration tests) to assess whether the number of employees falling for them is dropping. If you go this route, communicate your plans prior - but far enough out that it's still a surprise - or risk an employee base that feels violated.
In general, workers want to do what is right for the company, yet often don't consider the problems that can result from their security transgressions. Demonstrate for employees how poor security practices can lead to harm to the company and clearly articulate the level of risk their actions carry.
Certain audiences, such as senior executives and help-desk staffers, may not feel they are in need of training, so it's important to customize your message for different groups.
Incentives help encourage behavior changes, and some companies have turned to using gamification to make security awareness education more compelling. For example, you may award points (and prizes) to employees who flag a phishing message, while developers may compete over who can locate the most security vulnerabilities. On the flip side, employees who regularly engage in unsafe computing behavior need to hear about it too.
Most experts agree than training courses won't have much effect if they are only conducted once a year. It's important not to overdo it, but reinforcement of key points is important and that can be accomplished through refresher sessions, as well as through mediums like blogs, posters and newsletters.
Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.