How To

Security Awareness Programs: Now Hear This!

Awareness programs are the cheapest way to prevent costly problems, but the security message can be easy to ignore. CSOs and CISOs share their strategies for spreading the good word.

By Lew McCreary

In getting the word out about security priorities, Delaney relies on departmental luncheons, webcasts, podcasts and low-cost campuswide publicity (pitching security-related stories to The Exponent, Purdue's daily student newspaper, and Inside Purdue, a publication for faculty and staff). In October she held a staffwide Security Awareness Month, featuring daylong presentations on the most urgent data security issues: encryption, data security on the road and working from home, information classification and the operational requirements of the new state regulations.

One challenge is communicating with her various audiences in terms that will resonate with each. "You have different levels of expertise you have to talk to," she says. And not only expertise but frames of reference. "I mean, not as many staff people are going to be on Facebook.com [a social networking site popular with collegians] as students. So you've got different issues, depending on the demographics of the people you're trying to reach," she says.

Faculty members represent perhaps the toughest nut to crack. They enjoy plenty of authority and autonomy. For that reason they are a little like lawyers or physicians—two famously tough groups to domesticate to habits of right behavior that may seem in conflict with their sense of mission. That reality makes it clear why Delaney might want to get her game face on by tuning up with the friendly staff.?

Lew McCreary, CSO's former editor in chief, is a member of the Content Expert Faculty of the CSO Executive Council.

Other stories by Lew McCreary

• Email
• Print
• Comments
• Digg This
• SlashDot

• Ideas from Security Awareness Survey Respondents
• Show Time for Security
• Industry View| Ira Winkler on Awareness Training