How To

Seven Practical Ideas for Security Awareness

Audry Agle suggests steps for creating the culture necessary to protect your organization

By Audry Agle

Page 2

5. Bring it to their computer screen: If you have a company newsletter, be certain to include a security article in each edition and provide information on the latest incidents that have occurred, particularly in your industry. Supplement your newsletter with a monthly email to all staff with a short message about a timely and relevant topic—PDA safety, emergency preparedness, or a reminder of who to call for suspicious incidents. Provide a Security page on your employee intranet that lists the security policies, important contact information, links, etc.

6. Require training: Training programs will be more effective if you include interactive exercises, contests, games, or give-aways. Try to keep it short, and test comprehension.

7. Walk the walk: Perhaps the most impactful technique is for senior leadership members to display their own penchant for security. If it looks to be important at the top, you can bet it'll be important at the bottom. Advertise internally when someone does something that thwarts a potential attack, or comes up with a control that bolsters the security of your organization in a cost-effective manner. Use incident exercises at all levels, including executive leadership.

Remember that your employees can make or break your security program—keep them engaged in the process by soliciting feedback and suggestions. Provide a phone message line and emailbox—anonymous if necessary. Make it easy to use, non-threatening, and welcome stupid questions.

A security-aware culture is possible in any organization as long as it is the standard by which everyone operates, and concepts are consistently reinforced. ##

Audry Agle, CISSP, CBCP, MBA, is an independent consultant in the San Diego area assisting businesses in the development and maintenance of risk management programs.