How Do You Get Out the Security Message in Belt-Tightening Times?

The Toronto Sun and the BBC both ran stories last week about a new e-mail virus that feeds on public interest in the war against Iraq. It arrives as an e-mail message promising satellite images of Iraq or a funny screensaver about George W. Bush. It delivers neither upon opening, but attempts to disable antivirus and other security software in the infected machine, and then e-mail itself to the users entire address book. Despite security industry warnings, this particular virus isnt especially clever or insidious. It exploits a known flaw in MS Windows, for which a patch has already been issued, and represents a low risk.

But it reflects how current events constantly offer new angles for piercing your security armor, both virtual and physical. To guard against that, the first advice to CSOs and other security professionals is always educate people. In fact, a recent Computing Technology Industry Association survey found that in more than 63 percent of security breaches identified by its respondents, human error was the major cause. The study, Committing to Security: A CompTIA Analysis of IT Security and the Workforce, concludes that more training of IT workers could help protect the country against cyber threats.

Training may be the answer, but who has money for it these days? The same survey found that most people spend less than half of one percent of their IT budget on security training. So you try to get the message out, the same old (inexpensive) way. Companywide e-mail alerts, posters by the coffee machine, announcements at staff meetings. But for anyone who didnt absorb Dont open unsolicited attachments&. Dont open the door for anyone without a badge&. or Dont pack a boxcutter in your carry-on& the first time, is the thousandth time any more effective?

Human beings are stubbornly inattentive. How do you get them to listen, and not only that but to take it to heart? Maybe it requires a glitzy song and dance, maybe a big carrot, or a bigger stick. How do you get out the security message in belt-tightening times?