The failure of security awareness programs

In many cases, security awareness programs fail because they are not tied to the overall company-wide security policies. In some cases, security policies and therefore security awareness training is not given the proper attention and buy-in required by key stakeholders within the company.

According to www.windowssecurity.com, “The Security Awareness Program can be defined as one of THE key factors for the successful implementation of a company-wide security policy.”  Clearly, the goals for any awareness program are twofold:  to educate the employees on their role in the security process and how their efforts are essential in securing corporate assets as well as clearly articulating the main parts of the policy. For this to be effective, the policy needs to be easy to understand and concise.

Security awareness programs should cover both an understanding of the inherent security risks and the importance of security to the company’s daily business procedures. An effective awareness program also needs to include updated security issues and best practices in an easy to understand yet detailed enough manner for the employee to digest and incorporate into their daily routines. Security awareness training is about changing behavior, so your awareness program needs to be designed for repeatability.  Fresh content, best practice updates and new and innovative ways of getting the awareness to employees needs to be considered in the planning process.

As a side note, for those looking for a guide or needing to re-write security policies within your organization, Windows Security has a great document outlining what how to build and implement a successful security policy http://www.windowsecurity.com/pages/security-policy.pdf