I attended an event recently on promoting cyber security awareness through large organisations and this post aims to summarise some of the great ideas that came through.
THINK ABOUT YOUR AUDIENCE
With awareness training a one-size fits all approach might not be the best one. Think about your audience, and how they might relate to your content. Think about tailoring specific content for their needs. There was discussion around the psychology of influencing people – what do they want? what do they fear? what do they believe to be true? what is in it for them? Would they appreciate the chance to win prizes by notifying ICT of rogue emails for example?
TELL STORIES
People might relate to stories better than instruction. These can be told through the training, or alternatively use informal channels such as Yammer to get people to declare their own experiences. The beauty about this topic – it applies to people in their professional and personal lives. I frequently talk about my experience of clicking on an attachment and the next thing I know I’m buying trainers on eBay to be shipped off to Lagos.
Another interesting approach is to tell stories on behalf of other people by ghost writing articles on behalf of your senior management. Obviously you’d like to get them to approve them first – but this top table endorsement of your message would go a long way.
OTHER CONSIDERATIONS
Make sure the language resonates. Use humour and cultural norms. Can you develop striking graphics or use characters that keep within your organisations identity but can still get people talking. Think about passive and dynamic communications – if they won’t come to your online publications go to them.
STRUCTURAL CHANGES
Can you change people’s job descriptions to hard bake keeping data safe into them? Can you take sanctions against individuals who fail to comply with your policy and use the news of these sanctions to instill a change in behaviour? Can you get teams and departments to compete over who reports the most dubious emails? How can you maintain this discipline in the continuous thinking of every member of staff?
DATA AS A DRIVER
Try and develop metrics around awareness. How many people have completed the training, how is their department doing versus the rest of the organisation? How many phishing emails have been reported? How many stories have people volunteered? How many people have seen and interacted with your campaign. Having a data-driven approach to cyber security awareness will pay dividends.
If you’d like to know more about how to promote good information security awareness training within your organisation please get in touch on 0796 770 5102.