How to talk security so people will listen (and comply!)
Companies that are most successful in their security message have moved beyond an IT-centric approach to a holistic model. Computerworld caught up with three organizations doing just that -- Intel, Royal Philips Electronics and Endurance Services -- to find out how they managed to make information security a corporatewide responsibility.
Read on for five best practices for getting the security message to sink in with employees.
Put threats into context
People don't internalize security best practices by simply being told what to do or scared into compliance, Peeler says, and Harkins agrees. "You don't want to spin information security compliance as fear," he says. "Fear is like junk food -- it can sustain you for a bit, but in the long run it's not healthy."
Instead, both experts say, employees are more likely to be motivated into compliance if security managers can put risk into a context that relates to them directly.
Most employees know that a security breach affects not just data, but the entire company's brand and reputation -- but some business units might not fully understand their potential role in a security breach, says Harkins.
A marketing team, for instance, might want to launch a new interactive website ahead if its competitors, he explains. The website's content seems harmless enough since it doesn't include intellectual property, only a few interactive screens and videos.
But what if vulnerabilities left by a third-party provider that helped develop the site allow a hacker to implant malware in one of the links found on the site? Explaining the risk ahead of time, and in a way that's specific to the department's line of business, helps ensure the group will do what's necessary to mitigate damage, Harkins says.
Real-world examples can also drive the message home when put into context. When a data breach makes the news, use it as a teaching tool -- in training classes, via email or through video presentations.
Discuss the likelihood of a similar breach occurring in your organization. Ask: How would a breach like this have affected our company or a specific business unit? What people or business units should remain extra vigilant against a similar attack? What security measures do you already have in place to protect against such an attack?
Go phishing, internally
Another effective communication technique some companies have adopted is to launch their own simulated phishing scams, see how many employees take the bait, and then use the opportunity to offer advice on avoiding the scam the next time -- when it might be real.
Royal Philips Electronics recently launched a pilot program of controlled phishing attacks, says Nick Mankovich, chief information security officer.
Working with a professional phishing partner, whom Mankovich declined to name, Philips simulates an email scam that tries to get employees to click a link to a website and enter their password and user name. When the unsuspecting employee clicks on the link, a message pops up explaining their error and offers tips to avoid being scammed the next time.
"It's not about embarrassing or surveilling anyone. It's really about giving material that means something at the moment when they click on the [erroneous] link," Mankovich says.
Depending on the exact nature of the attack, tips might include questions like: Did the email come from a trusted source? Was there something misspelled or unusual about the link? Did you remember to hover the mouse over the link and check the bottom of the screen to see if the two matched?
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts