Chapter 4 - Developing an Effective Security Awareness Program

Abstract

This chapter discusses how to design and implement effective information security awareness program. Security should have an employee dedicated to creating and implementing a program. The program should be treated as a marketing campaign and each employee should be “touched” repeatedly by marketing messages about being secure. A business plan should be created for the program and the institutional buy-in should be there to ensure its success. Communication with employees is the most important factor when implementing a security awareness program. The creative aspects of the company should be utilized to create videos, web sites, and other forms of presentations to engage the audience. Each individual can significantly reduce the exposure of sensitive information by following simple behaviors and raising their hand with conviction when they see a potential or real risk. No one has all the answers, but collectively the risk can be addressed and reduced. Today's information risk pandemic should be treated like any other event that requires a disaster recovery plan.