Control concepts — Who's buying?

Abstract

IT Security Awareness is generally accepted by Security Managers as an essential component of security management. However, programmes and campaigns which are being currently conducted are not achieving the impact of other behavioural change programmes in the commercial world. Campaigns to improve safety, quality and ecological performance have been of higher profile and generally more successful than IT Security Awareness. The security manager needs to employ the methods used in Marketing and Advertising in order to achieve behavioural change. The Security Awareness strategic plan needs to consider persuasion as well as information. As well as getting authority from the most senior management, it needs to get the visible support of opinion leaders within the organization. The themes and messages need to be carefully thought out and targeted at population groups for best effect. Consideration must be given to conditioning attitudes of the population towards the need for Information Security, specifying the responses needed from the population and using ‘point of delivery’ messages as a final reminder or warning. The promotional campaign should use all the techniques used in marketing and advertising to help project the messages into the consciousness of the population. There should be some feedback analysis to test the success of the campaigns and to help refine the delivery process. The delivery should be refreshed by changing components which have become ‘stale’ and by including new messages where appropriate. IT Security Awareness is too important a subject to be treated half-heartedly. The cause is important for business success. It needs to be promoted professionally.