------------------------------------

Your Company Expects Personnel to Use Messaging Within Documented Boundaries

Many personnel are simply not aware of information security policies in general, let alone the messaging policies in particular. You must provide effective, periodic training to all personnel about electronic messaging security and privacy along with ongoing awareness communications to have personnel effectively safeguard PII.

You cannot expect that personnel will follow electronic messaging security and privacy policies if you have not provided effective training and ongoing awareness communications about this topic!

Periodically engage your personnel in critical thinking messaging security and privacy awareness exercises to help them keep the issue of messaging security and PII protection at the forefronts of their minds. One effective way to engage personnel is to ask them open-ended questions on your intranet site and provide some type of motivation, such as a "jeans-day" sticker to use whenever they choose, lunch with the CEO, 2 hours of vacation, and so on, to submit answers to your questions. For example, consider these open-ended questions you could ask:

• You receive an email message from a customer asking you to send them an email reply that contains the name, mailing address, and phone number the company has within our databases for them. How would you reply to this customer?
• You receive an IM from an ID that appears to be one of your co-workers, asking you to send a file that contains employee Social Security numbers through the IM session as an attachment so that she can use the file to test the application program code she is working on. What will you do?
• You manager asks you to forward all your business email to your personal email address so that you can continue to respond to email messages while you work from home for a couple of days. What will you do?

Be sure to speak with Human Resources and any other areas involved with your motivational "prize" when you are planning for this training approach.

If your privacy practitioners are located in a different department from your information security practitioners, be sure to have both areas work together to get these training sessions and awareness communications and activities launched. Both areas must work together to help ensure messaging security and prevent privacy breaches.

I cover how information security and privacy practitioners can effectively collaborate on overlapping topics, including many case studies that you can use within your own organization for training, in my 2-day class "Information Security and Privacy Convergence and Collaboration"; for more information, see http://www.privacyguidance.com/files/Information_Security_and_Privacy_Convergence_and_Collaboration.pdf.

Got other ideas for these types of engaging questions? Please share!