Pretty much everyone agrees that information security awareness and training are important, but the more interesting question is how to do it. Some organizations seem to think it's worth putting employees through a compulsory training course once a year or less. I think they're nuts. Some say "awareness doesn't work because employees still do dumb things". I wonder if there is a correlation between the people with both points of view?

Thanks for your thoughts, Gary!

Unfortunately, as I just blogged about today (8/12), I have seen a small percentage of folks that do not have this opinion, much to the potential damage of information security efforts.

I do like the "how to do it" question. This is something I've been studying and doing work in for a very long time. Yes, education done poorly is very likely a significant reason there are still too many security incidents and privacy breaches.

I'd love to see research and an experiment demonstrating the correlation! However, who wants to purposefully do education poorly? Perhaps the small percentage of folks I blogged about today? :)

Hi Rebecca.

I don't think people *deliberately* run useless awareness programs. Rather, they don't know any better and have a lack of experience, creativity and capability in this area. Part of the problem is that information security is usually the responsibility of IT Security people, who are usually IT people, and hence are often nerds. Nerds are great at communicating with fellow nerds but hopeless at putting anything across to ordinary mortals or indeed understanding them (I know, I'm exaggerating to make a point; if it helps, I consider myself a reformed former nerd!).

I'm quite confident there is a preponderance of certain personality types in IT. Nerdyism is more than just a joke. I'd be willing to bet that there's an uneven distribution of Myers-Briggs Personality Types in IT compared to the rest of the organization. With your background in psychology, Rebecca, would you agree? If so, could this be why typical security awareness programs are so badly designed and ineffective, and hence give the whole concept a bad name?

All the best,
Gary

I agree that "nerdyism" as Gary put it is overly common in IT. Maybe this is because as kids, teenagers, and young adults, people who are good with computers are usually loners. I don't mean loners in a bad way, but they are happy by themselves, working away at a computer. I always was. These loners don't usually learn confidence in dealing with other people. Luckily I've learned how to relate to people, or at least talk loud enough for them to hear me ;) I've ran into many nerds who haven't though, and I feel bad for their struggle.

I feel myself about to make the same point as Gary, that the bridge between the majority of IT people and the rest of company personnel is often to hard to cross. And perhaps this is where security awareness gets lost in the crossing.

My 2 cents,
Kara

p.s. Hello Rebecca, from a fellow Missourian.

Gary and Kara, you make some great points.

I think you both highlight the common practice of giving awareness and training responsibilities to folks with no background or training in how to effectiviely *DO* awareness and training. It would be like assigning the high school custodian to also teach the math classes along with his/her other duties, or assigning the cafeteria cooks to also teach history classes.

Organizations need to ensure that the people given education responsibilities know how to educate. Then this gap can be more successfully bridged. Unfortunately this is rarely the case, which results in poor quality and ineffective training and awareness activities.

Kara, nice to virtually meet a fellow Show-Me-Stater! :)