Deloitte Survey Shows the Need for Effective Training
Deloitte Touche Tohmatsu just released their "2007 Global Security Survey" report.
Much of the report emphasizes that the greatest cause of external breaches continues to be the "human factor": "an organization's employees, customers, third parties and business partners."
The need for effective awareness and training of personnel is greater than ever. Customers must also receive training, as financial industry oversight agencies have recently decreed.
Information security and privacy education efforts need to partnered to ensure the most effective personnel education. If the privacy areas and information security areas do not work together, not only will the resources and costs involved be greater to the organization, but the messages may be conflicting, or there could be significant gaps in the information provided.
On Thursday, September 27th I will give a webinar discussing this topic and the related issues in detail, "Security and Privacy: Cooperative Awareness for Better Compliance and Personnel Understanding"
I will discuss why information security and privacy education efforts need to partner and the cooperative steps you can take to ensure optimum results for both missions. I will also include a sample-training module incorporating privacy with security as part of the webinar.
Attendees will Learn:
* Regulatory requirements for information security and privacy awareness and training
* Why privacy and information security education is necessary for business success
* Topics applicable to both information security and privacy
* Target groups to receive training and awareness
* Strategies for training and awareness
* Sample content for an online module
These issues apply to all organization within all industries world-wide.
Whether you've been asked to add on an information security or privacy module, or are competing for funds with new initiatives, I created this session to help you.

Email This!
Digg it!
Del.icio.us
Reddit!
Newsvine
Comments
We can't just depend on technology to do all the work -- people are key in security. Having said that, IT staff can't be the only ones knowledgeable in the subject; the entire organization (and any contractors/partners) need to be on the same page as far as security practices go.
A little off topic, recently my work required every employee to complete the Agile Software Development Project Management course, and even though Agile probably can't be readily applied to, say Marketing projects, the way it can in development, we are now all on the same page as far as how projects are outlined and completed in development.
Doing a similar type of cross-training in security practices could greatly relieve the "insider threat."
Posted by: mila | September 20, 2007 1:53 PM
Mila, thank you for your thoughts. You make a great analogy with the Agile Software Development Project Management example. Yes, tying information security and privacy into other existing business practices, courses and models would be a very big step forward in addressing the insider threat and raising awareness of info sec and privacy.
Posted by: Rebecca | September 21, 2007 6:18 PM