Security Talk: 7 Ways To Make Users Listen

Zeus reboot underscores the fundamental cause of many security breaches: Human error. Heres how to keep users listening when you talk security.

(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
Privacy might be all but
dead
. Thats no excuse for poor security.
Yet the gap between ambition and execution is often wide when it comes to keeping the corporate perimeter secure. The usual culprit: human error. As the recent reappearance of the
Zeus banking malware
reminds us, the next
expensive
breach is only an employee click away. Malware, phishing emails and similar schemes thrive because people make mistakes.
You know the importance of educating staff, enforcing policies and deploying strong security technologies to backstop your training and awareness efforts. You know people need
help to steer clear
of phishing emails and similar scams. Youre well aware that
social sites
are fertile ground for malicious links and social engineering attacks. The pain is that no one seems to listen to your well-intentioned preaching on security best practices. And when they do listen, they seem to forget 15 minutes later.
[ Whats your worst security nightmare? Read
Ransomware, Social Scams Lead 2013 SMB Security Fears
. ]
How do you get the word out
and
make sure your users are actually paying attention? For starters, give those emailed security bulletins a rest.
End users rarely read security emails -- and comprehension decreases with length, said Nate Ulery, head of the IT infrastructure and operations practice at
West Monroe Partners
, in an email interview. IT organizations should focus on alternate means of consistently getting the message out to their employees.
If not email, then how? Ulery offered this advice for getting your security messages across.
1. Use The Corporate Intranet Or Internal Social Network.
Quick, ad-like images on the company intranet, social site or other internal Web presences are a good place to start, Ulery said. Any pages that offer customizable messaging and images are worth considering -- providing employees actually visit them regularly. (If the intranet hasnt been updated since 2009, skip to tip number two.)
2. Screensavers: No More Baby And Cat Pictures.
Some users might grumble, but Ulery advises a required, custom corporate screensaver. Its desirable real estate for corporate communications and marketing, company goals and values, and a healthy dose of IT training and security messages.
3. Decorate The Water Cooler -- Or The Water Closet.
Use old-school signage as a means of regular, repetitive security reminders. Brief, graphical and comical signs on common-area doors work well, Ulery said. A little humor in a sign hanging above the bathroom sink will be more memorable and effective than a boring, technical email.
4. Get Out From Behind The Help Desk.
Sometimes, you need to get in front of people and, you know, actually talk to them. Its tougher to tune out security training when its face-to-face. Real security failures make for good subject matter here. Ask for five minutes in team and department meetings to share real-life incidents -- while also asking for feedback to encourage better communication between business and IT, Ulery said.
5. Attack Your Own Employees.
OK, dont
actually
attack anyone. But
simulating phishing scams
and similar threats is a great way to identify and bolster weaknesses in your security programs and policies.
Proactively engage employees in poor security behavior by sending out phishing -type emails that end up taking the employee to an immediate, two-minute training session if they click on the link, Ulery said. Generate reports on who actually clicks the link [and retrain those users].
Likewise, dont forget about the phone scams. Ulery recommends that IT pros periodically call employees and, under some non-IT persona, ask them to give out passwords and other sensitive information over the phone. Retrain staffers who fork over their credentials.
6. Test Your Call Center.
If you have a call center that handles customer data, regularly test the processes and interactions by having employees call into the center and test their response, Ulery advised. In fact, you need not run a full-blown call center to run a similar program. Periodically test any employees with access that handle customer information across channels -- phone, email, Web, and so on. You might consider similar training for other employees and departments that handles sensitive information, such as finance.
7. Reward Good Behavior.
Dont just play the role of ominous Big Brother; highlight positive security habits and offer a little incentive for good behavior. One example: Send Starbucks gift cards to employees who refuse to share their password as a reward for being diligent on security, Ulery said. The reward is ultimately up to you. If your company is already applying
gamification
elsewhere in the organization, consider its possibilities as a security awareness tool.
Finally, although redundancy is a good thing in security training, dont confuse it with boredom or desensitization. Through all of these efforts, insure that the message is regularly changed so employees do not end up having a blind spot for the message, Ulery said.
Got your own tips and tricks for keeping users safe and secure? Share them in our comments section below.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Security Talk: 7 Ways To Make Users Listen