Published on December 14, 2009 by Karen Letain in Planning, Reinforcement Tools

Learning to tie your shoes

I purchased a new pair of runners for my 7 year old and these had laces. I had taught him to tie his shoes in Kindergarten but with most of the shoes and boots having velcro, I did not realize that the lesson taught in Kindergarten did not stick. I was both shocked and dismayed to realize that my Grade 2 child did not know how to tie his shoes! As a parent I also had that wonderful "guilt" feeling that goes along with realizing that I probably didn't do a very good job initially as I was in a rush (as always) and should have probably spent more time having him practice so that he retained the knowledge. I also should have bought him more shoes with laces!

So...how does this relate to security awareness? Like any type of training or learning, if a person does not practice what has been learned it does not get retained. Security awareness is even more difficult since we are ultimately trying to change behavior.  Individuals are already set in their ways of performing various job tasks throughout the day. Security awareness is about changing the way in which those tasks are performed. Teaching a security awareness class once a year and providing no other reinforcement or communication on the subject will not sufficiently change behavior of your end users.

Not putting aside enough time as an educator to ensure that your security awareness program is planned and supported properly will lead to additional stress, guilt and ultimately to the failure of the awareness program.

So...what do we do?  We must ensure that awareness is done in small bite sized amounts that are easily digestible and then follow up with reinforcement tools or methods - ie., posters, newsletters, video clips, spot checks or walkabout reminders that catch people doing what was taught correctly or not correctly. Providing continuous training throughout the year will aid in retention. Providing rewards and or encouragement for the training being accomplished and for a change in behavior will provide you with a better and more widely accepted security awareness program.

0 Comment

Published on May 25, 2009 by Lise Lapointe in Marketing and Communications, Planning, Reinforcement Tools

Rolling Out a Successful Information Security Awareness Training Program

You’ve identified the need for an ISATP, but now you’re trying to put together an effective plan that will ensure measured success and results for your organization. The success of your ISATP is in the planning of all stages of the training project. Training is a cyclical and ongoing process and should be treated as a project that has many phases and is continuous. Most organization’s engage in ISATP because they need to meet certain guidelines or compliancy standards. What many fail to realize is that in order to change employee behaviour within an organization you need to train continuously.

It is then essential to treat an ISATP program like any other information technology project. Behavioural change is not easy and requires continuous reinforcement. You need to create a project, assign a project manager, and recognize a project champion. Creating a project includes defining business objectives and scope (what’s included and what’s not) in a document. The document needs to be clearly defined and must appoint those who will be held accountable. The document will then act as a guide from planning to implementation to the effectiveness of ISATP outcomes.

Read More

1 Comment