The importance of having an Information Security Awareness Programme

Most businesses are starting to recognise the importance of information security, both from the perspective of regulatory or legal responsibilities, and from a viewpoint of good business practice and brand protection.

But information security policies, procedures and practices are only as good as the people and systems that operate them. If the people who work in the system don’t understand their role, their responsibilities and why the controls are in place, then the results can be as bad for your organisation as not having them there in the first place.

Over the last few years there have been many stories in the press about information security failures within major organisations and government bodies. These organisations almost certainly had information security policies in place at the time of the failure. So why did it still occur and what can we learn from the mistakes of others?

As already stated, information security policies are only any use if they are understood, are adhered to and ultimately enforced as part of the culture within an organisation. Many of the well publicised information security failures have occurred because either the staff involved didn’t know their responsibilities, weren’t aware they were breaching the policies, or were operating without adequate supervision.

Another common failing is that information security policies do exist but are complex documents, unlikely to be thoroughly digested and understood by staff, even where they have apparently ‘signed them off’. This often means that staff ignore, or at best pay lip-service to the policies and the only time they are truly understood is following a security failure.

In most cases, a programme implemented to raise awareness of information security may well have prevented the failure, either partially - reducing the impact of the failure; or completely, by preventing the breach from occurring in the first place.

A carefully implemented information security awareness programme, encompassing properly documented, easy to understand security policies, standards, procedures and staff guidelines, along with ongoing training and evaluation, is a proven method for reducing information security failures.

It ensures your staff are aware, not only that the policies exist and that they are expected to adhere to them, but also why they exist, what their responsibilities are and how to operate on a day-to-day basis to maintain the required level of security. It also allows management to understand the levels of awareness within the organisation and provides them with the ability to target any specific issues which may arise.

Finally, even a good information security awareness programme needs to be backed up with a policy of open reporting. Having a ‘blame culture’ is not a good environment in which to raise information security issues. Staff need to feel they can report actual or potential problems without the threat of some kind of retaliation or witch hunt!