Hello,
In your role as the person responsible for Information Security training, do you have a plan that is time-based which specifies that every employee must spend “X” minutes or hours a year on information security education? If you do, or you don’t, you may find the information below useful. This is based on my experience.
Let us consider a security education plan that specifies 120 minutes of security education time per employee. This number is not hard. Before executing this plan, here are some useful tips.
1) Focus on Quality and not Quantity: A good 5 minute security lesson, which is engaging, visually pleasing and thought provoking is much better than a 60 slide presentation with just bullet points. Just think of the best ads on TV that you recall. How long were they? 30 seconds to 60 seconds at the most? What was it that stuck?
2) Continuity: The security education must be continuous, which means, there must be small capsules (drip irrigation comes to mind) delivered frequently so that information security stays in the mental horizon of the employees.
3) Sustainability: You have a budget (time, money and people). The security education program must be executable without straining your resources.
Now, let us see how how these 120 minutes can be best utilized by focusing on QUALITY, CONTINUITY and SUSTAINABILITY. There are creative ways to utilize these 120 minutes, without being overly intrusive into the productive time of employees.
1) 45 minutes of mandatory information security training delivered in a classroom or via e-learning:
This must be the mandatory portion of the education time. No excuses tolerated. If your workforce is huge, then go for e-learning modules that are SCORM or AICC compatible so that you can track attendance. Also, here must be a mandatory quiz at the end of the training, which is not only a useful interactive tool but also helpful in capturing the effectiveness of training.
2) 15 minutes of security education through screen savers
Screen savers are often under utilized but in my opinion one of the most useful tools for quick tips. The best thing about screen savers is that every body sees them, atleast once. Get 12 screen savers, rotate them once a month and this gives approximately 1 to 1 and half minutes of learning time every month to your employees. Let us round that off at 15 minutes of learning time a year.
3) 15 minutes of security education through poster/ wall papers etc.
Same principle as screen savers. Get 12 posters and display them in prominent locations in either hard copy format or put them as desktop wall papers or give them away as laptop stickers or whatever other format that works.
Now, we have covered 75 minutes of learning time, and the 30 minutes through screen savers and posters were not intrusive and the employees recieved this education without they themselves noticing.
4) 30 minutes security education through short videos
Get 6 information security videos on important topics that are not more than 5 minutes long. If they are SCORM compatible, the better. Load them in your Learning Management System or Web server and deliver them once every 2 months. This covers 30 minutes of training time.
5) 20 minutes of security education through quizzes/ surveys
Deliver a security quiz/ survey of 10 minutes each (10 questions per survey will do the trick) by creating interesting multiple response and scenario based questions and deliver them via your web server or a free survey tool. You can create one using Google Docs. Quizzes and Surveys by themselves are learning instruments because they invite the undivided attention of the learner. This covers another 20 minutes.
Now, with the above plan you have covered 125 minutes of education time. This plan is simple, non-intrusive into the work time of the employee, is regular and is sustainable using a medium budget.
Good luck with your security education plan.
Anup Narayanan,
Founder, Information Security Quotient
