While there have been continuous efforts to build effective information security program via the constant development of security policies, standards, procedures and guidelines, a more proactive approach is necessary as far as creating the adequate awareness program is concerned.

A sound and solid security infrastructure is less effective if there is no effort to make employees aware of their rights and responsibilities within the structure. More often than not, internal staff is forgotten in the prescription for a successful program.

However, in reality, these employees are actually essential ingredients for the most cost-effective measures to protect the intellectual assets of an organization.

Employees at all levels should be made to understand the reasons of the importance of information security and the advantages that will follow upon its successful implementation.

Before delving into the essentials and goals of a security awareness program for an organization, the objectives and elements of the security scheme itself need to be examined.

What are the Objectives?

Over the last few years, there has been a changing perception of the role of information security in the business world of today.

In the past, security was viewed as an option. However with the increasing migration of business transactions onto the Internet, the present-day enterprise now sees information security as a business enabler. Some of the key objectives of a comprehensive security program include ensuring that:

• The organizations intellectual and information assets are well protected;
• There is a high level of confidence and confidentiality by keeping intrusions at bay;
• Those with a business need have quick access to the organizations resources and project management systems to make informed and accurate business decisions; and
• Business objectives and customer needs are met and understood.

What are the Essentials?

A successful security scheme does not necessarily mean large monetary investments, but it does require time and proper management. In a nutshell, some of the key elements that must be present to spell success are:

• Effective implementation of policies, standards, procedures and guidelines;
• Identification of the appropriate and capable leadership to be responsible for the implementation;
• Classification of intellectual assets according to their value and importance in the organization;
• Implementation of basic security concepts such as separation of duties and rotation of assignments; and
• Implementation of an effectual and competent employee awareness program.

While most organizations which have marked information security as a must-have will probably have most of the essentials listed above down pat, the final component, i.e. building the awareness from within, is often forgotten or inadvertently left out.

How to Establish an Effective Awareness Program

In order to achieve success, the awareness program must consider the needs and current level of cognition and understanding and of the employees and management.

The following are the key factors on how to gauge the level of Comprehension:

• Determine the current level of computer usage by asking the right questions and listening to the responses. This will help formulate a training and awareness program that suits employee needs.
• Ascertain what the managers and employees want to learn in order to formulate a program that best suits the needs of the various business units within an organization.
• Explore the level of receptiveness to the security program. In this way, an organization will discover what areas are meeting with resistance and will be able to work a plan that is for the grater good of the company.
• Formulate a plan of action on how to gain acceptance. By making the employees partners in this program and understanding the business processes in each department, acceptance of a far-reaching security awareness program will be easier to attain.
• Identify possible allies within the organization as their support will act as a catalyst in gaining the acceptance of the other employees.

How to Develop an Effective Security Awareness Program

Instead of an across the board type of plan, segmenting the organization according to the following can improve the effectiveness of the security awareness and level of acceptance:

• Level of awareness
• Job category
• Functions, duties and responsibilities
• Knowledge
• Applications used

Through segmenting, the staff of an organization will better understand their roles, both as individuals as well as collectively.

Getting your Awareness Message Across

To ensure the success of the awareness program, a highly visible and interactive plan needs to be put in place. Messages need to be stimulating and this can be done via posters, pictures and videos. Other effective mediums of include brochures, newsletters, e-zines and booklets.

An organization should also prioritize the messages that are disseminated to its employees. Start small and build on the plan.

Once these key factors are in place, the awareness program should be well underway. However, it must be highlighted that an awareness program is a continuous educational process. While it may not require huge initial monetary investments, it does necessitate much investment in terms of time and management.