Okay, so we push corporates to improve security, and provide training to IT staff and awareness presentations to CEO's etc, but each year a new batch of graduates are brought in to companies as others leave, and they typically have one of two perspectives:
- security fascist!
One of the things a few of us are trying to do in Scotland is facilitate training sessions for students (lectures, workshops, summer placements) by companies (banks, law enforcement etc) but there is a real struggle getting buy in - even though the companies are offering their resource for free (well, they understand the benefits to them of getting graduates in with some experience) and organisations such as the Institute of Information Security Professionals sponsor many of us to provide training in as many areas as possible.
What could we do to improve this - not just in Scotland, but everywhere, as it should be relevant to all...the problem is not going away, in fact it is getting bigger, but companies don't take it seriously until they are hit badly, and even then only until the newspapers target someone else.
Companies have security policies, but do they have culture from the top to the bottom? "No" is the easy answer. We try to fix the culture at the top, but typically that is high effort for no return so can we get in at the bottom? Educate students and new graduates!
The problem is, of course, that students don't want to hear about security, as it goes against the usual student ethos :-)
[edit - unless they are taking a security course, as @D.W. pointed out, but that is where we get a lot of the security fascists from - overkill on the security, not enough focus on real world, less than ideal scenarios]
- What do you see students and graduates interested in?
- What would work in your company / university / organisation?
- What is the biggest win for you?
- What are you fed up with hearing
- Does your organisation have an alternative solution? about?
If you have key learning points you think are appropriate for the community, let's get them into the community!
-----------Added bounty. 2 really good answers, but would really appreciate many more points of view, as I see this, and the associated problem (How to educate CEO's etc on security) as essential things to get better at.