Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It has been claimed that "the weakest factor in security is the humans". Unfortunately this is a weak link we cannot cut away so we have to deal with it.

I need ideas to help build inherently security awareness in an organization. I had a few ideas myself:

  • All clients have a mandatory screensaver which displays statements like "Remember to lock your PC", "Always wear a visible badge", "Do not let anyone follow you into a locked door without asking them for a valid key card".
  • Send SANS Ouch! newsletter to everyone.
  • Quiz people in security awareness annually
  • Present the OWASP Top 10 to relevant personnel, e.g. developers.

What are your ideas for building security awareness?

share|improve this question
Check this question, you might find it useful. – StupidOne Aug 13 '12 at 13:33

Love the suggestions you gave so far, I'll be keeping them in mind for future reference!

My #1 suggestion would be to attack your own employees. I don't mean you should run around with an axe all "Here's Johnny!" style, screaming at people about proper security practice, but rather stage cyber-attacks and judge their responses, then explain to them what they did right / wrong. People learn through experience much better than they learn through reading an email.

One of the easiest and most effective methods to try is an external website containing a login screen, with the company logo. Send out emails to employees from an external account, claiming to be the sysadmin, saying you've got a new staff portal. Every time a user logs in, have it direct to a page explaining what they just fell for and how they can recognise it in future. Include your phone number and email address in case the user wants to know more. Every time a user calls you up to ask if it's safe, or to report it as a security issue, tell them they did the right thing and make sure their line manager is aware of their success.

Next one to try is a more direct one. Send out an email (again, from an external mailbox) saying that the database is having problems and you've got to re-enter everyone's passwords. Ask them to send their passwords to a "secure password update mailbox", and wait. Every time someone sends a password, explain to them that they just fell for a phishing attack. Downside of this attack is that you'll have to reset a lot of people's passwords!

Just one word of advice: get authorisation to do this before you start the project! ;)

share|improve this answer
I'm aware of Theory X and Theory Y business psychology. In fact, it's the basis for this answer - I'm talking about giving positive feedback, not negative. You phish the users as an eye-opening tactic, then explain what they did wrong. Part of the exercise is to explain to the user that they didn't fail, they just didn't know. No negative feedback is given. However, if a user responds properly, then you provide positive feedback to their line manager, so they know they did a good job. – Polynomial Aug 13 '12 at 14:03
I'm working on a device to do exactly all these things and more. There are only a few other companies developing tools like this, including the makers of Armitage: – schroeder Aug 13 '12 at 14:24
I also agree that it cannot be a punitive approach, but an arena where employees get to make mistakes safely. Positive feedback is key. – schroeder Aug 13 '12 at 14:27

At the company I currently work for, they invest in user education through many avenues. There are online games with prizes (think iPads), required education materials that have to be taken every six months, and regular emails regarding security (including stories of breaches from news agencies).

All of these tend to keep the employees pretty well-educated. the most important key is the amicability of the IT department. Never are the end-users told "A Security Breach Will Mean Your Job!", but rather "If something happens, please let us know so we can quickly handle the situation"

This mindset keeps the end-users from being afraid to report security breaches. Since it's not a scary topic they are more willing to discuss security with their peers, and inform IT when they see what they think might be a security breach. While most all of these aren't actual breaches, it's worth digging through them to find the one or two that could have been catastrophic.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.