I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications.
The problem seems to be among people who are not computer savvy, who are in no way hostile to IT SEC. They are simply not "computer" people.
What guidance is there to ensure that the IT Managers and System Notifications are understood, and acted upon? I'd like to craft a single message for the entire user base, and not take on responsibility for hand-holding the "special" folks.
My hope is that I can develop a set of email best practices that are used when communicating with all end users, for the purpose of sending IT Security user notifications through email.
- How should I lay out the thoughts behind the message?
- Are HTML messages more effective? How so?
- Are there any cut-and-paste samples?
- Does the "From" address matter?
- What should the subject say?
Examples of notifications include (but not limited to):
- Automatic Email Messages from Antigen or Forefront AV systems
- Revisions to IT security policy
- General notifications that are simply informative
- "Maintenance will be performed at 11pm-6am. Expect a disruption in service"
- General notifications that are meant to be read and acted upon. They do apply to the end user.
- "Close all applications and log off for patching"
- Other notifications that may or may not apply to the end user.
- SPAM Quarantine Summary Emails: "Enclosed is a list of quarantined messages..."
- "A security patch for an old version of software that might not be installed"