Security awareness training is a bane to most employees.
A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from discovering all the answers in the raw HTML code.
What are good motivating policies to encourage employees to help play good defense?
Social norms. If employees see the managers taking security seriously, it sets a cultural expectation that to get ahead in this company, I must need to take security seriously.
Paradoxically, the first responsibility of the security training is to show why the security training is important, interesting to you (the employee), and relevant (for your work).
Any training (at least the first-time awareness trainings) must start with this, or at least lead up to it very quickly, otherwise its pointless.
Though it seems from your WTF example that you were referring to testing on the training, which is very different... Training needs to first and foremost TEACH the information.
If the first job (showing why its important) was done well, you don't need to test the rest. If it wasn't - well then, there's not really any point, is there? People will always find some way to cheat if they think its not important.
In addition, having an interesting trainer helps a lot... But not as much as giving the training over a free lunch!
I've done this at some of the biggest banks, to much success - employees are interested in coming for the food (but not just simple sandwiches, mind you); they have reason to hang around and not run out the first chance they get, so they sit and listen; they're enjoying themselves (studies have shown people enjoy themselves when there's food around, go figure); and they have their mental guards down, because of the food.
(Okay, thats more of a strategy than a policy, but still... the policy is making the employees want the training and enjoy it.)
One small addition, again not so much a policy per se, but part of the attitude towards awareness should be offering solutions and practicality of those solutions.
This of course includes proper tools, enough resources to "do" security, etc.
It would be worse than pointless if management got everybody to be aware of security, but then refused them the ability to do anything about it.
discovering all the answers in the raw HTML code
Isn't it slightly hard to take security training seriously, when the training is that easy to subvert?
For job related security code-review or peer review with positive feedback is probably the best way.
When you get down to it, hiring employees that care is the most important policy followed with letting go the ones that don't care. Nothing makes people not-care, faster than seeing coworkers getting away with bad security practices despite their manager knowing about it.
Ensure that whatever security policy isn't so draconian that it prevents people from actually doing their jobs. This is especially true if you're blacklisting/greylisting sites.
For example, one company I worked for had Google on its greylist. This meant that employees only got a limited amount of time to search on Google before their "quota time" ran out. This might have been okay when the company was working with some proprietary language, but writing .Net without being able to use Google is a real pain (and no, MSDN is not an adequate replacement). This, combined with the opaqueness of the process by which sites were added to the whitelist bred a lot of resentment, and subversion of the policy.
Rigidly enforce the security policy. If you have a clear, well-defined security policy and severely discipline those employees who circumvent/ignore the policy, they'll soon enough fall over themselves to be more aware of it.
It sounds a bit harsh, but a security policy with no teeth is worse than no security policy at all.
People hate security training because they don't think its relevent. To a lot of people, the risks are very abstract. If you put the risks to people on a level they can understand, and provide them with the education and information on how to best stick do their jobs in line with the corporate policy, everything will be more effective.
When compliance is clearly defined as part of the employees performance goals, it is hard for an employee to say "no".
