Skip to main content
45 votes
Accepted

How to make people report incidents?

Of course no one wants to report, they are "turning in" their peers. Also, the time and complexity it takes to go through the reporting process you described is another negative reinforcement. You are ...
schroeder's user avatar
  • 131k
42 votes
Accepted

Which topics should a security training for non-IT persons contain?

I actually did a presentation similar to this a little over a year ago, and spent quite a bit of time deciding how to structure it. My target audience did include developers and other people quite ...
Kjartan's user avatar
  • 989
21 votes

Should corporate security training be tailored based on a users' job role?

The idea of customising the training to meet user requirements is in fact a very good approach. However, there will have to be certain additions to this approach which will then suit everyone in your ...
Vikas's user avatar
  • 337
16 votes

Which topics should a security training for non-IT persons contain?

None of the existing answers mention this and its too long for a comment even if its not a thorough answer. One thing you will absolutely need to avoid engendering in your audience is nihilism (i.e. ...
Jared Smith's user avatar
  • 2,106
14 votes
Accepted

Should corporate security training be tailored based on a users' job role?

Security Awareness expert here (awards, best-selling book). Absolutely, you should/need to customise training to the role/risks. Many international bodies actually call this out as important: NIST ...
schroeder's user avatar
  • 131k
10 votes

How to make people report incidents?

Encouraging your employees to snitch on each other by sending documentation of minor misbehavior to a centralized email address is a terrible idea for work climate. Nobody does it because nobody wants ...
Philipp's user avatar
  • 49.4k
6 votes

Why are data breaches like the one at Quora considered so bad?

Putting privacy concerns aside (as it sounds like you don't particularly care), having detailed personal information about you makes at least four things easier: Identity theft, opening new accounts ...
Ben's user avatar
  • 4,022
6 votes

Which topics should a security training for non-IT persons contain?

It's so unreal for them that the only way to have it stick is by showing them by real life example. Ask them: Who knows what phishing is? Ask them: So what kind of information leaked would be ...
MPS's user avatar
  • 911
6 votes

How to explain importance of security & privacy to a layman?

Information security is a technically complex topic and it is largely invisible. You can see a door lock, and see a burglar, and see and understand the loss of your TV, but one cannot see or ...
schroeder's user avatar
  • 131k
5 votes

Is it wise to show the "e-mail has been scanned by XYZ antivirus" in e-mails footer?

I don't think it's a good practice to include footers like this in email correspondences. My arguments: It clutters your email thread, making the actual message stand out less The info is irrelevant ...
knipp's user avatar
  • 589
5 votes
Accepted

Why should small and medium-sized businesses care about security?

Every business, no matter what it does or how big it is, runs on information Information has value to the business, so the business needs to protect the availability and integrity of that information ...
schroeder's user avatar
  • 131k
4 votes

Why should small and medium-sized businesses care about security?

I think the question is too broad so I will only cover what I think is the main aspect: Is security, at the end of the day, simply risk management? That's what it is. There are several risks ...
Steffen Ullrich's user avatar
4 votes

How to make people report incidents?

I find it interesting to speak to the one who ever thought this was a good way to achieve results. The stimulus is extremely negative. You ask people to snitch on their co-workers. They must do this ...
user24119's user avatar
4 votes

Hacking demonstration

In practical terms there are three threats I'd be worried about: Passive monitoring by network owner/other users on the network Direct exploitation by network owner/other users on the network Active ...
markeldo's user avatar
  • 129
3 votes

Which topics should a security training for non-IT persons contain?

On the one hand you say you want to run workshops while on the other, you dive into some some quite hard-core topics with people who have limited knowledge of security. While I applaud your efforts, ...
symcbean's user avatar
  • 18.7k
3 votes

How concerned should we be about RFID skimming?

The article you point to presents things more from one perspective than the other. From the same article, I find the statement :"RFID crime isn’t a great payback for the effort and risk." at least ...
Overmind's user avatar
  • 8,899
2 votes

End user security awareness measurement

SANS Secure The Human now publishes lists of KPIs for you to consider: https://securingthehuman.sans.org/resources/metrics They split it up into "Tracking" metrics (who has completed the training) ...
schroeder's user avatar
  • 131k
2 votes

End user security awareness measurement

What we decided for one KPI is the amount of incidents reported. In the current phase, we say we want more incidents to be reported: not enough people report/are aware they should. When the amount ...
johan vd Pluijm's user avatar
2 votes

Which topics should a security training for non-IT persons contain?

Show them a Password Manager like LastPass or KeePass. Most everyone I know has a TON of user ids and passwords. To help remember them they do things like use all the same passwords, write them down ...
Adam Dewing's user avatar
2 votes

Which topics should a security training for non-IT persons contain?

Generally speaking, the more security measures you can abstract away from the user - the better! For example: File storage should, if available, be done on a centralized server. Assuming you have ...
Vegard's user avatar
  • 233
2 votes

How to make people report incidents?

It starts with leadership. In my current contract, for an organization of near 30,000 employees and contractors, I am nearly the only person who wears their photo-id badge. Everyone else carries it, ...
Pieter Geerkens's user avatar
2 votes

Why are data breaches like the one at Quora considered so bad?

Not familiar with Quora in particular, but here's some bad things that can happend in general: You could suffer monetary loss, e.g. if credit card info was stolen. Your online identity could be ...
Anders's user avatar
  • 65.6k
2 votes

Why are data breaches like the one at Quora considered so bad?

The "big deal" is that personal information that was knowingly shared with and entrusted to Quora by consenting individuals was compromised and obtained illegally by a third party. Obviously, the ...
Jeff's user avatar
  • 137
2 votes

How can I focus on the positive side of information security to create awareness?

What you're looking for is a change in culture, rather than positivity as a goal. You'd want to re-state your objective, which is "Achieving a better cybersecurity culture". I'd highly recommend ...
Milen's user avatar
  • 1,223
2 votes

Should corporate security training be tailored based on a users' job role?

This is more of a communication question than a security one, but I must acknowledge that the result has a strong impact on the global security practices. What matters here is that all employees can ...
Serge Ballesta's user avatar
1 vote

Why should small and medium-sized businesses care about security?

Few thoughts: Security is one aspect of Quality. A nice summary is here Security is coupled with Privacy (think of repudiation, compliance, customer claims etc.) Security is not just about ...
papajony's user avatar
  • 454
1 vote

Why should small and medium-sized businesses care about security?

IT is just a tool, and it should be considered as any other tool, neither more nor less. I assume that the office door is locked at night, but you probably have no armed guard squad behind it. But you ...
Serge Ballesta's user avatar
1 vote

How can I focus on the positive side of information security to create awareness?

This is a much better approach than trying to make people report violations. First of all, people will do things that affect them or have meaning to them. So I'd suggest making it be about "this is ...
baldPrussian's user avatar
  • 2,778
1 vote

How to make people report incidents?

I agree with all the other answers: you will never get compliance with your current system. There's zero incentive for people to participate in reporting their peers, and being reported isn't the best ...
Kat's user avatar
  • 117
1 vote

How to make people report incidents?

@schroeder's answer is good, but it misses one of the huge problems with security. Instead of motivating people to do the right thing, change the thing so that the desired behavior is the default ...
John Deters's user avatar
  • 34.2k

Only top scored, non community-wiki answers of a minimum length are eligible