Whereas usually our awareness and training modules focus in some depth on one of the 70 information security topics in our portfolio,  Information Security 101   is a broad but shallow module. It is designed to bring workers quickly up to speed on the basics of information risk and security during security induction courses, for periodic refresher training, or when launching an awareness program. As soon as a new worker arrives, they start absorbing and being assimilated into the corporate culture, picking up ‘the way we do things here’. Sensible organizations run orientation sessions to welcome newcomers and kick-start the cultural integration. InfoSec 101 covers common information risks ( e.g . malware) and information security controls ( e.g . antivirus). The materials are deliberately succinct, outlining key aspects without delving into the details. We’re not trying to tell workers everything about information risk and security all at once but to set them off on the righ...

The remaining items for the recycled  Information Security 101   module are falling rapidly into place. It will be a bumper delivery with fifty (yes, 50) files already in the bag. One of the regular end-of-month jobs involves matching up the awareness items - the files - with the contents listing and their descriptions in the train-the-trainer guide. Years back I came up with a simple numeric naming scheme to make it easier to get the files in order and link them with the listings. Good thing too: this afternoon I came across one listed item that I've decided to drop from the module, and about three additions that need to be listed and described. There's still a little time left before delivery to change things further and renumber, again, if we need to ... which emphasises the value of these final quality checks before packaging and despatch. Another part of the quality assurance process is to open and review the content of all the files. This is our last chance to spot speli...

Today I'm working on the  Information Security 101   awareness seminar for professionals, by which I mean workers with a professional interest in information security.  As with the staff and management seminars, the aim is to cover the basics in a way that appeals to the audience: I figure the professionals are more clued-up than most, particularly on technology, so it's appropriate to go into a little more depth here on the fundamental concepts ... starting with risk and control.  The diagram above represents the nature of risk i.e. 'uncertain outcome'. That's a seminar slide's worth, with a few words from the presenter briefly explaining each of the red-amber-green spectra as they appear on the screen. The next slide contrasts two complementary forms of control: either we stop harmful things from occurring by avoiding, preventing or mitigating incidents, or we ensure that good things occur - and that's an intriguing thought. What does that actually mean i...

From time to time, people get all excited about micro-learning, the educational equivalent of eating a chocolate elephant - one bite or byte at a time. "It's easy", the line goes. "Simply break down large indigestible topics into lots of smaller edible chunks, spreading them out enticingly for people to snack on whenever they feel peckish." I've tried that with our digital awareness content. For some strange reason, nobody was hungry enough to consume the random assortment of ones and zeroes, hundreds and thousands of bits all over the disk. Evidently it's not quite that easy. Education is never easy, if you want it to work well that is. Micro-, milli- and macro-learning, online learning, traditional classroom-based courses, webinars and seminars, conferences, educational events, rote and experiential learning, on-the-job training and demonstration classes, mentoring and so on are neither simple nor universal solutions. They each have their pros and cons...

Using the  Information Security 101  theme I mentioned on Feb 14th, I'm close to finishing the first set of presentation slides with a preponderance of yellow and black.  Through a carefully chosen sequence of bright, clear images, no bullet points and very few written words, the slides tell a visual story based around risk. The core message is that information security is less a case of stopping the business from doing things, than of being vigilant. ' Proceed with caution ' sums it up nicely. Given the elegance, simplicity and power of those 3 words, I'm not sure whether to elaborate on information risk and information security at all, in fact. I guess we'll mention a few current current threats, some recent incidents and typical controls in the speaker notes but I rather like the idea of leaving it up to the presenter/trainer to decide how to play things at run-time - during the induction courses and awareness program launch sessions for which the 101 module is d...

Fueled by a lot of Brahms and a wee tot of rum, half an hour's idle brainstorming on the purpose and objectives for information security awareness generated the following little Liszt: Rites, rituals Rite of passage Ritual slaughter Religions Belief systems  Cult, visionary leader, positional power, faith Sheep, lemmings Wolves, packs, threats, skills Group-think, conformity Compliance, rules, constraints, in the box Individuality, creativity, nonconformity, freedom, out of the box Hippies, communes, cliques Hallucinogens Noncompliance Cultural norms, expectations Counter-cultural, bucking trends Conventions, habits, preferences Automatic behaviours, instincts Socialising infosec Social pressure, influence, shared values Social acceptability Social structures, hierarchies, links Networks and relationships Families, organizations, departments, teams, groups, cliques Nations Interactions Dynamics Pressures Battles, wars, competition for scarce resources Reproductive success Change, c...

My perfectionist streak flared up with a vengeance today. First I spent a productive couple of hours checking and revising the content of our generic/model  A cceptable U se P olicies, intending to include them in the updated  Information Security 101   materials.  Aside from reviewing and tinkering with the information content , this also involved standardising the formatting of the AUPs by using the same MS Word template with specific styles for all of them. The AUPs have been updated at various times in various awareness modules and I noticed that, somewhere along the way, I must have changed the bullets and colouring for the 'acceptable use' and 'unacceptable use' points. Evidently I have also meddled with the boilerplate text that tops and tails each AUP, making them slightly inconsistent. To my beady eye,  this will not do!   Unsure how to name the model AUP files, I toyed with the idea of making a single multi-page document containing them all b...