Seeing the glass door

I can't remember what this commercial was for, but in it, someone with a full coffee smacks right into a glass door while trying to enter a building.  I giggled while I watched the coffee splash all over the glass and ooze down the door.   Maybe they were too busy to notice the door handle, or perhaps they thought it opened on its own.  Whatever the cause, infosec professionals, this is what we have to deal with. 

Wait, what?  You say that you pay attention to the glass door?  That's fabulous, because your fellow employees are not thinking about the door.  You may put a sign on the door that says 'caution', you may put a big red button on the wall near it that says: 'use to open door', but they are still going to smack right into it, coffee aftermath and all.  Substitute that example to whichever infosec risk you have to deal with today: don't click on the link/attachment/provide the nice Microsoft employee on the phone with your password and wah lah!  You have our over-busy, short attention spanned co-workers focused on just trying to get their job done, let alone educate and make aware of the infosec risks, let alone change their behavior.

I fully admit that I've smacked into my fair share of doors in my lifetime, because I too, am one of those over-busy, short attention spanned folks.  What made me get on this topic today is the Poneman Institute release of Part 2 of their 'Exposing Cybersecurity Cracks' report, and one of its recommendations is to: "Create security education and awareness programs that focus on the seriousness of cyber attacks and the importance of reducing high-risk behaviors."  Like the lack of executive communication that they pointed our in Part 1, this too got me all riled up.  We should know how to do this better by now !

So after reading Part 2, I took a look at myself and thought: 'Self?  How do you educate yourself?' No, I didn't actually talk to myself, but I did answer myself.  Here are my thoughts:

1) One thing I've learned this year:  I can still learn new things.  I seek to learn new things all the time, but I had kind of given up on trying any more certs.  I proved myself wrong, though!  I buckled down, studied, and passed the cert that I sat for.  The lesson here is: never give up trying.
2) The other thing I have learned this year: you have to, must, need to make education mean something to the audience.  When you can show your audience how taking some simple steps can help them personally...it makes a huge difference in affecting behavior.
3) Quit being ambiguous!  (Yes, I did just write about this).  Explain why things are bad.   Make it at a level that everyone can understand.  If folks feel like they understand the problem, this might also change their behavior.

This is a tough area for all of us.  But true leadership includes being persistent.  And this is an area we can't afford not to persist in.  Share your successful ideas!