Success strategies for security awareness

Gather your allies
Hansen also emphasised the importance of working with allies. "I've seen several Fortune 1000s team up their IT managers with a counterpart from corporate communications or marketing. The IT security group provides the content, and their marketing counterpart packages it."

A similar approach would be to use internal focus groups, Hansen suggested. "It is always a smart move to run your material by several department heads (e.g., HR, legal, finance, administration) to see how well your message plays. Their feedback can be extremely insightful."

Shivanandan agreed. "It is imperative that the IT manager amass a team of leaders from multiple disciplines throughout the organisation to map out a program that addresses the needs of all groups, and will result in the desired level of awareness."

Watch your language
"Most IT managers fail to realise that they speak a foreign language," explained Hansen. "The language of IT goes over like a lead balloon with most of the corporate community. Oftentimes, people feel like the IT department is talking over their heads purposefully and actively resent it. "One of the reoccurring issues we've seen is that security evangelists repeatedly fail to craft a message that inherently appeals to their audience," Hansen added. The key problem is in the analogies they choose, she said.

"We have seen awareness programmes wrap themselves around predominately medical and/or military analogies without understanding the impact that language can have. Not to borrow too heavily from Susan Sontag, but there is great power in metaphor. Using the wrong language can ensure that people will stop listening or, worse yet, start viewing security in a negative light -- something to be avoided, rather than embraced."

Hansen added that the best security awareness programmes are custom in-house projects that essentially "convey your message within the context of your corporate culture." She said that "canned programmes sound foreign and will not resonate well -- people are more likely to tune out the message."

Streamline your communication lines
The success of an awareness campaign would essentially hinge on how effective your corporate communication lines are. "Here at BellSouth," Shivanandan explained, "we constantly evaluate and streamline internal communication processes and procedures to leverage what we learn and to make all of our employees aware of what we are doing in the face of a disaster.

"For each initiative, we develop a comprehensive internal communications plan, orchestrated by the PR professionals in our organisation. We capitalise on our online capabilities for communications purposes.