"[T]he survey showed ... a surprising lack of awareness of security issues among the respondents. For instance, just 4% admitted to being fully informed about security breaches within their organizations. About 80% of those who said their organizations had suffered a data breach in the past year were unable to tell which IT components might have been impacted by the breach. There appeared to be even less knowledge or acknowledgement of the costs associated with a data breach. Nine out of 10 of those who said their organizations had been breached said they had no idea of the resulting costs to their companies."
So says a survey of the Oracle Application Users Group (OAUG) conducted by Unisphere Research.
I find it surprising that security awareness programs evidently pay so little attention to security incidents happening with the organization. Such incidents present ideal opportunities to discuss actual real-world security situations and business impacts that are of direct relevance to employees. They help get around the feeling that "incidents only ever happen to other people" and "that'll never happen here".
On top of that, such incidents are quite easy to investigate and write up. Sure, some departments, managers or staff might be a little sensitive, perhaps reluctant to 'see their dirty laundry washed in public' but it's for the general good, and if reported sensitively can highlight the positive learning and improvement aspects. Keeping them hidden is, to me at least, an unpalatable and unhelpful way of dealing with them. I would even go so far as to say that failing to take these improvement opportunities is a governance failure.
By the way, security incidents suffered by competitors and others in the same industry or area are also good fodder for awareness programs, supplementing the usual headlines and news stories from the security press. In many ways it is better to learn from the misfortune of others but incidents close to home tend to resonate with the audience and are more motivational.
Regards,
Gary Hinson
IsecT CEO and security awareness fanatic
Comments