Real-world examples can also drive the message home when put into context. When a data breach makes the news, use it as a teaching tool -- in training classes, via email or through video presentations.
Discuss the likelihood of a similar breach occurring in your organization. Ask: How would a breach like this have affected our company or a specific business unit? What people or business units should remain extra vigilant against a similar attack? What security measures do you already have in place to protect against such an attack?
Go phishing, internally
Another effective communication technique some companies have adopted is to launch their own simulated phishing scams, see how many employees take the bait, and then use the opportunity to offer advice on avoiding the scam the next time -- when it might be real.
Royal Philips Electronics recently launched a pilot program of controlled phishing attacks, says Nick Mankovich, chief information security officer.
Working with a professional phishing partner, whom Mankovich declined to name, Philips simulates an email scam that tries to get employees to click a link to a website and enter their password and user name. When the unsuspecting employee clicks on the link, a message pops up explaining their error and offers tips to avoid being scammed the next time.
"It's not about embarrassing or surveilling anyone. It's really about giving material that means something at the moment when they click on the [erroneous] link," Mankovich says.
Depending on the exact nature of the attack, tips might include questions like: Did the email come from a trusted source? Was there something misspelled or unusual about the link? Did you remember to hover the mouse over the link and check the bottom of the screen to see if the two matched?
So far, three phishing experiments involving 250 employees each have been conducted; eventually, Mankovich hopes to test the security smarts of all 90,000 email-connected Philips employees worldwide.
"At the end of each pilot we talk to a few of the users to see what they felt about the experience -- both those who fell for the phishing and those who did not," Mankovich says. "We [typically] have a very small percentage of people who did the bad behavior, and those people do get the message."
As for more simulated attacks, "We've decided we're going to run it forever. Those personal hooks do very well" -- though future phishing tests will be stealthier and increasingly intricate, he says.
Protect to enable
