Security awareness training does not have to be hard

Security awareness training is is arguably the most important part of a successful security program.  Because the human factor is typically your weakest link, well educated and security aware employees go a long way in the securing of your environment.  However, security awareness if often the most neglected part of a security program because of the sheer amount of work involved. 

Here are some (not all) of the challenges a security manager faces when creating a security awareness program:

• Creating curriculum
• Making sure the curriculum is at least somewhat customized to the environment
• The actual training itself (distributing for self-training or getting everyone to class)
• Keeping track of who has taken the course
• Testing to ensure the class is actually working
• Tracking test scores and retakes needed
• Security awareness reminders (posters, login banners, mouse pads, etc.)

Some companies have education departments to help with this, but most are not that fortunate.  So what is a security manager to do to overcome this hurdle?  Fortunately, there are resources.  There are people who have done this work already so you don't have to.  And there are companies that can even help build a complete security awareness program, complete with customized curriculum and tracking to take the burden off your shoulders.

The Computer Security Resource Center at NIST has a great resource page for security awareness that lists many companies and organizations that can help you.  Sure, many cost money.  But security awareness is one of those areas where you really can not afford to skimp.  If you have to do it on the cheap, then you may have to get creative and use all the free resources you can find.  It will be more intensive on you, but it will worth it.