You need to test the effectiveness of your security awareness program

I wrote a few weeks back about employee security awareness and gave some resources on how to do it on the cheap. Since I am sure you followed my advice and now have a security awareness training program, you now have to measure the effectiveness of that program. So, how can you know that the knowledge is sinking in and your employees (the weak link in the security chain) are becoming more "security aware"?

One way is to wait for an incident and see how your employees handle it. However, for obvious reasons, that is typically not a good idea. In order to confirm that your employees are starting to think in terms of security, you have to be more proactive.

Since a good security awareness program runs the gamut on security issues, there is a huge amount of ground to cover. A quick and fairly simple place to start is a written test of some sort. Since this is not high school or college again, don't go nuts with some kind of situation exam or essay test. This may prove the effectiveness, but you are going to get HUGE backlash. This type of test is typically composed of simple multiple choice and true/false questions. However, this does not mean the test has to be a push over. Make sure it gives a decent challenge to employees so you have a decent measure of effectiveness.

Another way to test is to actually simulate an incident in some way. This can be physical social engineering involving anything from bringing in people to try to break in, or it can be creating phishing emails of some sort and sending them from outside to see if users fall for it. Of course, I would not recommend this approach until your awareness program is fairly mature and your user base has been exposed for a time.

Also, remember that your purpose for testing your program is not to embarrass or to get employees into trouble. People will be sensitive to being targeted in any way, so you should do whatever you can to foster a comfortable environment. That may mean being involved to a high degree in the simulation so you can be there to sooth hurt feelings.

Also, because this is the purpose of testing, make sure to use the lessons learned to tweak your program.

However you go about it, remember that simply putting a security awareness program in place is not enough. Testing is necessary if you are going to strengthen that weakest link.