Security Requires Awareness Communication

Here’s a good statement of what’s involved in creating security awareness at corporate or non-profit locations. It’s in the context of IT security, coming as it does from a data base management site, but it applies to all locations with security concerns.

John Sawyer, of the DarkReading site, starts by quoting from a draft publication of the National Institute of Standards and Technology (NIST) on security training requirements:

“Awareness is not training. Security awareness is a blended solution of activities that promote security, establish accountability, and inform the workforce of security news. Awareness seeks to focus an individual’s attention on an issue or a set of issues. The purpose of awareness presentations is simply to focus attention on security. Awareness presentations are intended to allow individuals to recognize information security concerns and respond accordingly.”

“In other words,” John continues, “a security awareness program needs to inform users of security issues, the policies surrounding them, and why they are important. Trouble is, the ‘why’ is left out, so users consider security policies a boring nuisance they have to listen to once or twice a year, but take no ownership in….”

Thus, effective security requires effective communication with,  and understanding from, those in the workplaces being protected. This is essential, but often neglected.