# Presentation: 704478

## Building an IT Security Awareness & Training Program

- Mark Wilson
- Computer Security Division, ITL
- National Institute of Standards and Technology
- -  November 1, 2001  -
- mark.wilson@nist.gov
- (301) 975-3870 (voice)         (301) 948-0279 (fax)
- http://csrc.nist.gov/

## Cornerstones for Success

- Policy
- Roles and Responsibilities
- CIO
- IT Security Program Manager
- Managers
- Users
- Budget
- Management Support . . . Commitment

## A Life-cycle Approach

- Identify Needs
- Design
- Develop
- Implement
- Maintain

## Designing Your Awareness & Training Program

- Build a Strategy
- Determine Organization’s Needs
- Needs Assessment
- Incorporating Results of Program Reviews
- Develop an Awareness and Training Plan
- Identify Audiences; Scope Needs; Establish Priorities; Set the Bar; Get Mgmt/Org Buy-in!

## Developing Your Awareness & Training Material

- Policy and Guidance Issues
- Your program is dependent on policy
- OMB Circular A-130, Appendix III
- NIST guidance - http://csrc.nist.gov
- Infrastructure & Deployment Issues
- Web-based deployment the common theme
- CD-ROM

## Developing Your Awareness & Training Material

- Developing Awareness Material: Samples
- Password usage/creation/changes
- Protection from viruses - scanning and updating
- PDA security issues
- Laptop security while on travel
- Personal use and gain issues
- Software patches and security settings on client systems
- Software license restriction issues

## Developing Your Awareness & Training Material

- Developing Awareness Material: Sources
- E-mail advisories
- On-line IT security daily news websites
- Periodicals
- http://csrc.nist.gov/ATE
- http://csrc.nist.gov/organizations/fissea . . . previous conference presentations

## Developing Your Awareness & Training Material

- Developing Training Material: Sources
- In-house
- Contractors/vendors
- Mix of in-house and contractor support
- http://csrc.nist.gov/ATE   . . .
- NIST Special Publication 800-16

## Implementing Your Awareness & Training Material

- Messages on trinkets: e.g., key fobs, post-it notes, notepads, first aid kits, clean-up kits, diskettes with a message, frisbees, “gotcha” cards
- Posters
- Access (to my PC) lists
- “Do and Don’t” lists

## Implementing Your Awareness & Training Material

- Screensavers, warning banners/messages
- Newsletters
- Desk-to-desk alerts
- Organization-wide e-mail messages
- Videotapes
- Web-based sessions
- Organization’s IT security homepage

## Implementing Your Awareness & Training Material

- Computer-based sessions
- Teleconferencing sessions
- In-person, instructor-led sessions
- “Brown bag” seminars
- Rewards programs - plaques, mugs, letters of appreciation . . . all-hands meetings (public humiliation)      ;-)

## Maintaining Your Awareness & Training Program

- Monitoring Success - Use of Evaluation and Feedback
- Evaluation forms (classroom)
- Web- and computer-based evaluations
- Pre- and post-testing
- Feedback from management and users

## Maintaining Your Awareness & Training Program

- Managing Change
- Technological
- Architectural
- Organizational
- Raising the Bar

## Common Themes in Successful Programs

- Budget = Successful Program
- Defined Roles = Successful Program
- Web-based Material
- Keep Material Interesting and Current
- Movement Toward Professionalization
- Training Plans
- Mix of Awareness and Role-based Training

## Questions?

- Mark Wilson
- NIST
- mark.wilson@nist.gov
- (301) 975-3870 (voice)
- (301) 948-0279 (fax)
- http://csrc.nist.gov/
- http://csrc.nist.gov/ATE
- http://csrc.nist.gov/organizations/fissea