In this series of articles, we are exploring how social psychology helps practitioners implement information security policies more effectively. We can use this phenomenon by identifying the senior executives most likely to succeed in setting a positive tone for subsequent security training. We should look for respected, likeable people who understand the issues and sincerely believe in the policies they are advocating.
Fear can help change attitudes only if judiciously applied.
Excessive emphasis on the terrible results of poor security is likely to backfire, with participants in the awareness program rejecting the message altogether. Frightening consequences should be coupled immediately with effective and achievable security measures. Some studies suggest that presenting a balanced argument helps convince those who initially disagree with a proposal. Modest repetition of a message can help generate a positive response. Security awareness programs which include imaginative posters, mugs, special newsletters, audio and videotapes as well as lectures are more likely to build and sustain support for security than occasional intense sessions of indoctrination.