An attitude, in the classical definition, is a learned evaluative response, directed at specific objects, which is relatively enduring and influences behavior in a generally motivating way. Research on classical conditioning suggests that attitudes can be learned even because of simple word association. If we wish to move our colleagues towards a more negative view of computer criminals, it is important not to portray computer crime using positive images and words. When teaching security courses, we should avoid praising the criminals we describe in case studies. One theory on how attitudes are learned suggests that rewards and punishments are important motivators.
Studies show that even apparently minor encouragement can influence attitudes.
A supervisor or instructor should praise any comments that are critical of computer crime or which support established security policies. Employees who dismiss security concerns or flout the regulations should be challenged on their attitudes, not ignored. When enforcing security policies, too many organizations focus entirely on punishing those who break the rules. However, everything we know about modifying behavior teaches us to use reward rather than punishment. One of my students, a security officer in a large corporation, experimented with reward and punishment in implementing security policies.