@Ernst_Huijten wrote:
I am looking into new ideas how we can create security awareness programs. Due to information overload I am thinking toward playing and learning; does anyone have experience with how we can create programs based on the concept of learning by playing?
Hi Ernst,
By all means, develop lists of ideas for security awareness training elements and implementation, but don't think that you're alone in the endeavor. Make room for the corporate culture and departmental managers to influence your thinking and recommendations. You'll need buy-in from management anyway, and they may be more enthusiastic if they feel as though they've had some input.
Whether or not gamification is a good option goes back to the culture. At my last job, it was very popular. Not so much where I work now, as management prefer to keep the training metrics confidential.
My two big recommendations have to do with size and content. Users are more likely to pay attention to and retain smaller parcels of training information. Also, don't be afraid to occasionally offer training tidbits on information security topics that may not have direct relevance to company operations (safely using Facebook and configuring home Wi-Fi, to name a few). Users will pay attention if they believe they will derive benefit from the training.
Above all, be effusive with your praise when users rely on their training to good effect, and encouraging when they don't. Some of my best "security partners" ended up being users that blew it a few times.
