Discover how applying marketing principles to your information security awareness programme can drive real behaviour change and engage employees on a personal level.
Show the value of good information security behaviour.
The number of people in your Information Security team equals the number of employees in the business. In which case, you may have a lot of people to make aware of good information security behaviour.
Technology can reduce risk and eliminate certain threats, but it cannot prevent an employee from clicking a malicious link or bypassing physical security controls.
Given this, it makes sense to place people at the heart of your information security approach. In essence, you are aiming to change behaviour.
“What? I’m not a behavioural change psychologist!” I hear you cry. That’s ok, you don’t have to be.
What you must do, however, is take a structured approach and involve employees from the outset.
The marketing approach - define the value
There are as many definitions of marketing as there are fish in the sea, but the more universally-received ones revolve around value.
One definition I particularly like is: ’Marketing is systematically communicating your value to people’, where ‘value’ is the positive impact your product or service can create in their lives.
In the information security world, we need to demonstrate the value of good behaviour to our staff. We are seeking to bring about behavioural change by demonstrating the value of that change to the individuals concerned. So, what strategy should you adopt, what pitfalls must be avoided, and how do you achieve this desired outcome?
"Marketing is communicating your value to people - so define the value."
First off, define the value. This can be divided into value to the company and value to employees, both at work and at home.
Value to the company is reasonably straightforward. If information is cared for properly and there are no breaches, there will be no service/production interruptions (with their associated penalty costs), brand reputation damage, loss of business, regulatory fines, legal settlements and so on. The company’s bottom line and ability to look after its employees are maximised.
For personal value, we must take information security into employees' lives. Make it clear that good information security behaviour at work can be taken into the home, creating and securely storing strong passwords, avoiding scams and not clicking suspicious links or attachments, to name just a few examples.
Now we are talking to people on personal subjects, we immediately increase their engagement. Using themes related to their family, banking, and online shopping shows that every information security behaviour they adopt makes them (and their family) safer, saving them time and money.
With online shopping and auction fraud costing UK consumers £61.8 million across more than 58,000 reported incidents, the importance of staying vigilant online is clear.
How to engage your staff
The message is simple: placing value on your data and adopting secure online behaviours will save you from inconvenience at best and financial disaster at worst. But how do you get this across?
The approach does not need to be complicated. Go back to your Marketing and Internal Communication colleagues (they may be the same) who daily take their audiences on a journey. Plan an awareness campaign that uses multiple channels, including face-to-face training, videos, e-learning and internal communications.
From working with our clients, we see videos that re-enact real-life scenarios generate a huge impact. There are plenty of examples on YouTube of phishing campaigns, people giving away passwords, hackers secretly obtaining personal data and so on. The trick is to make it personal. Any content that makes someone think: “Wow, I would have fallen for that,” or “I’ve done that,” is priceless.
"Real-life scenario videos that elicit: 'I've done that!' are priceless."
Being a little more clever, you may want to segment your staff and create content for their specific situation. For example, we find that younger age groups can display less secure behaviour in password management. Or you may want to bring to the attention of your older staff the dangers of fraudsters attempting to steal pension pots. Consider what you know about your staff and tailor content accordingly
Emphasise the benefits of secure behaviour
As I hope you have gleaned by now, the success of helping people understand the benefits of good information security behaviour boils down to common sense.
Content that feels relevant is more likely to capture employees’ attention. Reinforcing it regularly across appropriate channels helps turn awareness into lasting secure behaviour.
Dialogue and education are what it’s all about. By taking a few leaves out of the marketing communication playbook, you can appeal to and – more importantly – grab the attention of your employees, opening their eyes to how they can benefit.
So, while your Information Security team equals the number of employees in the business, using the expertise and knowledge from your Marketing and Communication teams can enable you to reach those parts of the business that are often untouched.
