Proper Training: — How can training change behavior?

Nearly every organization that has reported having an information loss or breach since 2005 had some form of compliance and training measures in place. Taking a policy template, answering general questions, putting your name on it, then asking employees to sign it does not pass as employee training. Half-heartedly giving employees a couple of scenarios and asking them to agree to log off the computer, change their passwords, lock up, and shred will not ensure defendable behavior.

Training is needed on several levels to build a defensible position for any size organization. Initially, the individual or team in charge of assessing risk, facilitating design, implementing and maintaining the Identity Theft Prevention Program must be able to demonstrate a degree of expertise for managing information exposure. This includes a broad understanding of information law, prudent practice standards (of which technology is only a portion), program infrastructure, and methodology.

Once the Identity Theft Prevention Program is established, training for managers, employees, and sub-contractors must be relevant for their workspace and allow them to continue to perform their tasks efficiently. For instance, let’s say that all employees are asked to adapt a sixteen digit password, it must include letters, numbers, and symbols, it must be changed every thirty days, and the same password cannot be used twice in the same year. Sounds good, right?

While that may sound secure to some well-intentioned, security minded individuals, not all employees may be able to work efficiently under those parameters. They may write it down on post-it notes stuck on their monitors or under their keyboards. They may stop logging off of their computers when they leave their workspace. The point is that unless training is relevant to an employee’s work situation, they will circumvent security measures for the path of least resistance to productivity.

“A defensible position for training must be derived through a collaborative assessment of privacy, security, usage, and response practices, and must be relevant to each individuals work habits to change culture.”