SCOTTSDALE, Ariz.—Employee security training, long considered largely ineffective, is improving due to some new and innovative approaches, says one analyst.
Security training “got a bad rap, because it was so bad,” Steve Conrad, the founder and managing director of MediaPro, a Bothell, Washington-based security awareness training company, told Third Certainty.
Conrad said that old training methods “usually consisted of slide presentations—or their online equivalent—that were super dull and could last an hour or two. Employees were expected to sit through this, either at their desks or in a group, and come away with knowledge gained. And that was it. Awareness training was once and done, and it just didn’t work,” Conrad told Third Certainty.
MediaPro, Conrad told Third Certainty, bases its training on proven adult learning principles, providing educational content in a way that learners remember. “This concept extends beyond the training courses themselves to our focus on consistent reinforcement of key learning principles through extracurricular content such as games, videos and posters, as well as phishing simulation exercises.”
As many security experts are now saying, employee training needs to be ongoing and not just a once-a-year event.
“Learners need to hear something more than once for it to stick—just ask any ad executive or marketing jingle writer,” Conrad told Third Certainty. “Think about what makes up an advertising campaign: a series of messages that share a single idea or theme, transmitted via different media channels on a regular basis, for an extended period of time—with the singular goal of influencing consumer behavior. A great security awareness initiative should look like a great advertising campaign. Repeated, consistent messages delivered throughout the month, quarter or year, whatever cadence is appropriate for a given organization.”