2KKUU7ita

336
Part VI: Ethical Hacking Aftermath
Instilling a Security-Aware Mindset
Your network users are often your first and last line of defense. Make sure
your ethical hacking efforts and the money spent on your information security
initiatives aren’t wasted because a simple employee slip-up gave a malicious
attacker the keys to the kingdom.
The following elements can help establish a security-aware culture in your
organization:
✓ Make security awareness and training an active and ongoing process
among all employees and users on your network, including management
and contractors. One-time training such as when employees are
initially hired is not enough. Awareness and training must be periodic
and consistent to ensure your security messages are kept at the top of
people’s minds.
✓ Treat awareness and training programs as a long-term business
investment.
Security awareness programs don’t have to be expensive. You can buy
posters, mouse pads, screen savers, pens, and sticky notes to help
keep security on everyone’s mind. Some creative solutions vendors are
Greenidea, Inc. (www.greenidea.com), Security Awareness, Inc. (www.
securityawareness.com), and The Security Awareness Company
(www.thesecurityawarenesscompany.com).
✓ Get the word on security out to management! If you keep members of
management in the dark on what you’re doing, they’ll likely never be on
your side. I cover getting security buy-in in Chapter 19.
✓ Align your security message with your audience and keep it as nontechnical
as possible. The last thing you want to do is unload a bunch
of geek speak onto people who have no clue what you’re talking about.
You’ll end up with opposite the desired effort you’re going for. Put
your messages in terms of each group you’re speaking to: how security
impacts them and how they can help.
✓ Lead by example. Show that you take security seriously and offer evidence
that helps prove that everyone else should, too.
If you can get the ear of management and users and put forth enough effort to
make security a priority day after day, you can help shape your organization’s
culture. This can provide security value beyond your wildest imagination.
I’ve seen the difference it makes!