] Strategy to ensure that staff maintains a correct attitude to security
Regular training should be held for all staff new and existing. Employees should be made aware of the council code of practice and should be encouraged to regularly look and follow its advice. The importance of following rules and procedures, and of being alert to possible breaches of security need to emphasized and understood. Threats should be taught and ways to deal and prevent threats should also be made known to all staff. Someone should be available to give all staff extra help and advice when they need it. Staff should be trained how to use virus protection software for every floppy and CD that they use.
Staff should be trained to regularly save their data and be taught the consequences of not doing so. Fite (1993) suggests that staff should not be employed until they have had sufficient security training first.
Staff should attend workshops that do role-plays that put employees in situations of security problems and to see how that act, they should be in groups so that staff can work together.
Explaining what happens to an organization, its mission, customers, and employees if security fails motivates people to take security seriously.
To encourage awareness staff should be provided with videotapes, newsletters, posters, bulletin boards, flyers, demonstrations, briefings, short reminder notices at log-on, talks, or lectures.
The first security issue that should be dealt with is promoting awareness. Often, users of a system are the first to notice and report problems. If someone notices a door to a server room is unlocked, you want that person to notify someone so the door can be locked.
Awareness is often incorporated into basic security training and can use any method that can change employee's attitudes. Burnes (1990)
Explaining what happens to an organization, its mission, customers, and employees if security fails motivates pe...