I was going to ask about how to educate users, but now that I think about it, I

Question

I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all.

Are there any amazing success (or horrible failure) stories floating around about user education, and different approaches thereto? Any statistics on whether companies that attempt to educate their user base about computer secure are, in fact, less likely to suffer a major compromise?

My own experience is that people are often unwilling to alter their usage habits - especially more knowledgeable end users, who assume they know enough to avoid compromise. But my experience here is pretty limited, and based mostly on home/desktop use rather than office/workstation. I'm interested in hearing how this stuff plays out on a larger scale.

Explanation / Answer

I cannot answer for others but in my own personal experience as an admin I have seen mixed results. When I created a security policy for a company a few years ago, which included basic password rules--

I ran into a few very angry people who wanted their password to be 'password' or 'password1' or their last name and sent me emails for a couple of weeks or more refusing to change it. Our company deals with many locations in and around the continental United States and that was not acceptable of course.

I had to then tell them I would set it to a very bad list of alphanumerics... which I sent them... and which got them to give me a better one.

I did not bother asking about anything else, I just had to do what I could to encrypt and otherwise secure information on our servers in the background, which was of course a good policy anyway. There is an automation available but more than that is tough to handle for people who don't know or care for the importance.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.