Users continue to prove that security is about much more than technology. Many people talk about how it will take more than firewalls, AV, IDS/IPS, ACL's, and other technologies to secure our home PC's, our networks and the internet. As long as there are people using these resources then there will be security issues. Why? Because people continue to either ignore or not care about basic security.

There are at least 2 articles this week on major news sources that highlight this. The New York Times has a technology article here that talks about a paper (here) that is being written for the IEEE Symposium on Security and Privacy in May. The other is a InformationWeek article that talks about workers ignoring basic security principles. I'll let you read them yourself and you can read more on them here, here and here.

I've written before about the need for better Security Awareness Training and I'm working on some things that I hope will evolve into something that will help make this a reality. One of the things that I'm doing is networking with some others in the security world who also care about SAT and who want to do something about it. Now that I'm finished with my latest project I'll have more time to put into this and other things. These will involve not only what will hopefully be more interesting SAT programs, but also working with Management to change the culture within organizations to make Security Awareness part of every day and not just a once a year or so. As security issues make more headlines and as companies have to start taking responsibility for their actions or inaction's in regards to security SAT will have to take a more visible role in the company. This will open doors for those of us who want to make a difference to be able to introduce new concepts that can make a difference. I know that today compliance drives much of this, but I think that this will change. Doing a SAT program that just meets your compliance needs may work today, but in the future compliance won't drive this survival will.

I also believe that before we can really make a impact on the user community we have to make a impact on the IT community. There are too many people who work in IT who don't get security. The TJX breach and many others give us examples of this. End users won't take security at work seriously until those in IT do. So Security professionals have to work with all departments to ensure that security basics are understood and implemented. This isn't easy in many companies because each department likes to be self-sufficient and not questioned by others, but this has to stop or the bad guys will find a way in and will win.

In my opinion Security Awareness Training has to be a priority for companies. They have to look at all aspects of their business and figure out how users can make it less secure and then implement a plan to mitigate this risk and teach our users something that will help not only they company but also their homes and the Internet as a whole.