About Us | Contact Us
View Cart

The case against Dan Hadaway!

By Dan Hadaway | Monday, July 23, 2012 - Leave a Comment

The one thing everyone knows about me is that I believe firmly in Awareness Training.   I actually go so far as to declare that “awareness is 9/10’s of the battle.”  If you’ve ever been to one of my workshops, or if you’ve ever been audited by infotex, you’ll know exactly why we believe awareness to be key.


Security Awareness Training . . . . not?


However, as with any “mythology” about information security, we must be careful to understand the opposing philosophy.  [I would say you should be aware of the opposing philosophy!]

And thus, when I ran across “Why you shouldn’t train employees for security awareness,” I was intrigued.  As busy as I was, I still took time to go read the article!

And though it almost had a revulsive effect on me, I decided that you deserve to at least think about the position AGAINST awareness training.  Now, please know that I can rebut every point made in this article, though some of them do make sense, at least on the surface.  For example: our position is that the CISO can NOT have “meaningful authority” unless the management team is AWARE of this authority and the CISO’s role in protecting the business.

Still, the article does pull together “what organizations should do instead of wasting time on employee training” and I do agree that these are good ideas that should be prioritized as to-do’s right after you’ve polished your awareness training program!  In other words, they’re the other 1/10th of the battle!

 


The article, written by Dave Aitel of Immunity Inc, should only take a few minutes to read.  Be forewarned:  presenting this article in an audit will NOT mitigate compliance risk!

 


Dan Hadaway CRISC, CISA, CISM
Founder and President, Infotex

“Dan’s New Leaf” is a “fun blog to inspire thought in the area of IT Governance.”

 

Latest News
    Ransomware payments sent to countries under sanctions could result in fines… An article review. Whether or not to pay the organization behind a ransomware attack has been a hotly debated subject for many years, but a new advisory issued by the Treasury Department’s Office of Foreign Assets Control (OFAC) warns those who do pay up […]
    Welcome Webinar Attendees! You can download the deliverables by clicking on the link below. Boilerplates/Handouts Click here to download files.        
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Data by Rob Sobers, writing […]
    Thanks for being interested in our Technology Planning Webinars! This year‘s annual webinar on the subject will include a review of the previous years’ movies that are already available, and a discussion about alternative tactics that have arisen from recent virtual conferences and regulator panels. It’s not too late to register for the 2020 Technology […]
    Check out the Sponsor Video! We will be updating the video on YouTube in the coming days, but will include the credits so everyone is recognized for all their hard work. Like our Facebook, Twitter, and Subscribe on YouTube for further updates! Credits Producer: Bryan Bonnell “K0s$” Director: Sara Fultz Editor: Sofia Tafoya Wardrobe: Our […]