How do you encourage secure behavior?

1 Make it relevant

One of the key factors that influence people's behavior is the perceived relevance of the security issues to their own context and goals. If they don't see how security affects their work, productivity, or reputation, they are less likely to follow the guidelines or take the precautions. Therefore, you need to communicate the benefits and risks of security in a clear and concrete way, using examples, scenarios, and stories that relate to their roles and tasks. You can also tailor your messages and training to different audiences, depending on their level of knowledge, responsibility, and exposure to threats.

2 Make it easy

Another factor that affects people's behavior is the perceived ease or difficulty of performing the secure actions. If they find the security measures too complex, time-consuming, or inconvenient, they are more likely to ignore them or look for shortcuts. Therefore, you need to simplify and streamline the security processes and tools as much as possible, reducing the friction and the cognitive load. You can also provide clear and concise instructions, reminders, and feedback, as well as automate some of the security tasks, such as updates, backups, or encryption.

3 Make it rewarding

A third factor that influences people's behavior is the perceived rewards or consequences of their security choices. If they don't feel appreciated or recognized for their security efforts, or if they don't face any negative outcomes for their security lapses, they are less likely to care or improve. Therefore, you need to create a positive and supportive environment, where you acknowledge and reward the secure behaviors, and provide constructive and timely feedback on the insecure ones. You can also use gamification, incentives, or competitions to motivate and engage your staff, as well as monitor and measure their security performance and progress.

4 Make it social

A fourth factor that shapes people's behavior is the perceived social norms and expectations of their peers and leaders. If they see that others are not following the security rules or values, or if they don't receive any support or guidance from their managers or colleagues, they are less likely to adhere or trust them. Therefore, you need to build a strong and cohesive security culture, where you model and promote the security behaviors, and encourage collaboration and communication among your staff. You can also leverage the power of social proof, testimonials, or champions to influence and inspire others to adopt the security best practices.

5 Make it continuous

A fifth and final factor that affects people's behavior is the frequency and consistency of the security education and awareness activities. If they only receive sporadic or outdated information or training, or if they don't have any opportunities to practice or refresh their skills, they are less likely to retain or apply them. Therefore, you need to design and deliver a continuous and dynamic security awareness program, where you update and reinforce the security knowledge and behaviors, and adapt them to the changing needs and threats. You can also use various methods and formats, such as e-learning, webinars, newsletters, posters, quizzes, or simulations, to appeal to different learning styles and preferences.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?