One of the challenges with creating a high-impact security awareness program is how do you reward good behavior? Obviously enforcement is important to any awareness program, but at some point we need to combine that with positive reinforcement. However this is not as simple as it seems, it turns out rewarding good behavior can have bad results. For example, lets say you want to promote the reporting of incidents. You educate your employees the indicators of compromise and how to report them to your security team. To promote this, you decide you will give a free lunch to anyone who detects an infected computer. While at first this sounds good, in two weeks you will most likely have every employee surfing dodgy websites and downloading free screensavers in the hopes of getting infected. Your reward changed behaviors, just not the ones you wanted. Another challenge is cost. Lets say one of your employees gets hit with a social engineering phone call and your employee does the right thing. They identify the attack for what it is and report the attacker to your security team. To reinforce this behavior you immediately reward the employee a $50 gift certificate. The problem is you have now set precedence. Anytime an employee spots a real attack they will expect to get paid a reward. You can quickly bankrupt your awareness budget. The trick to rewarding is making sure you motivate the right behaviors while keeping your budget in check. Here are some tricks.
- Rewarding behavior does not require material goods, public recognition can go a long way. I know of several organizations that post an example of an employee doing the right thing with their monthly security awareness newsletters.
- If you do want to hand out a reward, keep it small. One organization I know does nightly desktop checks at the office, making sure computer are locked and sensitive materials are securely stored. When they find violators they take note. However for those who are doing the right thing they leave a jelly bean at the table. The next morning employees come in and find their reward. Little gifts like this can really have an impact.