A common challenge for an effective security awareness program is continuously reaching out to employees/staff in a fun and engaging manner. Training people once a year may keep auditors happy but will not change behavior. As such, you always want to be thinking of different ways you can reach out to people. The new hire process is a great place to start. While "new hire" training is the first thing that comes to mind, there are other options to consider. For many organizations, one of the first steps in any new hire process is delivering a new computer and/or mobile device to the new hire. With that new hardware why not include a simple handout explaining how to keep that hardware secure. This is even more helpful for organizations that have remote employees and the IT team cannot deliver hardware or train people in person. While some organizations already do this, the key to engagement is how the handouts communicate their lessons. Do not state nor focus on employees must follow these steps to keep THIS device secure or keep the organization safe. Instead, explain that these steps will keep any device secure, that the employee should not only follow these steps at work but at home. In fact, why not make the handout family friendly, something that employees will want to post at home or share with family and friends. Quite often with security awareness, its not what we are teaching that is the problem, it is HOW we are teaching that is the problem.
