Frank Cannon To Educate IFSEC Attendees On Employee Security Awareness Program

A security awareness program is an educational process to help employees  observe events or people through a “security lens”

Organizations have a duty of care to protect their employees wherever they work. But in the increasingly complex world that we all live in, the ability to deliver a risk-commensurate and cost-efficient security program that adds real value to a business is extremely challenging, according to IFSEC International 2016 speaker Frank Cannon. He will be speaking on developing an employee security awareness program in the Security Management Theatre at IFSEC International in London on 23 June.

Benefits And Challenges Of Security Awareness Programs

SourceSecurity.com: In what ways does a good employee security awareness program add value to a business?

Cannon: Simply put, it increases the number of people within an organization who behave appropriately to safeguard the workforce and protect its property. Through enhanced vigilance and informed awareness, the employees identify and report suspicious conditions or people at the earliest opportunity, so triggering a proportionate response by others. This early notification helps to minimize the negative consequence of crime and thus saves money. 

SourceSecurity.com: Why is implementing an employee security awareness program such a challenge?

Cannon: To be effective, a security awareness program must have the support of senior executives and then resonate with the workforce. It is necessary to identify a series of key security messages that are consistent with the security risks, but that also echo the organization’s beliefs and vision statement. The pitch, tone and proportionality of the security message must complement the day-to-day working culture of the target audience. There is no one-size-fits-all program that can be used to create a security culture, but more there’s a need for a cognitive process that requires an informed approach to harness the views of numerous stakeholders. Once initiated, the program must adapt to the changing work environment and security risks.

The challenge is convincing leaders to invest funds based on the likelihood that an undesirable event will have a negative impact on the business and/or convincing the workforce to change their behaviors to minimize the impact of such events.

Logistics Of Security Awareness Training

SourceSecurity.com: If all employees are effectively part of the wider security team, how do you distinguish between their roles and those of security professionals?

Cannon: A “team” is a group of people with a common purpose; in this instance, the purpose is to safeguard all those within the team and to protect the property they use or own. Communication is the essence of good teamwork and by encouraging each and every member of the team to observe, listen and communicate, it allows others to take appropriate action to address any fears or concerns. Non-security professional members of staff become the “alarm” or information gatherers, leaving the security practitioners to respond or analyze and plan. 

SourceSecurity.com: What does a security awareness training program look like? 

Cannon: My belief is that “training” is a process to develop skills or practical ability, whereas “education” is the giving and receiving of knowledge or theoretical competence. A security awareness program is an educational process to help employees observe events or people through a “security lens” and help them recognize an abnormal situation that may place people or property at risk.

Initial inductions, promotional courses, trade training, team meetings, periodical workshops and quarterly town halls all provide good platforms to engage workforces

SourceSecurity.com: What are the main elements of such a program?

Cannon: Prior to the development of a security awareness program, the security threats and associated risks against the organization, its workforce or its assets require assessment. You then have to create an integrated security program with a proportionate blend of physical, technical and procedural elements. The security procedures set out behavioral expectations for employees, so that a pre-determined outcome is achieved. Only then can an employee awareness program be developed to communicate with the workforce. 

A program consists of numerous methods (or tools) to communicate security expectations to active participants. These consist of key messages, each of which amplifies specific issues that, when put together, help to create a security culture. This isn’t a tangible asset or outcome but more a way routine business is carried out. Key messages are developed with the support of stakeholders and should complement an organization’s culture, beliefs and operating processes. 

SourceSecurity.com: What format does the training take (classroom/online/reminders/refreshers etc.)?

Cannon: Security education is a continually evolving process that takes advantage of opportunities as they appear. Initial induction, promotional courses, trade training, team meetings, periodical workshops and quarterly town halls all provide good platforms to engage the workforce.

The location, audience, time available and importance of the security message often dictate how and when the security awareness program is delivered. This can range from regular (3 to 5 minute) “security moments” at the start of routine meetings, to a full day workshop involving larger audiences. A tradesperson with little access to a computer may benefit from a “toolbox talk” at the start of the day, whereas an office worker may learn more through an online e-package. For those with time – or for the more important security risks – a workshop or standalone meeting may be the most appropriate forum. Alternatively, a well-designed poster may successfully convey the simpler messages. 

The critical element of a security awareness program is that the message being communicated must be relevant, important and personal to each person. He or she must identify with the message and understand a personal benefit for changing an otherwise acceptable behavior to help increase the levels of protection for themselves, their colleagues or the property they are responsible for. 

Effective Physical And Cyber Security Awareness

SourceSecurity.com: Does the security awareness program include information security as well as conventional physical security?

Cannon: If the organization, its management or the security risk assessment identifies a cyber risk that requires employees to behave in a specific way, then information security can be included in the program. Anything that adds to the protection of personnel or assets can be included, including health and safety, environmental or community interaction.  

SourceSecurity.com: How can you measure the effectiveness of such a program?

Cannon: This is challenging and is often why organizations tend not to invest in security awareness programs. I often say that the success of my program is when I have leaders or supervisors discussing personal safety or asset protection as part of routine business. An organization with an effective program (or security culture) has security as part of its operational planning process, listed within job descriptions and part of its meeting agenda items.

Success is when employees are routinely reporting suspicious people or events, where employees are willing to participate in workshops or practice drills, where they change their behaviors based on advice received and where they seek out security awareness materials for use within their own teams. The ultimate goal is to have an incident- and injury-free working environment so that the incident statistics support a downwards trend. The security risk level can change overnight, however, so incident trends are not always a true reflection on the success of a security awareness program.