Outline for training and awareness plan
This document describes the security training and awareness activities. The organization recognizes it is essential to have well trained users and support staff in order to achieve safe and secure operations of the infrastructure and the data on the infrastructure.
The aim of security training and security awareness is to make sure that everyone involved with the acquisition, design, development, use and management of the infrastructure has actual and accurate knowledge about security, security techniques, rules, procedures and regulations, and knows how to apply this in day-to-day operations and in emergency situations. Security training and awareness is crafted for a role or a function and can even be crafted on individual persons when they have specialized tasks.
Security awareness is a recurring effort. After initial training anyone involved with the infrastructure, and the data on it, will have to keep knowledge and experience with security up-to-date. Different subjects apply to different kind of users. This document defines the different training targets groups and what subjects they need to be trained on. It also gives an outline of a training schedule that can be used to adapt for different target groups.
Training Schedule
A typical training schedule has several types of trainings and looks:
- Initial security training: getting acquaintanced with rules and regulations. Initial training will be specific for a role or function.
- Repeat security training: on a regular basis repeat parts of the initial training and get more in depth training on specific subjects, related to a specific role or function.
- Regular security awareness training: repeated security awareness activities on several generic and actual subjects, a mix of high- end low-intensity
Most of the trainings will be held according to a pre-determined schedule. However the schedule should not be to tight: As a result of incidents there can be a necessity for ad hoc additional or repeated training.
Initial training
When someone start in a new function, a new role of starts using of managing a new system there should be an initial security training. This initial training gives all security details about the security aspects of the new role or function. It will make the new person acquaintance with rules and regulations, processes and procedures for both day-to-day operations and for emergency situations. This applies for both usage of systems and for acquiring, designing, developing and managing systems.
Repeat Training
After initial training all people involved should have a repeat training on regular intervals. These might cover the same subjects as the initial training but ideally go into more detail or touch different subjects or the same subjects from a different angle. Just as initial training repeat training must be focused on the targeted audience. Some training might be generic for all involved, some repeat training will be subject and role specific.
Security awareness training
For awareness raising and maintaining several methods can be used. Security awareness mostly means an adaption of behaviour and this is a difficult thing to achieve. Mostly this involves repeating a message and repeating it in different ways, with examples or with background information. Security awareness should be addressed at multiple scheduled and unscheduled moments using multiple methods. It can be in the format of classes, with posters or gadgets, but also integrated in other communication, like normal staff meetings.
Training formats
Trainings can be in different formats. A training plan should use multiple formats and were possible training materials should be available for review after training. Of course the format mostly is already choosen by training content supplier, however when you have a choice, choose different formats to make is more interesting for the trained subjects. Most used formats are: training classes, workshops, simulation sessions, books and other printed material, websites and wikis, MOOCs and other e-learning systems, games, instruction videos, recorded talks and presentations.
Maintenance of trainings and the training plan
Trainings and the training plan need to be maintained on a regular bases. It is a good practice to set up and review the training plan on a yearly basis. Based upon feedback from training activities trainings you can identify if there is any training module that needs to be updates or replaced, or if there are any subjects missing or new subjects have come up. There also might be new trainings available within the communities or commercial that can be a good or better alternative for existing training modules.
Roles and responsibilities
Security training and awareness is the responsibility of everyone involved. The system owner should make sure there is an actual training plan in place and that it is used accordingly, and allocate funding or decide upon financing.The system owner will designate roles for executing the training plan and the actual training activities. This can be a distributed role though it should be coordinated.
Funding
Hiring a tutor or buying training materials will need budgets. As part of the high level training plan a E-infrastructure needs to define how security training an awareness is financed. When it is not funded from the E-infrastructure budgets clear appointments must be made on how will take which part of the costs.