...
- Initial security training: getting acquaintanced with rules and regulations. Initial training will be specific for a role or function.
- Repeat security training: on a regular basis repeat parts of the initial training and get more indepth in depth training on specific subjects, related to a specific role or function.
- Regular security awareness training: repeated security awareness activities on several generic and actual subjects, a mix of high- end low-intensity
...
After initial training all people involved should have a repeat training on regular intervals. These might cover the same subjects as the initial training but ideally go into more detail or tpouich diffenrent touch different subjects or the same subjects from a differnet different angle. Just as initial training repeat training must be focused on teh targetted the targeted audience. Some training might be generic for all involved, some repeat training will be subject and role specific.
...
For awareness raising and maintaining several methods can be used. Security awarenss awareness mostly means an adaption of behaviour and this is a difficult thing to achieve. Mostly this inviolves involves repeating a message and repeating it in different ways, with examples or with background information. Security awareness should be addressed at multiple scheduled and unscheduled moments using multiple methods. It can be in the format of classes, with posters or gadgets, but also integrated in other communication, like normal staff meetings.
...
Trainings can be in different formats. A training plan should use multiple formats and were possible training materials should be available for review after training. Of course the format mostly is already choosen by training content supplier, hoever however when you have a hoicechoice, choose different formats to make is more interesting for the trained subjects. Most used formats are: training classes, workshops, simulation sessions, books and other printed material, websites and wikis, MOOCs and other e-learning systems, games, instruction videos, recorded talks and presentations.
...
Security training and awareness is the responsibility of everyone involved. The system owner should make sure there is an actual training plan in place and that it is used accordingly, and allocate funding or decide upon financing.The system owner will designate roles for executing teh the training plan and the actual training activities. Thsi This can be a dirstibuted distributed role though it should be coordinated.
Funding
Hiring a tutor or buying tdaining training materials will need budgets. As part of teh the high level training plan a E-infrastructur eneeds infrastructure needs to define howsecurity how security training an awareness is financed. When it is not funded from the E-infrastructure budgets clear appointments must be made on how will take which part of the costs.