The first failure is to not have a proper security awareness program. If the users do not know what is in the infosec policies or what is expected of them as part of that policy, how does the organization expect these users to follow the policy? Unfortunately, most organizations either do not have a security awareness program or have one as part of employee orientation and they do not follow it up with refresher courses.

Having sound policies that understand that the insider is the greater threat, a solid security awareness program, a proactive security enforcement program, and a commitment from management are the keys in meeting this challenge.


What are your future plans? Any exciting new projects?

Not long ago, I contributed a chapter to Que Certification's "CISSP Training Guide." I wrote Chapter 3, Security Management and Practices. I have also been working with the SANS Institute to review some exciting new courses they will be offering. I am also working on a book proposal with a colleague. This should be fun!