Getting the most from training sessions: the art of raising security awareness without curing insomnia

摘要

When an organisation finds itself in the position of having to raise staff awareness of information security issues, whether due to customer requirement or internal drive, the standard approach is to use traditional formal training. This is done even though we know by personal experience that the ability to pay attention in presentation-based training is rather limited. In fact the average attention span in the UK and the US is about eight minutes. Even among students who can reasonably be thought to be interested in the subject, there is a significant dip in attention span after 20 minutes. Surely staying interested through hours of presentations on the organisation's security policy is too much to ask?