Security awareness programs may seem like they should be easy to implement, but in reality, they require skills that most security teams don’t regularly practice. To help you on your way towards a brighter security future, we've identified three steps required to create an effective awareness program: 

1 - Create a brand: This is advertising and marketing 101. Plain and simple, you must use marketing concepts like branding and advertising if you want your program to be effective. Take the time to actually convert your security policies to three to five concepts and taglines that can be reinforced on a continual basis in a variety of media. Wrap those ideas around an icon, character or image and you just might have a brand. Branding sells products as well as ideas, concepts and security mechanisms.

2 - Reinforce the message: One you have your brand, think about how to communicate your three to five concepts. How can you repeat them to your target audience over and over again until they become mantra? Can you find ways to get folks to “opt in” to getting the message? Can you make it a part of their routine?

Whatever you decide, consider using prizes, surveys and multimedia to make it happen. The number one rule in this part of the process is to be creative -- if you stick with traditional posters and weekly emails -- you have an awareness program, but it won’t be an effective program. The more you can mix the media of delivery, the better. The more interactive you can make it, the better. Don’t be afraid to use humor, drama and hype to create effectiveness.

3- Perform ongoing assessment - Most folks forget this step. Don’t wait for your next audit to determine if your program is effective. Test it yourself, or work with a vendor. If you are not auditing your own resistance to social engineering, malware trickery and phishing, then you do not have a complete awareness program. Only through continual testing and ongoing feedback and revision loops will you succeed. Assessment is key to identifying what works and what doesn't.

That’s it! Follow these steps, continue to work on the program and it will be an effective mitigation to many threats. It sounds easy, but the real task is the creativity and ongoing effort to sustain it. That’s where you might reach out to your internal marketing teams, or form a working group with a vendor. The payback will likely be huge and more than worth the resources. Some security teams may even bring in marketing consultants or employ a marketing person full time to work on awareness. Things have come a long way since the days of policy reading and boring yearly PowerPoint presentations – thankfully!