Access Control and Identity Management, 3rd Edition

Training Employees

A well-trained workforce is a valuable asset in any access control system, especially when it comes to defeating social engineering tactics. Employees cannot be expected to respond appropriately to security situations if they have not been trained in the proper way to handle them.

Simply handing a new hire the employee handbook and expecting him or her to read the sections on security policy is not enough. A good security awareness program should:

• Be ongoing—Telling employees about a security policy once is not enough. Security awareness messages should be repeated and reinforced on a regular basis.
• Include multiple formats—Not every individual learns in the same way. Some people are better at processing written information, ...