In both John's and Joyce's cases, the theme of security awareness may be focused on PCI DSS compliance. There are many ways to deliver security training, such as posters, newsletters, e-learning or teleconferencing, in-person workshops, or hands-on tutorials. NIST SP 800-50 Building an Information Technology Security Awareness and Training Program and PCI DSS Best Practices for implementing a Security Awareness Program are two good references for building a security awareness program. Here, we discuss some of the key points to consider when delivering a security awareness and training program with an organization.
Sending newsletters is considered to be one of the most cost-effective and common practices to target all employees across business units. What can be even more effective is to look at a real example or case study that relates...