Sending an email from an odd-looking address and seeing if employees open the email is one way to gage the relative wariness of employees. If employees open up the email, it staff can include a message warning them that this is just the kind of message employees should delete. Creating 'backdoor' threats and viruses to attack a system, and see if it is vulnerable is one potential 'fire drill' that can be used by the organization to assess potential areas that can be compromised. General assessments of the knowledge of non-it and it staff of proper security procedures and the areas which can pose new threats are also essential.

Simple systematic procedures, such as requiring employees to change their passwords on a regular basis, and having passwords screened for complexity, must be built into the system, as well as more complex tests of efficacy. To ensure that these measures are working requires formal audits, but also a self-critical attitude on the part of staff members in both technologically-related and non-technologically related jobs.

Q7. Keeping the information security program functioning and improving over time

Monitoring and quality testing must continue, but it must shift, change, and improve with the evolving security...

Maintaining a high level of education on the part of the security staff is essential, through retraining and also continuing the staff's education. Staff must receive constant exposure to the subject of new security threats by attending conferences and in-house training. Having a strong HR program to encourage top it graduates to join the security team is also essential. Proper financing for the it department to maintain its high-quality efforts is a vital.
A high level of technological literacy is desirable amongst all staff members. As well as being kept abreast of how to protect their departments and their own security, there should be a close relationship between it and other departments. Other employees should feel comfortable going to it staff to discuss potential security compromises.

Compromises to security can be injurious for the company and for staff members on a personal level. Incorporating a briefing regarding the need for high-level security into orientation and having 'retraining days' at the company makes security a natural part of standard operating procedures, not something that is only of concern when there is a breach. Employees should know the risk for YGT but also for themselves, if they are not vigilant.