Translated from french · 2026

This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →

Behaviour Management and User Education

It's easy, even too easy, to think of IT security as something purely technical, a matter of applying configuration X and policy Y and declaring the situation under control. Perfect security can exist, but it remains an illusion because it has to make compromises to provide a usable work environment, which requires freedom of access, as Bruce Schneier points out in his articles (for example, this one) and as shown in this diagram:

There are standards for that, you say... great, that's simpler, less hassle in terms of training and knowledge transfer. Up to you, but to better grasp the issues surrounding these compromises, there's no harm in understanding what's at stake by building a security policy from A to Z

First, a few questions:

What do users absolutely need in order to work?
What do they need to maintain a certain level of productivity (if we're willing)
What is simply harmful to security and needed by nobody?
What assets do we have to protect?
How important are these assets to the organization or company? (build a scale so you can quantify/qualify)
Quantify the risk for each asset (or look at the flip side: how important are these assets, negatively or positively, to the other players around the organization/company (competitors, [disgruntled/malicious] employees, hackers, organized criminals))
Who holds responsibility and accountability for such decisions?

Obviously, there are many more questions, but that's already a good chunk. Based on such an analysis, measures need to be put in place, either technically or in a politico-ethical way. If you take the technical route, there are costs, time, knowledge and resources to think about. In the politico-ethical case, it mainly takes follow-up, trust, training and education.

Users will always want ease and freedom, while executives and administrators will instead care about security and minimizing the work required. How the 2 factors are balanced will vary from one organization to another, as will the decision to implement everything technically or in a politico-ethical way. Let's look at how to approach implementing the latter:

Training, Education, Procedures and Policies

In a well-secured (or over-secured) environment, users will generally complain about complexity, wasted time and frustration while constantly expressing their incomprehension of the situation. It has to be said that they're normally not included in the related decision-making, which can only increase that feeling of incomprehension. By informing them about their workplace and the culture around it, you increase their interest in protecting the organization and its assets.

Through information security policies, an organization's management reflects its long-term strategic vision as well as part of its culture and ethics. We're talking about guidelines dictating the right ways of doing things, best practices, and behaviours to avoid that could damage its image and public integrity. They clearly define who is responsible for what in the organization, and if there are processes that could affect the organization's image, procedures mitigating the risks and their potential impacts are spelled out. Various examples of policies: passwords, remote access, file transfer, transactions and handling of personal/confidential information, granting of access rights, etc.

Clearly, anyone with access to a computer network has some responsibility and duties stemming from such policies. Generally there's no problem getting the organizational elements of a policy across, but as soon as it gets technical, some users will take the easy way out - pretend not to understand or ignore it. If the users in question know there are no consequences at the end of the day, it doesn't make them accountable in any way and they won't give a damn... That applies to procedures as much as to policies: you have to enforce them and apply consequences according to how important it is that they be followed. Procedures, whether hyper-simplified, complex, technical or long, must be justified, explained, and their application followed up. That can be done through training, awareness, tests or demonstrations.

A common problem, which applies as much in this context as to parents raising their kids, is that we pass the responsibility ball back and forth far too often, and in the end the outside impression is that nobody cares. Once again, they have to be strictly enforced, and who decides what and how to apply it must be explicitly defined.

Identifying widespread bad habits is a form of follow-up that can give good results, and an appropriate response would be training, awareness or a demonstration. Of course, technical measures can be used to force change, but the average user won't necessarily understand any better...

What has impact is a demonstration where users are invited to spot the difference: on one side, a scenario with a user not following procedures and on the other, a user following them, and in both cases someone trying to take advantage of a lapse in vigilance. Then come the related consequences, and you ask the audience what they think and what they understood. For example, a password policy that's misunderstood and neglected, and users complaining that it's too complicated to have a password with at least 2 charsets and 8 characters. At one demonstration, after a risk agreement was accepted, live cracking of passwords was requested: ask participants to type 2-3 passwords and remember them because they'll have to retype them in 10 minutes. Once that time is up, you start the cracking and explain what's happening on screen... it's not unusual to reach a 90%+ rate of cracked passwords, but what's really worth it is seeing the participants' reaction, and then you re-explain the procedure and policy on the subject - guaranteed results. You also need to think about the ethics of demonstrations, to be clear and avoid any problems.

Too few organizations enforce their rules, and they don't take the time to explain them.... yes, maybe there's high staff turnover, but that's not a valid reason... demonstrations can be recorded on video and made available on the Intranet, plus short clips can be shared (an Intranet isn't just for posting news that interests 5% of the organization or announcing birthdays...). Might as well build it all into the organization's culture and the work atmosphere!