In the previous article we talked about Metrics, and in this article, I will conclude this series on Building Security Champions.
A few more tips:
Start by defining the focus of your program and what is expected from champions. Be realistic; you can only expect 1-4 hours maximum effort from them per week.
If someone is taking a security course, but they are not on the security team, they may make a good champion. Reach out and introduce yourself.
If the mantra of the security team is “it's my job to help you do your job, securely”, “you're my customer” or “I'm here to serve you”, that is very attractive. If your team is known as ‘the ministry of NO!', you will have difficulty attracting volunteers until you turn over a new leaf.
Record every group session and save them. Create an on-boarding set of champion videos from these recordings, so you can auto-onboard new champions. Some of the videos can also be used to on-board new software developers or other IT staff.
Save all the videos so anyone who missed them can see them later. Offer up the list of videos to everyone at your organization, if appropriate.
Include a TTT (train the trainer) package so that your security champions can train their own teams as needed. For instance, if you want your champions to give training or talks to their own teams, have them follow your package. The package should contain 1) your slides, 2) demo information and instructions to set it up, 3) a video of you giving the talk/training, and, 4) a video of you explaining what you are trying to get across for each slide and the entire demo, spoken as though you are teaching someone to give the talk on your behalf. For an example of this, see mine!
PS… Feel free to give these talks yourself, at your own workplace.
Lastly, don't stop. Don't give up. Perseverance is the thing that will make this program work. As your program continues it will grow and the value you that you receive from it will also grow, scaling upwards over time. You and your organization can do this, all it takes is dedication and time.
Please feel free to email me with questions, or even better, tell me about your success with your own security champions program!
