How communications can unlock the solution to information security In today's connected world, protecting business critical information is a key challenge for most organisations. While there is an increasing number of technical systems available that aim to make organisations more secure, the key to data privacy lies in employees' behaviour. Fostering the right behaviour can be challenging as information security tends to be seen as tedious and yet another addition to a busy task list. If communicators approach people with a waging finger listing all the things they mustn't do, there's a risk employees simply won't listen. Swiss bank UBS has taken a different approach by joining the Think Privacy consortium and running an internal awareness campaign that highlights correct behaviour – instead of telling people what they might do wrong – making employees the solution to information security. In this case study presentation you will learn: How communications and technical solutions can work hand in hand to increase information security. How you can bring a seemingly dry subject to life by changing the focus and making employees the solution. What obstacles you may face when developing a campaign across a global organisation (and how to overcome them). The benefits of introducing a separate brand to make your communications stand out.

1. Communications & Branding Public
Engaging employees
for information security
Christoph Ruedt
UBS Communications & Branding
Simply Summit, London
26 April 2012

2. It's about enabling a secure culture
Information security
Foster
Technical understanding
controls and correct
behavior

3. The Think Privacy consortium
• Founded by major players in the financial and
professional services industry
• Members benefit from the experience of other
large firms that deal with similar issues
• Use of an external brand to increase visibility
and make sure the campaign has an impact
• A way to establish a sustainable communication
platform

4. Two step campaign approach
1. Establish importance
2. Inspiring action

5. Interactions between campaign elements
Intranet site
Posters Intranet banners
Editorial content PDF leaflet Interactive content
(quiz / mini game)

6. 5 tips to make information security communication engaging
1. Think of information security as an ongoing effort – not a
one-off campaign
2. Make your people the solution – not the problem
3. Present information security an integral part of your
business, not an add-on
4. Make the link to people's own personal data privacy
5. Create an internal brand or bring in an external brand to
label your information security communications