Whether you’re an IT admin, CISO, or even a dedicated security awareness professional – the challenge to communicate the importance of stronger passwords remains the same. But with anything you’re trying to sell, in this case – security, it’s all about understanding your audience, their needs, and getting their attention. Only then can you provide them with easy and intuitive tools they need to be successful in securing their data.
As the Senior Security Engagement Manager at LogMeIn, part of my job is running our Cybersecurity Awareness Month activities. Last year, we decided a key theme of the month would be ‘stronger password security’. We had multiple tracks all with a shared goal – increase our internal usage of LastPass. So, how did we do it?
We started with the LastPass admin dashboard which gave us a wealth of information to baseline our current overall password security posture as an organization. Using this information, we created a month-long contest with three types of winners: new active users chosen at random, employees with the highest security scores, and grand prize winners with the highest combined score (master password score plus overall security score) and the most ‘reacted’ to internal social channel posts. This variation gave everyone in the company an opportunity to win and increase personal and corporate security.
Partnering with Other Teams
Launching a company-wide initiative requires support from leaders and peers, so making sure the initiative aligned with our corporate goals was key to getting support and buy in. Furthermore, depending on the size of your campaign, it can take a mountain of effort – so don’t be afraid to ask for help. We shared the plan with our partners and engaged with LogMeIn and LastPass leadership to gain executive sponsorship behind the campaign and help evangelize our message. They were immediately bought in and even looking forward to getting involved in the contest themselves! This level of support helped us drive our program forward, and ultimately got employees even more eager to join in and create some friendly competition with senior leaders.
Our internal communications team guided us to leverage the internal, global, communication channels to advertise the contest throughout the month. Ensuring the message was spread across our internal social channels, email, company intranet site, mentioned in global all-hand meetings, and (pre-COVID) posted on office digital displays made it hard for our employees to miss. A helpful hint: share your Cybersecurity Awareness Month agenda with your comms and/or marketing teams early in the planning process.
Lastly, we recruited our IT teams to customize the ‘Welcome to LastPass Enterprise’ emails our new hires received. They were updated to include internal and external LastPass resources available to them and the support contacts to reach out to if they needed help setting up their LastPass account, etc.
If you are at a smaller business that doesn’t have dedicated internal communications teams, that’s okay! Ask team leads to send an email to their team members encouraging them to participate.
“Sounds great. What’s in it for me?”
In a recent survey, 14% of people said they take no action at all to protect their information online. As either a security or IT professional, we know security matters and should be our top priority. But how can you make this resonate with your employees? Maybe your employees are spending a lot of time managing passwords for their team and they need an efficient way to securely share passwords. Maybe it’s emphasizing the convenience of never getting locked out of their accounts because they forgot their passwords. Highlighting the benefits in your communications gives your employees the ‘why’ to get started.
As we saw an increase in new users adopting our password manager, they were eager to share their experiences and get their peers to join in. We created an internal Slack channel where employees could share how LastPass has made their lives easier. Giving them a place to share their stories boosted others interest to hop on board – the best testimonials always comes from your coworkers.
Leveraging LastPass Resources
The LastPass admin dashboard is a great resource to identify your current overall password security posture as a company and give you insights into trends about how your employees are using the tool.
LastPass offers a ton of helpful resources we were able to provide to our employees; things like one pagers on the LastPass Security Dashboard to help increase their Security Score, and how to use the LastPass Password Generator to generate secure passwords for you. We lined up all the benefits it has to offer and made sure to communicate those using the communication channels available to us. Also, LastPass provides a full Cybersecurity Awareness Month toolkit with ideas for admins to get employees engaged with LastPass.
We closed the loop on Cybersecurity Awareness Month with an email to employees recapping the months’ highlights, winners of the contest, and most importantly a recap of our adoption efforts and how they each played a role in helping to secure company data and their own personal information.
I hope this post can help with your Cybersecurity Awareness Month planning and has inspired some ideas for improving your employees’ online security behaviors.
