Security Education, Awareness and Training: From Theory to Practice

We promised you we'd give you some theories and models to work with, and now you're going to get them. These items have been stolen from the fields of motivational psychology and organizational behavior. If you study these theories in college courses, you'll find that some of them get awfully complicated as the experts and researchers tuck in all sorts of ifs, ands, and buts. We've stripped them down to the basics so they'll be easier to understand and put to work. For each theory and model, we'll give you a few ideas about how you might find them useful. Keep in mind that the purpose of these theories and models is to give you tools for understanding what's happening on the motivation side of your security program and figuring out possibilities for what to do about it. We've found these tools valuable in our own work, and we hope you will, too.
First, let us remind you of something we discussed in an earlier chapter that is vitally important to what we're going to be working with here. It's the basic truth that people react to their perceptions, not to reality. Consider this scenario: I'm getting ready for my morning walk. The weather forecast the night before predicted subfreezing temperatures. I look out the window and it looks cold out. (How does the weather "look cold"? I don't know; it just does.) I perceive that it's cold out and act accordingly by putting on...