CXO

Is end-user training a lost cause?

As everyone knows, the biggest threat to company data and computer systems don't come from outside forces. Unenlightened employees pose the biggest risk. But does end-user education forestall this risk? Take our poll and let us know how you feel.

Time and again we've seen data that indicate the biggest threat to business data and computer systems do not come from outside hackers or competitors; the biggest threats come from employees making dumb mistakes and using their computers and peripherals irresponsibly.

There are two schools of thought on fixing this problem. Those who believe end-user education is the key (if end users are made aware of the behavior that leads to security risks, they'll stop doing it), and those who think end-user education is a waste of time (the warnings go in one ear and out the other).

We'd like to take an informal poll to see which camp you're in. In this poll we ask if you've had success training end users. (By "success," we mean you have seen user behavior change for the better due to training you've conducted.)

About

Toni Bowers is Managing Editor of TechRepublic and is the award-winning blogger of the Career Management blog. She has edited newsletters, books, and web sites pertaining to software, IT career, and IT management issues.

20 comments
karl.beil
karl.beil

I don't have to deal with training people in the traditional sense. I don't teach them to use a system or application. I train them on how to use access a process or procedure. For example: How to get a quote for an item or how to get that item purchased. My organization has very specific procedures for these to tasks. I find that if you enable a behavior, such as allowing them to circumvent the procedure, they will continue to do so. If you consistently make them go back and do it correctly, they tend to catch on fairly quickly. In this sense, I tend have a reasonable rate of success in training people. The keys are persistence and consistency.

itvisionary
itvisionary

It is only a lost cause if the end user doesn't care about learning how to correct an issue or process. User training is never a lost cause, however with our ever increasing dependency on technology, it is inevitable that the majority of the population will gain deeper understanding of IT related subjects. My parents couldn't work a VCR 5 years ago, and now they use PSP's, send txt messages and own multiple computers. Time changes everything.

Chi-7
Chi-7

To be a good teacher is about as close to Divinity as any mere mortal can hope to achieve, to instill the inquisitive will to learn and better oneself can be a monumental task. The rewards of watching the light behind ones eyes click on, capturing that moment and making the student fully aware of their accomplishment can make a difference that will last a lifetime. Years ago I taught piano, bass and guitar, there was a universal rule, everything had to be stated three times in three entirely different ways. The years have convinced me that all people, regardless of intelligence or willingness listen with an accent. I still enjoy the challenge and take great delight in watching that light click on. I live in a world far removed from the large scale cooperate IT operations most of you live in and likely have more latitude in dealing with system inequities, operator traps, errors and indiscretions. Controlling the risks by tailoring work stations to the required tasks, uniform data entry fields and tab orders, requiring root privilege for removable media and hardware / software enforcement of browsing policy have been highly effective in reducing stomach acid. Wanna check your E mail, see whats new in Swedish XXXXXXXX videos? Thats what the 5 vanilla wood burning K-7's in the break room are for, better to rototill 5 hd's occasionally than 62 on a regular basis.

cssatx
cssatx

A lot depends on the industry. In HealthCare there is tremendous emphasis on HIPAA and SOX related security. However, general security tends to be viewed as an impediment to the real work ... patient care. That said, education is something that you can not afford to not do. It is an ongoing struggle and cost of doing business. It starts with creating a culture of awareness (already mentioned) but needs to continue using any and every innovative approach at hand. We have had the greatest success when we carry education on past the point of do's and don'ts to actually sharing detailed infomation about risks and practices. At that point you can begin to partner with users. Most people have home PCs ... education they recieve in the workplace can transfer to their home setting ... where they have a real vested interest. Tell them something they can apply there and the message will stick ... and stand a better chance of being applied in the workplace.

kevin
kevin

Training has to be continuous without being intrusive (which is a fine balance). And the security function needs to get buy-in from the line managers. The key is to create a culture of awareness, not just throw training at people.

Osiyo53
Osiyo53

Training is nothing more or less than the process of communicating. When training fails, MOST of the time, the responsibility for this rests with the one attempting to establish that communications. That is the trainer. After all, he or she is the one trying to initiate the act of establishing communications with the goal altering the behavior or actions of others. Note, I said "MOST" of the time. Not "always". There will always be some in the target audience (those to be trained) who are going to be pretty much a lost cause. Due to lack of interest, nursing a hangover from the previous night, having a stubborn streak and thinking more or less "I've always done whatever THIS way and it has always worked for me.", or similar personal issues. Of a kind which closes their minds to being fully receptive to the communications. But, by and large, it is the Trainer's responsibility to establish the communications, and to motivate the target audience to be open and receptive to the communications. To present the data to be communicated in digestible, understandable bits ... understandable to the target audience. In language, and in a style or form that THEY will understand. Too many trainers speak AT their audience, rather than TO them. Don't use technical terminology or introduce technical methodologies or concepts unless you first ensure that the target audience is familiar with such. If they are not, explain the terminology or concepts in layman's terms FIRST. And never, ever forget that you need to MOTIVATE your target audience to WANT to learn the info which you are presenting. It's the old, "What's the benefit to ME?" concept. They'll sit up and pay better attention, ask more questions for purposes of clarification, and so forth if properly motivated to want to learn the material. Proper training involves two way communications. If your audience is just sitting there quiet, you may well have a problem. Maybe not, but usually their silence is an indicator that they're not really thinking all that hard about what you are trying to communicate. ENGAGE them in two way communications. Stop routinely and ask one of them a question. For instance, "Sam, tell me in your own words what you think I meant by what I just said?" Or, "Julie, tell me what you think? Will this new procedure work? Will it help you get your job done better and easier? Can you see any pitfalls or problems with it?" And so forth. You're not only trying to engage their minds actively instead of just passively. You should also be testing to ensure that THEY understood the info you just gave em ... otherwise YOU have failed in your communications. Just some food for thought. The ideas I expressed above are all basic concepts taught in any good class on communications or educational theory. Yep, there are those who are just "dumber than a box of rocks", as one poster put it. And I've used that phrase myself. But the true facts are that the VAST majority of your target audience is probably just as intelligent and capable of learning as you are. So if they fail to learn, it is almost certainly primarily the fault of the teacher, not the student. Where I work, we have one fellow who does the majority of training to the end users of the systems and applications we install. The fellow is VERY bright, far smarter and more knowledgeable than I am about the technicalities of things. But he is often a poor instructor. He presents material from HIS perspective and level of knowledge. And expects that everyone understand the material presented, and the technical terms and concepts. Has no patience with end users who are unfamiliar with those things. So quite regularly, after we've completed a project and he has conducted end user training I find it necessary to later go through things once again with end users and explain the why's and why-not's of various things. Re-explaining things in language and using concepts that the end users can understand; that are meaningful to THEM. You know you've connected, and communicated, when you see their eyes light up and they say something like, "Ohhhh, okay. Now I get it. That's why it should be done like that!"; or "Hey, okay, I can see where that will help me ...."; etc. Then, after I get such a comment, I make em do whatever one more time just to make sure proper understanding is achieved.

Maevinn
Maevinn

The only end users I've failed at training are those who did't want to learn. It's a matter of persistance and being willing to find an approach that works for the end-user in question. I know that there are some things I learn best by reading, some I learn by watching, and some I learn by doing. Other people seem to be much the same, so it's a matter of tailoring the subject matter for more than one approach, and being willing to make changes as needed.

santeewelding
santeewelding

Assistant London metropolitan police commissioner Bob Quick relevant to your point?

CharlieSpencer
CharlieSpencer

It's like teaching any other skill. Some people can learn almost anything, some have trouble in one area but not in others, and some are dumber than a box of rocks. Those people outnumber the first two groups.

lgorbic
lgorbic

Proper training of end-users ought to be multi-dimensional rather that "do it just one way." Each of us is capable at doing something. Some of us are lousy with technology. By identifying the more capable end-users through basic training or through one-on-one interactions with them we might be able to make them receptive to helping their office mates by determining what organizational rewards might be available to them. Perhaps some time off, or recognition in org publication, or celebration meal on the town, etc. Some people really respond positively to proper recognition of their successful efforts. End user training ought not to be a drudge.

Editor's Picks