I’ve been tasked with planning an improvement to internal security, I want to start with some fundamental tasks that are free to implement such as clean desk policy, complex password enforcement etc. But I’m wondering, as I lack experience in a project like this, how we go about expanding on the basics? Are there any recommendations for additional things we can do which are simple to implement and/or free that go above what we would class as the “basics”. Also, if anyone has experience managing an internal project like this where the goal was to create a security culture while improving systems/educating users would you have any tips that you would suggest?
I know some of the above detail is pretty vague, but if the end goal is what’s mentioned above and you’re tasked with achieving that, how would you plan, what would you include and how do you deliver that? i.e getting the employees to “buy in” to this new culture you’re trying to implement.
Thanks in advance.