I’m in the process of updating the case studies for the 2-day class I’m giving…TWICE…in the next few weeks, “Information Security and Privacy Convergence and Collaboration.”
First in Grand Rapids, Michigan, hosted by the Michigan InfraGard and the West Michigan Chapter of ISACA on November 12 and 13.
Second immediately following the CSI Annual conference in National Harbor, MD (just south of D.C.) on November 20 and 21…
To get a $100 discount on the CSI class, enter the code, “WSRHCG” on your registration form.
We have had many of the class attendees tell us that they found the case studies to be very valuable, and several indicated they were going to start doing such case studies within their own organiztions since they found them so effective.
And I agree that case studies can be a very effective learning experience.
Unfortunately, too many organizations, and external classes, do not use them.
Consider using case studies in the class room training you provide to your targeted groups, such as call center staff, marketing and sales folks, IT folks, and others. Interactive case studies engage the mind in ways that more passive computer-based training modules can, and allow your participants to practice activities and and collaborate with their peers during the case study activities to build stronger team connections.
I have written about case studies on this site several times; for examples, see “Creating Effective Case Studies for Information Security and Privacy Training” within the May 2008 issue of IT Compliance in Realtime Journal.
I also talk about case studies multiple times throughout my book “Managing an Information Security and Privacy Awareness and Training Program.”
Here’s one of the excerpts from that book, pages 232 – 233:
“Case Studies
Using real stories and case studies are wonderful ways to engage the participants and to obtain their participation, and attention, and to enrich their learning experience. Use such activities to provide reference points and memorable images to help reinforce the topic.
You can use either real or fictional situations and accounts for your case studies. I find both to be very effective. Real stories are by default highly credible because they have actually occurred. When writing fictional situations, be sure to base the account upon an event that has occurred, which you are modifying to preserve confidentiality, or prevent liability or slander. Or, be very sure that a completely fictional account is absolutely
credible.
What is nice about case studies is that you can include in them information that is normally given in a lecture format. Case studies present nice opportunities to present abstract information in concrete ways. Usually, the biggest challenge in using case studies is finding or creating the case study, or studies, to use in your training session that best fits your training program, topic and audience. Here are some pointers for creating case studies:
Identify in your training session the key issues, concepts, messages, etc., that you want to get across to the participants.
Interview employees at different levels in the organization prior to creating your case study. Collect war stories about situations and incidents related to the topic.
Discuss war stories and incidents at seminars and conferences with other attendees as you are networking. Use generic versions of these situations, to retain confidentiality as necessary, as the basis of case studies.
Brainstorm, either alone or in a group with some of your key contacts or teammates, the types of situations that exemplify the topics you are covering.
Choose one or a few of the situations that seem the most realistic and with which the target audience will identify.
Write a draft description of the case study scenario and ask a trusted colleague to read it, as written and without any more explanation from you, and get feedback. Are there portions that do not make sense? Does it clearly relate to the topic you are teaching?
Rewrite the case study based on feedback.
Create discussion questions for your target audience based upon the case study. If possible, include graphics, photos, or other types of visuals that can add to the impact of the case study experience and make it more realistic.
It is very effective if you have the opportunity to simulate the case study on a video, an interactive CD, etc.
Prior to the training session, in the training announcements or invitations, ask participants to send you examples of situations they have actually experienced, and use these as the basis for case studies. Keep in mind that this will require you to be able to quickly form a case study structure to use as part of the training.
See Appendix V for some sample case studies. See Chapter 19 for case study discussions from leading information security practitioners.”
Oh, and regarding this book, I was very pleased when my publisher just asked me to do an update for a 2nd edition of the book! 🙂
Let me know if you have any suggestions for what I could include in the 2nd edition.
Tags: awareness and training, case studies, Information Security, Infragard, ISACA, IT compliance, IT training, policies and procedures, privacy training, risk management, security training