The Balancing Act: Education vs Enforcement

Let’s face it – there are very few people in this world who like being told what to do. We often find that suddenly enforcing strict rules and big changes, in both social and working environments, is met with resistance. Questions arise: Why are things changing? Why should I care? What benefit does this have to me? The list goes on…

A good deal of human interaction is based around getting other people to do what we want, but it is the way we propose these changes that will reap the rewards in time and make that interaction a positive one. Positioning a new process, rule, or system into your organization needs to clearly highlight the benefits to the new users in order to get their buy in and cooperation. It’s a difficult balance to strike; knowing that a change is going to be made, and there might be confusion and resistance, yet needing to get that buy in from users in order for the new process to work as it should. You often find that once you have educated your peers on the reasoning and benefit behind a change, getting support should be much less of a challenge, and that you have enforced a new “rule” without any users even realizing it.

How Fortra Data Classification Can Help

Implementing a data classification solution into your organization treads that thin line of the requirement for education and enforcement all at the same time. Users who have not yet been familiar with data classification, and the how’s and why’s, will have plenty of questions surrounding the process. There are plenty of ways this can be handled from an organizational point of view, pre-roll out educational campaigns to warn the dangers of not classifying data, and mandatory learning modules (tactics used by Classifier customers Ofgem and Maersk Oil), but the education doesn’t have to stop there.

Fortra's Classifier Suite enables user education to continue after the implementation of the data classification solution throughout your organization. Simply, where a user has selected a label that may contravene the organization’s classification policy, Classifier allows for a warning message to be displayed (tailored to the organization’s own style) that can describe what may be wrong and offer a means to correct.  However, if the user wishes to continue with the current classification and selected action, that option is also provided, avoiding the risk of blocking the user from completing a standard (and perhaps valid) work activity.

How Data Classification Supports the User 

This approach lets users feel their own way through the data classification process and get an understanding of the labelling requirements on their own; eliminating the strict enforcement of the “right or wrong” culture – where normal working processes are interrupted. Users can make up their own mind as to whether they are correctly classifying the documents; therefore, boosting the security culture within the organization, as users feel in control of their own work, and can see the positive impact their actions have on the business. Once users have become accustomed to the requirements for document classification, organizations can consider moving towards an enforced approach, if that is seen to be an objective of introducing the classification controls provided by Classifier.

For organizations who already have the makings of a security culture, and users who understand the process of data classification, taking an educational approach is not always necessary. Instead, the solution can be implemented with an enforced style, where the option to “Prevent” the creation of documents, or sending of emails, with certain labels can be selected.  In this case, users are not provided with the option to continue with an action and are forced to address the issue described in the accompanying message, before the requested action can be completed.

Of course, with both approaches there is always more to think about than simply what is easiest for your users to understand. We see organizations concerned that when they implement a data classification solution that after a while, users might get used to seeing warning signs relating to wrongful classification, and simply ignore them for ease of carrying on with their work. This, however, is something that can be monitored using our Classifier Reporting tool, and easily rectified from a management perspective, via further education and/or appropriate changes to the Classifier configuration.

The real message here is – help others to help you. By educating your users to the benefits of data classification, implementing a new solution doesn’t have to be daunting or cumbersome, rather helping them become part of the bigger picture, and each carrying an important responsibility.