Building Information Security Culture: How Welcome Training Turned Rules into Engaging Dialogue
A large software company has shared how it replaced dry policy documents with an interactive Welcome Training program to build genuine information security culture among its staff.
The organization already deploys advanced controls such as access restrictions, security policies, an SIEM system, and antivirus solutions. However, these tools proved ineffective when employees lacked basic understanding of why rules exist and what consequences follow from violations.
What did not work
Signing a policy document during onboarding proved insufficient, as staff rarely retained the content. Posting rules on the corporate portal also failed to drive compliance, since no verification mechanism existed.
The target audience consists of developers, analysts, testers, product managers, and designers. While these professionals often master complex product security technologies, many still store passwords in Google Sheets, showing that technical skill does not automatically translate into security culture.
Welcome Training structure
The company therefore introduced 45-minute in-person sessions limited to groups of 7–10 people. The format encourages questions and discussion. The curriculum includes:
- Current threat landscape with examples of major Russian incidents
- Step-by-step attack mechanics to illustrate individual impact
- Assets under protection, including code, data channels, and personal information
- Consequences of sharing credentials or personal data
- Password requirements and use of corporate password managers
- Proper use of corporate email
- Storing sensitive data on encrypted volumes with VeraCrypt
- Secure credential transfer using the pbin service
- File checking via VirusTotal and antivirus tools
- Recognition and response to social engineering
- Signs of workstation compromise and reporting procedures
- Overview of deployed corporate protections such as Kaspersky Endpoint Security, Kaspersky Secure Mail Gateway, and SIEM
Results include higher engagement, better retention, increased awareness of personal responsibility, and a measurable drop in human-factor incidents.
Related articles
Ozon Data Security Team Details Audit Framework to Eliminate Paper-Only Compliance
Alena, head of the Data Security group at Ozon, describes how the company built an internal audit process that focuses on actual risk reduction instead of producing lengthy formal reports. The team examines personal data, financial records, and other sensitive information across hundreds of microservices while checking role-based access, logging, encryption, and data flows. They analyzed more than 84,000 user-role pairs in one review and identified overly broad permissions on product tagging that could cause major financial losses. A notable case led to the removal of customer names, phones, and addresses from delivery boxes even though the practice was formally allowed under Federal Law 152-FZ. The group uses a scoring model based on data sensitivity, business importance, user count, and potential monetary impact to prioritize which systems to audit first. Additional criteria such as past incidents and critical information infrastructure status can be added to the model. The approach emphasizes real implementation of recommendations, cross-team communication, and hiring analysts who care deeply about practical security outcomes.
Microsoft to Make Passkeys Default Authentication in Entra ID Starting September 2026
Microsoft will transition Entra ID users to passkeys as the standard authentication method beginning September 1, 2026. The change aims to eliminate reliance on phishing-prone SMS and voice call codes. Existing SMS and voice users will be prompted to register passkeys during their next multifactor authentication. Passkeys rely on public-key cryptography and avoid shared secrets, blocking phishing, interception, credential reuse, and SIM swapping attacks. Support includes synced passkeys via iCloud Keychain and Google Password Manager, plus device-bound options like Microsoft Authenticator, Windows, and FIDO2 hardware keys. Native SMS and voice services will be fully retired on February 1, 2027, forcing affected tenants to adopt passkeys with no opt-out option.
Russian Ministry of Transport Unveils Draft Rules for Centralized Passenger Data with Unique Per-Trip IDs
The Russian Ministry of Transport has published a draft regulation expanding centralized databases of passenger and crew personal data. Each traveler and crew member will receive a unique identifier generated separately for every flight or trip that cannot be reused or reassigned. The rules add new mandatory data points including cancellations of boarding, online check-ins, and changes to group tickets. Data must be transmitted within 15 minutes for air and rail tickets and 30 minutes for other modes, with crew details submitted at least 24 hours before departure. Retention remains fixed at seven years. The order, if adopted, will replace the 2024 rules and is open for public comment until 29 August with an intended effective date of 1 March 2027.
Multiple Ozon Apps Removed from Google Play Following Sanctions on Ozon Bank
Several Ozon applications have been removed from the Google Play store, affecting Android users who can no longer download the main Ozon client along with Ozon Fresh, Ozon Seller, Ozon Job and Ozon Travel. Ozon stated that the company did not violate Google Play rules, yet the exact reasons for the removals remain undisclosed. The action follows the earlier disappearance of the Ozon Bank app after the bank was placed under European Union sanctions, although no official connection has been confirmed. Apple users continue to access Ozon services through the App Store, while Android users are directed to alternative stores including RuStore, AppGallery and Galaxy Store. The company also warned against downloading APK files from unverified sources due to security risks. The removals come amid a broader wave of app store purges that also affected Yandex Pay on the App Store. Already installed applications generally continue to function, but users may face difficulties with future updates and reinstalls.