BA flies into e-learning

British Airways has developed an online learning programme to get its 3,000 managers up to scratch on security and data protection issues, after costs forced it to abandon classroom-style training.

The project for company-wide compliance on security policy, Chameleon, started four years ago and has so far cost the company £1 million. But after getting 1,400 managers compliant through face-to-face workshops, prohibitive costs drove the programme online in September.

Speaking at the Compsec 2000 conference in London last week, Dominic Steinitz, head of information security at British Airways in the UK, said the programme meant the company is now only "one or two percentage points" off its 85 per cent compliance target on security policy.

The online workshops focus on the business impact of the data and processes each manager is responsible for. Managers complete a threat and vulnerability assessment to rate their compliance with BA's information security policy.

In turn they receive recommendations for security compliance.

"Each workshop is given a unique number, you can stop and start it at any time and you can have multiple workshops on the go at the same time," said Steinitz.

"For business impact we looked at what would happen if the information was not available, if something corrupted the information, or if the information became disclosed either accidentally or maliciously. We assess it from the perspective of 'British Airways would cease to exist' down to 'negligible' or 'no effect'."

Steinitz said monitoring levels of compliance was easier thanks to the online workshops and allowed managers to complete the assessments at times that suit them best.