I was recently asked to speak in an information security class that is being taught on my campus.  The professor wanted me to speak about developing Information Security Policies since that has been my primary role at the University where I work.

Being a particularly sadistic person, I wrote a paper on information policy development and user education to share with the class.  Now I know that security policy development is nobody's favorite subject, but since there has been a call for more content, I thought I would share what I could.

So if you're looking for some light reading to help put you to sleep, here is an excellent guide to developing Information Security Policies and User Education programs.  Enjoy!

http://mavdisk.mnsu.edu/kevin/security/secuser.html