With the economy tight, squishy balls and other tchotchkes have been axed from budgets. But Curran said it's important to "touch" employees, including remote ones, with security awareness information. Among other things, Bose uses online presentation software from Brainshark to make security awareness information available to employees anywhere (she noted that she did not intend her remarks to be construed as an endorsement for Brainshark, nor is the product free, but was just citing it as an example). Others chimed in that those who already own PowerPoint can extend the Microsoft software through a narration feature to accomplish some of this same sort of communication.

Anne Oribello, a security expert at Genzyme, said freebies are also available in the area of IT security policies. She cited the and as sources. While these policies might not work for you untouched, they give you a good place to start.

She also advised looking to available standards, such as the Health Insurance Portability and Accountability Act, even if you don't happen to be in the healthcare industry. She said a lot of thought has been put into detailing security requirements, and that these are the sorts of things any organization could benefit from considering.

One last bit of savings advice from Oribello -- well, something that can save you from trouble anyway. She recommends that any security policy include forms for making requests for policy exemptions. By doing this, an organization can address things it didn't think of when originally putting its security policy in place, plus puts a system in place to monitor the exceptions.

Follow Bob Brown on Twitter and at our Alpha Doggs blog about network research.