Security awareness is the knowledge and attitude members of an organization possess regarding the protection of the physical, and especially
informational, assets of that organization. Many organizations require formal security awareness training for all workers when they join the organization and periodically thereafter, usually annually.
Coverage
Topics covered in security awareness training include:
*The nature of sensitive material and physical assets they may come in contact with, such as
trade secret
Trade secrets are a type of intellectual property that includes formulas, practices, processes, designs, instruments, patterns, or compilations of information that have inherent economic value because they are not generally known or readily a ...
s,
privacy
Privacy (, ) is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively.
The domain of privacy partially overlaps with security, which can include the concepts of a ...
concerns and government
classified information
Classified information is material that a government body deems to be sensitive information that must be protected. Access is restricted by law or regulation to particular groups of people with the necessary security clearance and need to k ...
*Employee and contractor responsibilities in handling sensitive information, including review of employee
nondisclosure agreements
*Requirements for proper handling of sensitive material in physical form, including marking, transmission, storage and destruction
*Proper methods for protecting sensitive information on
computer systems, including
password policy and use of
two-factor authentication
*Other computer security concerns, including
malware
Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, de ...
,
phishing
Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...
,
social engineering Social engineering may refer to:
* Social engineering (political science), a means of influencing particular attitudes and social behaviors on a large scale
* Social engineering (security), obtaining confidential information by manipulating and/or ...
, etc.
*Workplace security, including building access, wearing of
security badges, reporting of incidents, forbidden articles, etc.
*Consequences of failure to properly protect information, including potential loss of employment, economic consequences to the firm, damage to individuals whose private records are divulged, and possible
civil
Civil may refer to:
*Civic virtue, or civility
*Civil action, or lawsuit
* Civil affairs
*Civil and political rights
*Civil disobedience
*Civil engineering
*Civil (journalism), a platform for independent journalism
*Civilian, someone not a membe ...
and
criminal
In ordinary language, a crime is an unlawful act punishable by a state or other authority. The term ''crime'' does not, in modern criminal law, have any simple and universally accepted definition,Farmer, Lindsay: "Crime, definitions of", in Ca ...
penalties
Security awareness means understanding that there is the potential for some people to deliberately or accidentally steal, damage, or misuse the data that is stored within a company's computer systems and throughout its organization. Therefore, it would be prudent to support the assets of the institution (information, physical, and personal) by trying to stop that from happening.
According to the European Network and Information Security Agency, "Awareness of the risks and available safeguards is the first line of defence for the security of information systems and networks."
"The focus of Security Awareness consultancy should be to achieve a long term shift in the attitude of employees towards security, whilst promoting a cultural and behavioural change within an organisation. Security policies should be viewed as key enablers for the organisation, not as a series of rules restricting the efficient working of your business."
Measuring security awareness
In a 2016 study, researchers developed a method of measuring security awareness.
[{{cite journal, last1=Giboney, first1=Justin Scott, last2=Proudfoot, first2=Jeffrey Gainer, last3=Goel, first3=Sanjay, last4=Valacich, first4=Joseph S, title=The Security Expertise Assessment Measure (SEAM): Developing a scale for hacker expertise, journal=Computers & Security, date=2016, volume=60, pages=37–51, doi=10.1016/j.cose.2016.04.001] Specifically they measured "understanding about circumventing security protocols, disrupting the intended functions of systems or collecting valuable information, and not getting caught" (p. 38). The researchers created a method that could distinguish between experts and novices by having people organize different security scenarios into groups. Experts will organize these scenarios based on centralized security themes where novices will organize the scenarios based on superficial themes.
See also
*
Access control
In the fields of physical security and information security, access control (AC) is the selective restriction of access to a place or other resource, while access management describes the process. The act of ''accessing'' may mean consuming ...
*
Physical Security
*
Security" \n\n\nsecurity.txt is a proposed standard for websites' security information that is meant to allow security researchers to easily report security vulnerabilities. The standard prescribes a text file called \"security.txt\" in the well known locat ...
*
Security controls
*
Security management
*
ISO/IEC 27002
*
Internet Security Awareness Training
References
External links
Army's Security Education, Training and Awareness Site The Security Awareness CycleComparison of Security Awareness Training Companies
Computer security
Security