Year: 2009
Type: dissertation
Abstract: Information Security awareness initiatives are seen as critical to any \ninformation security programme. But, how do we determine the \neffectiveness of these awareness initiatives? We could get our employees \nto write a test after the awareness to determine how well they \nunderstand the policies, but this does not show how they affect the \nemployee’s on the job behaviour. Does awareness training have a direct \ninfluence on the security behaviour of individuals, and what is the direct \nbenefit of awareness training? This research report aims to answer the \nquestion: To what extent does information security awareness training \ninfluence information security behaviour? \nTechnologies meant to provide security ultimately depend on the \neffective implementation and operation of these technologies by people. \nThus awareness of policies is needed by all individuals in an organisation \nto ensure that policies are well understood and not misinterpreted. Some \nresearchers have maintained that educating users is futile mainly \nbecause it is believed that it is difficult to teach users complex security \nissues and, secondly, because if security is seen as secondary by the user \nthey will not pay enough attention to it. \nThis research found that, firstly, there is a shortage of in-depth \ninformation security awareness research and that behavioural concepts \nare not properly taken into account for security awareness programmes. \nThere is a shortage of theoretical models explaining how awareness \ntraining affects behaviour. Secondly, this research tested a proposed \nmodel empirically using system-generated data as indicators of behaviour \nin a pretest-posttest experimental design. It was found that security \nawareness training was effective in terms of end-users retaining security \nknowledge. However, there was no evidence to suggest that security \nawareness by itself is sufficient to ensure compliant behaviour by endusers. \nSecurity awareness training is a necessary, integral component \nthat could influence compliant behaviour, but is not adequate to do so \nfully. Practitioners must insist that their security awareness programmes \nare measured in terms of effectiveness and focus on behavioural aspects \nto complement traditional security awareness initiatives.
Author: Anthony Stephanou
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W2235413064