Security awareness training and education
Security awareness training is the most important element of an information security program. In the absence of a structured and well-defined security awareness training program, the security program will not be providing the desired results. It is not possible to address the security risks only through technical security measures. It is important to address behavioral aspects of the employees through continuous awareness and education. Compliance with the requirements of the information security policy can be best ensured by education and improving the awareness of the employees. On a lighter note, the following illustration is for the security manager who believes that security awareness training is not required as long as controls are automated:
Figure 5.1 – Human weakness
The security manager should consider the following aspects of security awareness training and education:
- The most effective...
