Information Security Awareness and Training
Security awareness training is the most important element of an information security program. In the absence of structured and well-defined security awareness training programs, the security program will not be able to provide the desired results. It is not possible to address the security risks only through technical security measures. It is important to address the behavior of employees through continuous awareness training and education. Compliance with the requirements of the information security policy is best ensured by education and improving the awareness of employees.
Figure 6.5: Human weakness
A security manager should consider the following aspects of security awareness training and education:
- The most effective way to increase the effectiveness of training is to customize it as per the target audience and address the systems and procedures applicable to that particular group. For example, a system...
