The Need for Effective Information Security Awareness

Abstract

Abstract-Security awareness is an often-overlooked factor in an information security program. While organizations expand their use of advanced security technology and continuously train their security professionals, very little is used to increase the security awareness among the normal users, making them the weakest link in any organization. As a result, today, organized cyber criminals are putting significant efforts to research and develop advanced hacking methods that can be used to steal money and information from the general public. Furthermore, the high internet penetration growth rate in the Middle East and the limited security awareness among users is making it an attractive target for cyber criminals.In this paper, we will show the need for security awareness programs in schools, universities, governments, and private organizations in the Middle East by presenting results of several security awareness studies conducted among students and professionals in UAE in 2010. This includes a comprehensive wireless security survey in which thousands of access points were detected in Dubai and Sharjah most of which are either unprotected or employ weak types of protection. Another study focuses on evaluating the chances of general users to fall victims to phishing attacks which can be used to steal bank and personal information. Furthermore, a study of the user's awareness of privacy issues when using RFID technology is presented. Finally, we discuss several key factors that are necessary to develop a successful information security awareness program.

Phishing in an academic community: A study of user susceptibility and behavior

“…They concluded that the more educated a student was in academic year, the less likely they were to fall for the phishing scam. Similarly, Aloul [2] presented a project in which a fake website portal recorded the number of students who navigate to this phishing trap. They recorded 9% of the 11,000 students falling for the fraudulent portal.…”

Cultural impact on user authentication systems

“…The cultural factor resulted from the trust phenomena makes the user share his/her private information with friends and relatives. In this direction, Aloul (2012) asserts that education on user privacy is imperative for Arab internet users due to the lack of knowledge of social engineering attack techniques. Consequently, dealing with these issues individually produces incoherent and brittle outcome (Dourish and Anderson, 2006).…”

“…It is clearly known that privacy and security are difficult to manage from the technical perspective and that is because they are caught up in larger collective rhetorics and practices of risk, danger, secrecy, trust, morality, identity. Furthermore, the continuous increase of internet usage allows attackers to gain unauthorised access to information by exploiting user's trust and tendency to help (Aloul, 2012). The other factor is the lack of security awareness.…”

The Awareness Behaviour of Students on Cyber Security Awareness by Using Social Media Platforms: A Case Study at Central University of Technology

“…Companies normally use advance security technologies to protect their information and only train their security professionals, but limited attention is given to the awareness of information among the actual users of the information (Aloul, 2012). Conducted studies indicated that the majority of computer users have an absence of information security knowledge due to inadequate awareness (Aldawood & Skinner, 2018).…”

“…Conventional methods (posters and newsletters) or online communications methods can be used to enhance ISA (Aloul, 2012;Alotaibi & Alfehaid, 2018). Emails can also be used as a medium to make people aware about cyber security threats that can face them (Dugan, 2018).…”