The Need for Effective Information Security Awareness

Abstract

Abstract-Security awareness is an often-overlooked factor in an information security program. While organizations expand their use of advanced security technology and continuously train their security professionals, very little is used to increase the security awareness among the normal users, making them the weakest link in any organization. As a result, today, organized cyber criminals are putting significant efforts to research and develop advanced hacking methods that can be used to steal money and information from the general public. Furthermore, the high internet penetration growth rate in the Middle East and the limited security awareness among users is making it an attractive target for cyber criminals.In this paper, we will show the need for security awareness programs in schools, universities, governments, and private organizations in the Middle East by presenting results of several security awareness studies conducted among students and professionals in UAE in 2010. This includes a comprehensive wireless security survey in which thousands of access points were detected in Dubai and Sharjah most of which are either unprotected or employ weak types of protection. Another study focuses on evaluating the chances of general users to fall victims to phishing attacks which can be used to steal bank and personal information. Furthermore, a study of the user's awareness of privacy issues when using RFID technology is presented. Finally, we discuss several key factors that are necessary to develop a successful information security awareness program.

Impacts and Satisfaction of Using Smartphones for Learning in a University Context

“…An increase in the number of phishing attempts shows that the target is now the user and cybercriminals seek to exploit their lack of knowledge. While organizations are increasingly advancing their security technologies, very little is invested in increasing safety awareness among general users, consequently causing them to be the weakest link on the organization's system (Aloul, 2012). Social awareness campaigns can be run to inform people of prevalent security issues.…”

A Perspective on the Intersection of Information Security Policies and IA Awareness, Factoring in End-User Behavior

“…IT systems are dependent on employees' behavioral compliance with security requirements [23]. Without information security awareness training and a commitment to compliance, people's intentional and unintentional actions cause adverse consequences that negatively impact organizations [26].…”

Narrative review: Social media use by employees and the risk to institutional and personal information security compliance in South Africa

“…2,3 For this reason, organisations should be actively involved in information security awareness programmes as social media risks are ever-increasing. 4,5 According to Frauenstein and Flowerday 6 technology controls alone cannot deal with social media risks; therefore, employees play a vital role in the defence.…”

“…Professional isolation and job performance was found to be highly negatively correlated. Aloul 4 and Ajzen and Fishbein 5 notice a rise in phishing attacks, for instance, malspam and ransomware attacks as COVID-19 is used by attackers as bait to impersonate brands and mislead employees. This puts personal computers and phones on high risk and will likely result in more of these gadgets getting infected.…”

“…Moreover, if employees are not well informed regarding the risks and privacy issues when accessing social media during working hours at the workplace, they could expose the organisation's reputational damage and customer loss. 4,5 Furthermore, the emergence of COVID-19 plague has forced businesses and governments to depend increasingly on technology to assist citizens, thus the use of digital systems have become popular and the only alternative to save people and businesses. 8 New demands have been placed on networks and datacentre infrastructure as remote working and collaboration tools have become important systems, with a new wave of demands placed on networks and datacentre infrastructure.…”