The positive outcomes of information security awareness training in companies – A case study

Eminağaoğlu, Mete; Uçar, Erdem; Eren, Şaban

doi:10.1016/j.istr.2010.05.002

Cited by 78 publications

(32 citation statements)

References 6 publications

(4 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In addition, Eminağaoğlu et al (2009) emphasize in their research that, in addition to standard training, organisations should periodically introduce awareness campaigns supplemented by additional interactive support materials.…”

Section: Discussionmentioning

confidence: 99%

Forming the Awareness of Employees in the Field of Information Security

Chmura

2017

JPM

View full text Add to dashboard Cite

Research purpose: The aim of this study is to present the essence and importance of information security awareness in the organisation and to analyse selected methods used in forming employee awareness in terms of information security. Methodology/ approach:This paper is based on literature studies and available reports. Findings:The presented paper suggests that in order to create a positive change in the organisation, information security training should focus on the attitude and behavior of employees. Concentration is primarily about what they do and how their actions affect the results. In order to minimise the risk of data breaches, often resulting from human error, training methods must meet the needs of today's employees. Effective information security awareness strategies should address the needs of both the organisation itself and the learning people. Limitations/implications:The study is based on the theoretical analysis, indicating the need of conducting further empirical research. Originality/value:The main value of the study is to clarify the need for forming employees' awareness of information security, while indicating a number of available methods enabling the implementation of awareness programs in the organisation.

show abstract

Section: Discussionmentioning

confidence: 99%

Forming the Awareness of Employees in the Field of Information Security

Chmura

2017

JPM

View full text Add to dashboard Cite

show abstract

“…Awareness training approaches certainly have an impact, but the extent of this impact is uncertain, as there is no reliable approach for measuring the lasting effect. Primary evaluation is traditionally based on supervised testing in specific case studies [Eminagaoglu et al 2009;McCrohan et al 2010]. The extent to which different awareness training strategies employed by organisations impacts their quarterly or yearly breach statistics is not measured.…”

Section: Organisationalmentioning

confidence: 99%

A Taxonomy of Attacks and a Survey of Defence Mechanisms for Semantic Social Engineering Attacks

2015

View full text Add to dashboard Cite

Social engineering is used as an umbrella term for a broad spectrum of computer exploitations that employ a variety of attack vectors and strategies to psychologically manipulate a user. Semantic attacks are the specific type of social engineering attacks that bypass technical defences by actively manipulating object characteristics, such as platform or system applications, to deceive rather than directly attack the user. Commonly observed examples include obfuscated URLs, phishing emails, drive-by downloads, spoofed websites and scareware to name a few. This paper presents a taxonomy of semantic attacks, as well as a survey of applicable defences. By contrasting the threat landscape and the associated mitigation techniques in a single comparative matrix, we identify the areas where further research can be particularly beneficial.

show abstract

“…ISA programs can be structured as intense and coordinated campaigns or simply consist of several isolated initiatives [5,19]. An increased ISA through such programs can lead to improvements of employees' security compliance behavior [8]. Hence, we generally assume that ISA programs positively affect the intention for compliant security behavior [3].…”

Section: The Effects Of Isa Programs On Employees' Protection Motivationmentioning

confidence: 99%

“…An increased awareness concerning information security risks and threats is by many considered as the most cost-effective control of an organization [11]. ISA programs make employees sensitive to foster security of organizations' information systems and be aware of information security risks [8]. Actual topics for ISA programs are, among others, phishing attacks, social engineering, passwords security, secure internet use and clear screen policy [5].…”

Section: Introductionmentioning

confidence: 99%

The Effects of Awareness Programs on Information Security in Banks: The Roles of Protection Motivation and Monitoring

Bauer

Bernroider

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Our aim is to understand how information security awareness (ISA) programs affect the intention of employees for compliant information security behavior. We draw on Protection Motivation Theory (PMT) to uncover indirect influences of ISA programs, and seek to identify the extent to which intention translates into actual compliance is contingent on monitoring. Based on partial least squares structural equation modeling analysis of 183 survey responses consisting of German bank employees, we find strong empirical evidence for the importance of ISA programs, protection motivation and monitoring. While ISA programs effectively change how employees cope with and assess security threats, only coping appraisal is an important condition for the positive behavioral effects of such programs to occur. However, ISA programs may cause a false sense of security, as vulnerability perceptions are reduced by consuming ISA programs but not affecting intentions for compliant security behavior. Perceived monitoring strengthens this confirmed intention-behavior link.

show abstract

The positive outcomes of information security awareness training in companies – A case study

Cited by 78 publications

References 6 publications

Forming the Awareness of Employees in the Field of Information Security

Forming the Awareness of Employees in the Field of Information Security

A Taxonomy of Attacks and a Survey of Defence Mechanisms for Semantic Social Engineering Attacks

The Effects of Awareness Programs on Information Security in Banks: The Roles of Protection Motivation and Monitoring

Contact Info

Product

Resources

About