* End user security training lacking, finds report
This newsletter is dedicated to training and education issues for IT professionals but how much do we think about training for end users, particularly educating users to be security-aware? Not much according to the results of a recent survey of 1,233 organizations in 51 countries about security concerns.
Respondents to the 2004 Ernst & Young Global Information Security Survey cited lack of security awareness by end users as the top barrier to achieving the required level of security. Yet raising awareness through security training programs was ranked just sixth and eighth in the list of security priorities in 2004 by business chiefs and IT execs, respectively. Business leaders ranked enforcing information and security policy as the first priority, which begs the question, how will this be done if training isn’t even a top-five initiative?
“With proper training and education, people can become the most effective layer in an organization’s defense-in-depth strategy,” the report notes. “The first step is making sure they operate in a security-conscious culture.”
Security experts say organizations should foster a pervasive security-aware corporate culture. To get there, network executives must begin by insisting on CEO leadership. The CEO must decide on the risk level the company is willing to take and instill in the workforce the importance of being security-savvy and of using security technologies to protect against attacks. Training should be given to end users to help them recognize potential security breaches and that in a security culture, regularly changing passwords, not opening suspicious e-mail attachments and other basic precautions are second nature.
A PDF of the Ernst & Young survey can be downloaded here (https://www.ey.com/global/download.nsf/International/2004_Global_Information_Security_Survey/$file/2004_Global_Information_Security_Survey_2004.pdf).
***
Network World Technology Tour: Network Security: Structuring an Aggressive Defense
Nov. 9 – Dec. 1, at a city near you
https://www.nwfusion.com/events/security/index.html#overview
Will it be an enterprisewide attack that suddenly shuts you down? Or a stealth virus that worms into your network? A well-organized strike by an outside force? Or an inside agitator on a mindless rampage? No network is exempt from attack – protected or not. The only difference between those spared damage and those thrust into chaos will be the security strategies prepared in advance. The solutions you implement now. And the leadership you show ahead of coming threats. Attend Network Security: Structuring an Aggressive Defense. A top-to-bottom, inside-out security event focused on every element needed for total enterprisewide protection.
