Towards the Human Information Security Firewall

Information Security Awareness Today

Information Security Awareness is a well established term today. If most employees are educated and made aware of security threats and vulnerabilities, it is like expanding the information security department into the whole company (Hight, 2005). Although the term Information Security Awareness is used in many different forms, for the purposes of this paper, it is seen as including all aspects related to security awareness, training and education. Information Security Awareness has become a key component of sound industry good practice for information security (ENISA, 2007) and most organisations today do have some form of awareness (PriceWaterhouseCoopers, 2008). It is defined by the Information Security Forum as; “an ongoing process of learning that is meaningful to recipients, and delivers measurable benefits to the organisation from lasting behavioral change.” (ENISA, 2007). Two important factors that can be highlighted from this definition are; firstly, it must be ongoing and secondly, it must lead to behavioral change.