Fortifying Corporate Human Wall: A Literature Review of Security Awareness and Training

2. Background

It has been consistently shown through numerous surveys and studies that most of the data breaches happen due to insiders’ oversight or mistakes. It is usually the non-malicious and uninformed employees that lead to the breaches. The number of layers of technological defense can be as strong as possible but the people working and supporting these technologies are always vulnerable. Users with little security awareness are the biggest risks to the organization. Breaches after breaches has shown us that only a minor slip up is enough to put the whole security program for any company at huge exposure. Technology alone cannot provide protection against information security and privacy risks and people are the most important line of defense who are responsible for ensuring that risks are managed in accordance with specific risk appetite and tolerance for the company (Tipton and Krause, 2007; IT Governance Institute, 2008). Focusing only on technical countermeasures is not enough for mitigating information security risks (Mitnick and Simon, 2003). Employees of the company need to be trained and educated on security best practices, policies, compliance requirements, implemented controls, expectations for risk mitigation as part of a security awareness program (Ashenden, 2008; Williams, 2008).