Making Security Awareness Happen

INTRODUCTION This article focuses on the first step of providing computer and information system security — developing and implementing an effective security awareness program. One might wonder why security awareness is not considered the same as training. The simple answer: because the desired outcome of each is different. The goal of a security awareness program is to heighten the importance of information systems security and the possible negative effects of a security breach or failure. During an awareness campaign, the end user simply receives information. It is designed to reach a broad audience using various promotional techniques. In a training environment, the student is expected to be an active participant in the process of acquiring new insights, knowledge, and skills. When designing and developing an information technology (IT) security training program, there is a wide range of options that are based on specific job requirements and the daily management, operation, and protection of information systems. IT is apparent in every aspect of our daily life — so much so that in many instances, it seems completely natural. Can you imagine conducting business without e-mail or voice mail? How about hand-writing a report that is later typed using an electric typewriter? As one is well aware, computer technology and open-connected networks are the core comP A Y O F F I D E A