Measuring the Effectiveness of Information Security Awareness Program

Many researchers and experts in the information security field stress that the user is the weakest link in the chain when it comes to information security and security assets of an organization. The human error is still the key concept that might threaten and seriously damage assets of the organization. Consequently, the challenge for many (if not most) institutions and organizations today, is to improve the information security awareness of the end user. Identifying the program that best influences and improves the user’s knowledge, attitude, and behavior towards information security, is yet highly important. In order to identify this program, a method for assessing and measuring the effectiveness of information security awareness program is applied in this study. In the previous literature many methods for assessing and measuring the information security awareness are found,but there is not even one research found that shows effectiveness of the awareness program. Therefore, in this thesis a case study, and an experiment is realized in practice to examine, and represent the effectiveness of the information security awareness program. In this study information security awareness training is realized. The level of awareness among the participants in regard to information security is assessed and measured before and after the awareness training. The purpose of this is to let the effectiveness of the awareness training be highlighted, shown, and to find out to what extended it is effective. The methodology used to accomplish this task is: the online surveys and the interviews. The results from the statistical analysis of the data form the surveys have shown that the awareness training programs used in this case are effective. The topics discussed in the training, are: (1) Password protection and management, (2) Sensitive information handling, (3) Social engineering, (4) Physical/Office protection, (5) Incident response whom to contact, where all of them scored higher from the group of participants that attended the training, than the group of participants that NOT attended the training. The information security awareness on "all topics together" ("all topics together" includes all from the above mentioned topics, and represent the awareness in general) is scored significantly higher from the participants that attended the training, with value of p = 0.009 (If p ≤ 0.01 the observed value is "highly significant"). Regardless of these statistical facts, the interviews with IT personnel confirmed that the number of employees asking about suspicious e-mails has been increased, after the training has been realized. The training is realized into different training styles, such as: (a) Classroom, (b) Discussionbased, and (c) Web-based training style. These training types are compared with each other, to identify their effectiveness. It resulted that the (a) Classroom training style is more effective on improving the knowledge, attitude, and behavior, among the participants in the majority of the topics. However, the (c) Web-based training style resulted to be better in the (3) Social engin-