That is, it provides the focus individuals need within an organization to maintain knowledgeable employees, consultants and contractors. Since information security is 70 percent people and process and 30 percent technology, it is essential to develop and promote a security-awareness campaign. It is recognized and widely accepted that people are the weakest link. Many studies about security breaches indicate this very point. To further demonstrate the value of training, and underscore that people are the weakest link, security programs teach employees how to prevent social engineering.
Social engineering is essentially a con game.
It is an attempt to persuade another person to do what you want them to do. For example, in 1994, a French hacker named Anthony Zboralski called the FBI office in Washington, D.C. pretending to be an FBI representative working at the U.S. Embassy in Paris. He persuaded the person at the other end of the phone to explain how to connect to the FBI's phone-conferencing system. Organizations must ask themselves how vulnerable they are to potential hacking attacks, such as a help desk employee providing an account and password to a caller masquerading as an employee on medical leave. That is why certification of information security professionals and practitioners is becoming more common as a condition of employment.