A Perspective on Achieving Information Security Awareness

Overview In 2002 the Organization for Economic Cooperation and Development (OECD) released the document "OECD Guidelines for the Security of Information Systems and Networks: Towards a Culture of Security" (OECD, 2002). This initiative calls for approaching information security globally, although only 30 countries are members of OECD (OECD, 2004a). United States (US) has been a member of OECD since 1961. This document marked a "new international understanding of the need to safeguard the information systems on which we increasingly depend for our life" ("OECD publishes," 2002). The guidelines "Towards a Culture of Security" specify that Information Technology (IT) users have "to be aware of the need for security of information systems and networks". After releasing the initial document, the OECD Working Party on Information Security and Privacy (WPISP) promoted implementation plans, revised plans, and monitored the efforts to promote a "Culture of Security" among all participants who develop, own, provide, manage, and use information systems and networks. The document emphasizes a culture of security in all aspects of information systems, from designing and planning through to everyday use, and among all participants, from government down through business to consumers. The guidelines promote nine principles: awareness, responsibility, response, ethics, democracy, risk assessment, security design and implementation, security management, and reassessment. In addition, a Web site "Culture of Security" has been created to promote a global "culture of security". In February 2003, the US government released the final version of the document "National Strategy to Secure Cyberspace" which lays out five public and private sector priorities. Among those priorities is "A national cyberspace security awareness and training program" (Goth, 2003). In June 2003, the US Department of Homeland Security created the National Cyber Security Division (NCSD) that supports creation of cyber security awareness programs for the US public and for various international communities. However, recent worms, viruses, and denial of service attacks show that the Information Technology (IT) workforce is not prepared to handle such attacks because of "poor security awareness and training" (McConnell & Hamilton, 2002). According to the survey "Hacker Homelands" of third quarter in 2003 provided by Internet Security Systems Inc., approximately 84.95% of cyber attacks originate from North America ("Security log," 2003). Intruders known as hackers may be novices (called also script-kiddies) or vicious criminals. Statistics show that more than 90% of computer attacks are initiated by teenagers. These attacks make security education increasingly important in schools starting at a very early age. Many intruders use social engineering techniques to persuade someone to reveal access codes, passwords, or other confidential information. Threats, such as viruses spread via email, achieve their destructive goal through social engineering. "That is, by psychologically manipulating or tricking the user to do something" (Volonino & Robinson, 2004) quickly that maybe be very dangerous. The success of the mass spread of the ILoveYou virus is because of its attention grabbing email subject. In fact, social engineering is a collection of techniques used to fool the users. These techniques succeed well with uneducated users. In June 2004, the Internet intrusion called a scob attack "exploited a powerful new assault technique" that affected many Web sites (Leavitt, 2004, p. 16). This attack "has computer security officials worried that it could be a harbinger of worse things to come" and it has sent a signal that we can expect "scob-like attacks to become more targeted and sophisticated" in the future (Leavitt, 2004, p. 18). Leavitt (Leavitt, 2004, p. 18) advises that "the best proactive steps involve educating users, system administrators, and software manufacturers". …