# SAWIT--Security Awareness Improvement Tool in the Workplace
## 2 Security Awareness
### Security Awareness  
Security awareness is defined in NIST Special Publication 800-16 as follows: \"Awareness is not training. The purpose of awareness presentations is simply to focus attention on security. Awareness presentations are intended to allow individuals to recognize IT security concerns and respond accordingly\" [12] (p. 15). It is very important to emphasize that security awareness should be a continual process because new attacks appear constantly. Security awareness is more closely defined by using the term situation awareness [13], i.e., \"the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning and the projection of their status in the near future\".  
The leading idea is to achieve of awareness in a given situation, and the model consists of three levels:  
* Perception (recognition of the status, attribute and dynamics of related elements in environment);* Comprehension (synthesis the separated perceptual elements through analysis and evaluation process based on the previously collected data);
* Projection (prediction of analyzed information obtained in comprehension level) [13].  
Situational awareness applied to cyber domain is _cyber-situational awareness_ and can be defined as \"compilation, processing and fusing of network data to understand a network environment and accurately predict and respond to potential threats that might occur\" [14].  
Although situational awareness was firstly mentioned twenty-five years ago, it is still a hot research topic applied to a broad range of research areas. Recently [PERSON] et al., have proposed a framework to measure the risk of Internet of things devices based on situation awareness [15]. On the other hand, security awareness serves to enhance the perspective that new cyber sensors can contribute to situational awareness for the purpose of understanding what needs to be done in terms of the desired effects and the actions that ought to be undertaken to achieve these effects [5].  
According to the National Institute of Standards and Technology [16], the first step in information security learning is awareness, the next is training, and the final stage is education. Security awareness offers organizations numerous advantages, such as compliance with the increasing number of laws and regulations regarding forms of training and awareness activities, achieving customer trust and satisfaction, enhancing accountability and compliance, reducing the number of security incidents and improving corporate reputation [17; 18].  
User factors such as attitude, self-efficacy and the perceived response costs of security tasks are linked to information security policies [19]. On the other hand, a lack of cyber security knowledge could result in users' lack of confidence, higher dissatisfaction and a sense of helplessness, as indicated by [PERSON] et al. [20]. According to [PERSON] and [PERSON], users who read about cyber security terms and concepts are more aware about cyber security issues [21].  
Ernst & Young analyzed the ability of companies to meet the requirements for building security awareness in 2013, and three years after: Both reports confirmed the lack of skilled resources [22; 23]. According to Oracle and KPMG's report from 2019, the shortage of cyber security skills is a major factor contributing to the inability to process security events, and 53% of organizations stated that they have a problematic shortage of skills in the area of cyber security [24]. Thus, one of the solutions for this problem may be technology enhanced learning. [PERSON] and [PERSON] stated that web-based programs raise security awareness in tested domains (password, email and virus management) [18].