Building an information security awareness program: defending against social engineering and technical threats

摘要

As it is often said, people are the weakest link in information security. For this reason, security training and education, or security awareness, as it commonly called, is generally acknowledged to be a key element at the base of any security program. In practice, there is the widespread perception that most security awareness initiatives are not sufficiently effective, to the point that some experts suggest that a better return on investment would be obtained by focusing the attention on designing better systems and stronger security controls.