An Information Security Training and Awareness Approach (ISTAAP) to instil an information security-positive culture

摘要

This paper proposes a unique information security training and awareness approach (ISTAAP)that can be used to instil an information security-positive culture which will assist inaddressing the risk that human behaviour poses to the protection of information. Aninformation security culture assessment tool is used as the critical diagnostic instrument toassess the information security culture within the context of ISTAAP. A case study isdiscussed where the ISTAAP was deployed. This provided empirical data to illustrate thevalue of ISTAAP to direct employee behaviour through focused training and awareness based on the outcome of the information security culture assessment data.