Achieving Effective Employee Information Security Awareness Through Web 2.0 Technologies Presented at ISACA AsiaA

1. Achieving Effective Employee Information
Security Awareness Through Web 2.0
Technologies
JEEVAN JOSHI

2. What do we cover in this session ?
• Trends in Information Security
Employee Awareness
• Using Web 2.0 technology
• Demos
• Conclusion

3. Key Message
Employees the stewards of critical organisational data and
information assets represent the most vulnerable link in the chain..
The use of Web 2.0 technologies allow effective engagement with employees,
specially the growing numbers of technology savvy generations
Web 2.0 tools are not only allow low cost, large scale deployments but also
allow effective communication of key messages on Information Security

4. Human Error – Main Reason for Security
Breaches
• Study on IT security by the Computing
Technology Industry Association (CompTIA)
finds that
– human error continues to be the main
reason for security breaches - 42% of the
IT professionals polled.
– Industry can learn from its mistakes: Two
years ago, that number was 59%.

5. Human Error – Main Reason for Security
Breaches
– "There has been a definitive shift toward
greater emphasis on making employees
aware of the threats around them..,“
– Some sectors are better prepared than
others. Financial services are most likely
to have a written policy, while fewer than
half of education institutions do.
– 81% said their policies now cover issues
specific to remote and mobile employees.

6. Human Error – Main Reason for Security
Breaches
– "data suggesting that human error
accounts for as much as 80% of
breaches..,“
– “'Processes we have to spend money
on because many regulations require us
to. Technology we have traditionally
been spending a lot of money on. Then
in terms of people, the only spend we
have is the salaries,'"So, there is a lot
of work to do in education.”

7. Human Error – Main Reason for Security
Breaches
• Security training or certification now
accounts for 12% of the total IT
budget, compared with 8% in 2005.
• The bottom line, however, is that only
45% of the IT staff members at the
companies that responded have
security-related training.

8. NIST Employee Awareness Model
Slide Title

9. Sample Plan for Information Security Training
RABQSA Certified Lead Auditor in
Information Security Management
(ISO 27001:2005) Course
Demystifying Information Security
Management
Internal Auditing for Information
Security Management Systems
using ISO 27001:2005
Understanding and Implementing
Information Security Management
Systems using ISO 27001:2005
SAI Global Information Security
Awareness Model

10. Web 2.0 Technology
• Technology
– e-Learning
• Online Courses
• Blended Learning
• Virtual Classroom
– Social Networking
– Blogs
– Podcasts

11. Employee Awareness Channels
High Employee feedback High
Employee Engagement &
Social Networking ?
Effectiveness
Blogs with comments
Participation
e-Learning/ Podcasts
Classroom Training
Brochures & Posters
Low Info Sec Policies
Low
Awareness Behavioural Change

12. Use of Web 2.0 Technologies
Building the Web
2.0 Enterprise,
McKinsey Global
Survey

13. Use of Web 2.0 Technologies
• Slide Content
Building the Web
2.0 Enterprise,
McKinsey Global
Survey

14. Regional Satisfaction with Web 2.0 Tools
Building the Web
2.0 Enterprise,
McKinsey Global
Survey
Asia Pacific includes Australia, New Zealand, Taiwan, Hong Kong, Japan, S Korea and
Singapore

15. e-Learning Courses
Slide Title
Courtesy – SAI Global
• Slide Content

16. e-Learning Courses
Courtesy – SAI Global
• Slide Content

17. e-Learning Courses
Slide Title
Courtesy – SAI Global

18. Learning Based Games

19. e-Learning
• Now a proven, scalable and cost effective
method of raising information security
awareness.
• Allows employees the flexibility to learn on
their own terms.
• Incorporate graphics and media elements
• Develop refresher courses every 6 months or
so.

20. Blogs
• More informal method of explaining
the drivers behind Information Security
policies.
• Allow employees to add moderated
comments.
• Keep the content fresh
• Choose bloggers who have the
respect of the employees not just
figures of authorities.

21. Social Networking
• Relatively new channel for
raising employee awareness.
Works the other way i.e. users
choose to access information
created by other users.
• Content framework to be
specified in a corporate
environment.

22. Information Security Employee Portals
• One stop for formal and informal
Information Security information
in the organisation.
• Use collaborative features such
as feed back and contributing
authors to engage users.

23. How Companies Adopt Web 2.0 Tools
Building the Web
2.0 Enterprise,
McKinsey Global
Survey

24. Key Message
Employees the stewards of critical organisational data and
information assets represent the most vulnerable link in the chain..
The use of Web 2.0 technologies allow effective engagement
with employees, specially
the growing numbers of technology savvy generation X & Y employees
Web 2.0 tools are not only allow low cost, large scale deployments but also
allow effective communication of key messages about Information Security