A Model to measure information security awareness level in an organization : case study of Kenya commercial bank.
Abstract
Information Security awareness forms a key basic part of Information Security Strategy within most organizations. Organizations that tend to be more conscious regarding Information Security will invest more than organizations that are less conscious. This can be seen in Financial and Telecommunications industry as compared to Agricultural industries. Information Security awareness is an investment that organizations make to ensure that the human aspect of Information Security is taken care of. Majority of organizations that invest in Information Security awareness do not measure the levels of awareness among their staff to identify the impact of their investment. Measurement of Information Security results in value add such as positive change in staff attitudes towards Information Security, respective increase in Information Security knowledge and a more secure organization. The value add comes with other added benefits such as reduced Information Security incidents and frauds, a more knowledgeable staff and an Information Security team with visibility into the general organizations predisposition to Information Security challenges as well as general awareness. This study aims at expounding on the various techniques used to impart awareness. The study aims at proposing a model that can be used to measure Information Security awareness levels in a Local financial institution. Achievement of specific objectives of the research was done through qualitative technique. Collection of data required is done from local Members of Information Security Profession who possess the required data in the area of Information Security. Following analysis of responses from the local Information Security professionals, the model developed was based on the Kruger and Kearney Model awareness measurement model with specific modifications to suit the local financial institutions' requirements. The models' modifications were based on a local banking institution for purposes of testing and validating the mode!. The modifications are as a result of the findings from the survey.
Description
Partial fulfillment for award of the degree of Master of Science in Information Technology (MSc.IT)
Information Security awareness forms a key basic part of Information Security Strategy within most organizations. Organizations that tend to be more conscious regarding Information Security will invest more than organizations that are less conscious. This can be seen in Financial and Telecommunications industry as compared to Agricultural industries. Information Security awareness is an investment that organizations make to ensure that the human aspect of Information Security is taken care of. Majority of organizations that invest in Information Security awareness do not measure the levels of awareness among their staff to identify the impact of their investment. Measurement of Information Security results in value add such as positive change in staff attitudes towards Information Security, respective increase in Information Security knowledge and a more secure organization. The value add comes with other added benefits such as reduced Information Security incidents and frauds, a more knowledgeable staff and an Information Security team with visibility into the general organizations predisposition to Information Security challenges as well as general awareness. This study aims at expounding on the various techniques used to impart awareness. The study aims at proposing a model that can be used to measure Information Security awareness levels in a Local financial institution. Achievement of specific objectives of the research was done through qualitative technique. Collection of data required is done from local Members of Information Security Profession who possess the required data in the area of Information Security. Following analysis of responses from the local Information Security professionals, the model developed was based on the Kruger and Kearney Model awareness measurement model with specific modifications to suit the local financial institutions' requirements. The models' modifications were based on a local banking institution for purposes of testing and validating the mode!. The modifications are as a result of the findings from the survey.
Information Security awareness forms a key basic part of Information Security Strategy within most organizations. Organizations that tend to be more conscious regarding Information Security will invest more than organizations that are less conscious. This can be seen in Financial and Telecommunications industry as compared to Agricultural industries. Information Security awareness is an investment that organizations make to ensure that the human aspect of Information Security is taken care of. Majority of organizations that invest in Information Security awareness do not measure the levels of awareness among their staff to identify the impact of their investment. Measurement of Information Security results in value add such as positive change in staff attitudes towards Information Security, respective increase in Information Security knowledge and a more secure organization. The value add comes with other added benefits such as reduced Information Security incidents and frauds, a more knowledgeable staff and an Information Security team with visibility into the general organizations predisposition to Information Security challenges as well as general awareness. This study aims at expounding on the various techniques used to impart awareness. The study aims at proposing a model that can be used to measure Information Security awareness levels in a Local financial institution. Achievement of specific objectives of the research was done through qualitative technique. Collection of data required is done from local Members of Information Security Profession who possess the required data in the area of Information Security. Following analysis of responses from the local Information Security professionals, the model developed was based on the Kruger and Kearney Model awareness measurement model with specific modifications to suit the local financial institutions' requirements. The models' modifications were based on a local banking institution for purposes of testing and validating the mode!. The modifications are as a result of the findings from the survey.
Keywords
Information security awareness, Quantitative modelling