Discuss the importance of user technology security education within organizations. What topics should be included in security education and training?

Directions:

• Students are required to post one original response to the discussion questions each week, as well as a response to one classmate. Original responses should not be a word for word rehashing of what is stated in the readings, but rather an integration of the concepts and additional insights, either from real world experience or additional sources. It should be a 250 word response to the question . Your primary posting may end with a tag-line or a related question of your own. Your secondary posting is a response to one classmate's post. Each answer/response should be supported with research. Responses to classmates should not be "I agree” or "I like the way you stated that.” These responses should again be insightful, offering an opinion or facts based on your research and experiences. The response to one classmate should be a minimum of 125 words. See APA criteria for citing resources. You must provide a minimum of a reference, in APA format, in your original response.

1st reply to topic

Regardless of how big or small your company is, we must have a plan to ensure the security of your information assets. Such a plan is called a security program by information security specialists. The process of creating a security program will make you think about the security of our organization. The security program provides the foundation for maintaining your company at the desired level of security by assessing the risks you face, deciding how you will mitigate them, and planning how you continuously update the program and your security practices. When weighing the biggest security risks for an organization, it may be a surprise to discover that the end user inside the organization is often the first to compromise security. Not through their own fault, and mainly because of insufficient awareness, employees often open a virtual gate to intruders. With the growth of cybercrime, as well as the growing consumer demand for IT and BYOD, it is more important than ever to fully educate security personnel and protect. Despite the fact that BYOD gave them an increased level of flexibility, it also provided the end user with even more opportunities for security breaches.

The key advantage that a protection program helps protect is your data – and the value of your business in its data. We already know this if our company is one of many, whose data management is dictated by governmental and other norms.

In any organization, employees have access to the most important and confidential information, which must be maintained with a high degree of security. But there is a high probability of a security breach when such information is processed by several users without proper awareness and security measures. To avoid and eliminate risks, a carefully developed safety training and educational program are required. All end users, employees in the organization must be educated and trained through these security programs before providing access to sensitive data.

At present, many organizations conduct SAT trainings as prerequisites for employees, and also implement these information programs and trainings on employee orientation. Security training or awareness raising programs explain the role of an information security officer and make employees understand IT governance issues and management solutions.

Topics that need to be included in education and training in the field of security:

Any educational and training program in the field of security should determine the importance of ensuring confidentiality, integrity and accessibility of information within the organization. Below are some topics that need to be included in education and training in the field of security.

1. Awareness of the importance of education and training in the field of security. Each SAT program must determine its importance and use to protect the organization from various organizations, such as hackers, intruders, phishing emails, unidentified networks and voice communications.

2. General security violations and their impact on the organization. Security breaches such as password sharing, confidential information exchange, and maintaining common data security are some common areas where there is a good chance of a security breach.

3. Various methods of the safety information program and its training information. SAT programs can be designed in various ways to be accessible to users, such as computer training, group training, multimedia presentation and security booklets, etc.

4. General policies and security measures. Each SAT program must define its privacy, integrity, and sharing policies such as a strong password policy that describes how to create a strong password, a computer device, and a network policy that defines reliable firewalls and a network for connecting and processing file sharing information and printouts of confidential information.

5. Training aids on information security and courses. Organizations should include training manuals and courses and conduct tests so that staff are aware of the latest updates and policy changes.

2nd reply to topic

Data security is one of the important aspects every company needs to care off. If there are no proper security standards established there would be the big loss to the companies as data would be the heart of any company. As companies started to maintain security at the network level but employees who use these don’t have proper knowledge of the email phishing happening to gain access to data through employee’s systems. To end this issue cloud would be the best choice for any company because data is secure in the data center where access would be very restrictive.

Security awareness should be given to the employees because of a recent study by economic times which got the report that 80 % of corporate security professionals and IT administrators said that it’s due to end user carelessness. As they are less concerned about the emails they open and data they share. Couple things which need to add to the employee’s security awareness education and training. As traditional methods of security education didn’t allow any change in the end user behavior which is found to be true.

-> Ensure executive and management buy-in into the program: The end user awareness program should be supported from the top executives to the low-level managers in the company. Once they fallow and lead the team, it would be good chances that every employee down the line follows the security guidelines for data security.

-> Make the security education with fun: If the training is done with the fun factor that observably will be in mind for a very employee as they get involved in it. As traditional power point is no more getting the attention of the employees. If they are done using gamification and interactive content then it would encourage everyone to follow.

-> Put some posters which employees go through getting the glimpse: As posters, interactive emails and blogs which helps to educate better. As the employee can go through them when they have some leisure time to spend.

-> Educating the security awareness with the social life of employee: If the education is given by relating to the social life of the employee so that they can discuss them with their family and friends.

-> By encouraging feedback's from the end users about the program: As getting feedbacks which makes the employees involved in this activity. This also helps to get to know the real-time problems at the end user.

Using the technology is definitely a boon as well as bane, for the organization it can be a major threat. Considering the scenarios where we have breaches going on very frequently, we must educate the employees on using the use technology. A breach can happen through a very minor input such as an email or clicking on a link. There are several authentication procedures used in and around the world and these infrastructures have been increasing hugely but still, it is highly difficult to ensure that we are secure. It is important to have them educated because they will close the path that leads to these security threats.

These would be the topics that should be included in the training and education. It is highly recommended that the users are made aware of the following:

Confidentiality- To create awareness about the importance of maintaining the confidential information. For example, if there is any competitive company that we would like to beat then we must make sure that our source or our practices are not out in open but are safely treasured in the organization.

Risk Analysis- To identify the risks associated with playing with the technology both to the employee as well as a company. If a person breaks the rules and clicks on emails with anonymous links then that is the violation and might be charged a certain punishment. In the same way, these incidents could provide valuable information to other companies that will cause a lot of trouble. Different forms of Security Breaches- They should include the different forms such as phishing emails, virus, spyware and so on.

Effects-The companies in the past that had gone through the security breaches and what it cost them should be explained to have a real-time knowledge.

Hence, a properly secured infrastructure and awareness can erase any such security threats. It is always best to prevent a problem then take a risk.