Hinnang veebipõhiste andmeturbe teadlikkuse kursustele
Files
Date
2016
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Veebipõhised Infojulgeoleku Teadlikkuse Kursused on tavapäraselt soovitatud \n\rküberjulgeoleku strateegiates, aitamaks konstrueerida julgeoleku kultuuri, mis oleks \n\rvõimeline adresseerima infosüsteemi rikkumisi, põhjustatud kasutajate vigade poolt, kelle \n\rhooletus või eeskirjade teadmatus võib ohtu seada infosüsteemide vara. Veebipõhiste \n\rInfojulgeoleku Teadlikkuse Kursuste mõju uurimises esineb lõhe - need ei muuda osavõtjate \n\rkäitumist olulisel määral, mis puudutab kuuletumist ja töökust, resulteerudes järjepidevates \n\rnõrkustes. Käesoleva töö eesmärk on panustada teoreetilise ja empiirilise analüüsiga \n\rVeebipõhiste Infojulgeoleku Teadlikkuse Kursuste potentsiaalsete tugevuste ja nõrkuste \n\rkohta. Samuti panustada kahe valmis rakendatava praktilise töövahendiga veebipõhiste või \n\rvahendatud andmejulgeoleku teadlikkuse ning õpetuse kursuste kujundajatele ja \n\rarvustajatele. Uuringu disain püüab vastata kahele uurimisküsimusele. Esimene on \n\rmiinimumkriteeriumi formuleerimise kohta, mida saaks rakendada Veebipõhistes \n\rAndmeturbe Teadlikkuse Kursustes, et toetada nende tõelist mõju töötajate kuuletumisele \n\rja töökusele, andes tulemuseks üksteist kriteeriumit kursuste hinnanguks ning \n\rkontrollnimekirja. Teine küsimus puudutab olemasoleva kursuse kuuletumise ja töökuse \n\rsuhtes tõelist mõju uurivat reguleeritud katset, kasutades kalastusründe meile hariduslike \n\rvahenditena, mis kinnitab eelnevalt tehtud teoreetilisi oletusi. Miinimumkriteeriumi \n\rarendamine ning selle süstemaatiline rakendamine taotleb muutusi käitumises, rõhutab \n\rditsiplinaarintegratsiooni tähtsust küberjulgeoleku uurimistegevuses ning propageerib \n\rkindla kuuletumise ja töökuse julgeoleku kultuuri, mis oleks võimeline toetama \n\rorganisatsioonide kaitset infosüsteemi ohtude eest. Selles uurimuses näidatud tulemused \n\rpakuvad, et positiivsete tulemuste saavutamine olemasolevates infojulgeoleku testides, \n\rmis järgnevad julgeoleku kursustele, ei näita tingimata, et need töökust või infojulgeoleku \n\reeskirjadele kuuletust mõjutaks. Need esialgsed järeldused koguvad tõendeid käesolevas \n\rtöös sõnastatud soovituste rakendamise tähtsuse kohta.\n\rVõtmesõnad:
Information security awareness web-based courses are commonly recommended in cyber security strategies to help build a security culture capable of addressing information systems breaches caused by user mistakes whose negligence or ignorance of policies may endanger information systems assets. A research gap exists on the impact of Information Security Awareness Web-Based Courses: these are failing in changing to a significant degree the behavior of participants regarding compliance and diligence, which translates into continuous vulnerabilities. The aim of this work is to contribute with a theoretical and empirical analysis on the potential strengths and weaknesses of Information Security Awareness Web-Based Courses and with two practical tools readily applicable for designers and reviewers of web-based or mediatized courses on information security awareness and education. The research design seeks to respond two research questions. The first on the formulation of a minimum set of criteria that could be applied to Information Security Awareness Web-Based Courses, to support their real impact on employee’s diligence and compliance, resulting in eleven criteria for courses’ assessment and a checklist. The second, about a controlled experiment to explore the actual impact of an existing course, in respect to diligence and compliance using phishing emails as educational tools, that reaffirms the theoretical assumptions arrived to earlier. The development of minimum criteria and their systematic implementation pursue behavioral change, emphasizes the importance of disciplinary integration in cyber security research, and advocates for the development of a solid security culture of diligence and compliance, capable of supporting the protection of organizations from information system threats. The results gathered in this study suggest that achieving positive results in the existing information security tests that follow security awareness courses does not necessarily imply that diligence or information security policies compliance are affected. These preliminary findings accumulate evidence on the importance of implementing the recommendations formulated in this work.
Information security awareness web-based courses are commonly recommended in cyber security strategies to help build a security culture capable of addressing information systems breaches caused by user mistakes whose negligence or ignorance of policies may endanger information systems assets. A research gap exists on the impact of Information Security Awareness Web-Based Courses: these are failing in changing to a significant degree the behavior of participants regarding compliance and diligence, which translates into continuous vulnerabilities. The aim of this work is to contribute with a theoretical and empirical analysis on the potential strengths and weaknesses of Information Security Awareness Web-Based Courses and with two practical tools readily applicable for designers and reviewers of web-based or mediatized courses on information security awareness and education. The research design seeks to respond two research questions. The first on the formulation of a minimum set of criteria that could be applied to Information Security Awareness Web-Based Courses, to support their real impact on employee’s diligence and compliance, resulting in eleven criteria for courses’ assessment and a checklist. The second, about a controlled experiment to explore the actual impact of an existing course, in respect to diligence and compliance using phishing emails as educational tools, that reaffirms the theoretical assumptions arrived to earlier. The development of minimum criteria and their systematic implementation pursue behavioral change, emphasizes the importance of disciplinary integration in cyber security research, and advocates for the development of a solid security culture of diligence and compliance, capable of supporting the protection of organizations from information system threats. The results gathered in this study suggest that achieving positive results in the existing information security tests that follow security awareness courses does not necessarily imply that diligence or information security policies compliance are affected. These preliminary findings accumulate evidence on the importance of implementing the recommendations formulated in this work.