Information Security Awareness in an Organization

Information is considered lifeblood of a successful and profitable business and employees of the organization work as veins to pass this information through. Confidentiality, Availability and Integrity of information are then directly related with employee’s behavior towards information. Most kentico software development companies think information security is a technical issue and do not consider involvement of employees in ensuring continuous security of the information. Organizations may have components of information security awareness program but without proper management of the needed resources, they will not be able to complete it properly and continue to be successful. Identifying and bringing together all available components to develop an effective information security awareness program can be a difficult and overwhelming task.

Brief about Information Security Awareness

Information Security is the protection of information in opposition to fault, disclosure and manipulation. 

It is commonly accepted that the majority of the security violations are due to human interaction rather than technology fault. Yet, companies depend and grant a lot of consideration to technology and usually forget participation of human beings in the system. Usually organizations use best of the best products and technology for the protection of information and infrastructure. They ignore human’s contribution and role in securing organization assets. Actually kentico companies in India make this mistake and relate information security with the products and technology although it is a process which needs human interaction and involvement. There is no such thing as 100% security but we try to maximize its level through an awareness program and human involvement in the process. 

A simple definition of the three security pillars is as follows. If anyone of them is missing then it’s a flaw and is against the information security measures.

Confidentiality: It means only authorized people can see information e.g. you are the only one authorized to see your bank statement.

Integrity: It ensures that information has not been changed either in transit or while in storage. It means only authorized people can change the information e.g. you can see bank statement but not authorized to change it according to your wishes.

Availability: It means information is available when and where it is needed e.g. you can get money from ATM machine when you want to buy things.

Information Security Awareness is user’s education and awareness to handle information security threats and minimize their impact. Awareness program basically focuses attention on information security issues like confidentiality, integrity and availability. It highlights the importance of these factors, their role in business and finally concentrates on how to behave with them in a confident way.

“Awareness is not training. The purpose of awareness presentations is simply to focus attention on security. Awareness presentations are intended to allow individuals to recognize IT security concerns and respond accordingly.”

Information Security awareness is a method used to educate people in the organization such as a kentico cms company. It highlights the importance of information, threats to that information and staff’s contribution in implementing policies and procedures for the protection of information. Awareness program is an attempt to change the behavior of employees towards systems and processes in the organization. It teaches what needs to be protected, against whom and how.

Information Security Awareness is a Business Need

In today’s business environment most of the companies rely on electronically exchanged information. It is a requirement of all the departments to produce and pass information across different departments in a quick and secure manner to support their business decisions. Information plays an important role in making decisions. Therefore kentico companies in India and even the government departments have different classification of data based on its importance and use. 

Business success depends upon continuity of operations and information provided to the business processes by information systems. The growth, excellence and efficiency of the business could be damaged due to the threats and misuse of information. Therefore, awareness program basically helps, set measures and educate users on how to behave and get benefit out of information without jeopardizing its confidentiality, integrity and availability. 

The employees are the primary users of the information. A lack of awareness and mishandling of information could expose this information to competitors or get corrupted. If this information is freely available the following could be some of the impacts on the company and its business functions:

• The information available easily can be used by competitors to design strategies and launch new products with more features

• The company’s credibility can be affected from this disclosure

• Customer confidence can be lost

• Help competitors to gain more share in the market

• Suppliers and partner would be conscious to deal with the company

• Non compliance to government and industry laws and standards

• Employees will lose trust and will look for other opportunities

In today’s competitive business environment to have a good reputation in the market and legal compliance is a major concern. Suppliers, partners and even clients ask proof of information security before making any transaction. They want to make sure that all the information given to the company will be protected and will be used only for the purpose it is provided. 

Therefore need of successful and responsible organization is to have well written security polices and procedure, run information security awareness program on a continuous basis and be conscious in protecting its information assets. Implementing a strong information security awareness program can be a very effective method to protect critical business secrets and it will help employees to understand:

• Why they need to take information security seriously

• What they gain from active participation and support

• How a secure environment helps them complete their assigned tasks

Information Security Awareness Goals and Objectives

As we all know people are the weakest link in the chain and are the source of many information security breaches within the organization. Before demanding information security, employees should be conveyed the importance of a kentico software development company’s information and criticality. An educated and aware user is the foundation of a secure and reliable business environment. 

Dealing with information security threats and incidents is not a technology issue but people’s behavior. It is a critical factor to have a successful and effective information security program that will modify the behavior of employee’s dealing and interacting with company’s policies and procedures. 

Usually IT or Security department is considered responsible for the security of information assets. It is a misconception which has to be communicated among employees that the IT department is not the only one responsible but Information security is everyone’s responsibility. Information Security is everyone’s responsibility and at any level of the hierarchy.

Information security awareness program helps in minimizing the cost of security incidents, helps accelerate the development of new application systems, and helps assure the consistent implementation of controls across an organization’s information systems.

The primary and foremost objective of any awareness program is to educate users on their responsibility to protect the confidentiality, availability and integrity of their organization's information.

One of the objectives of an awareness program is to convey simple, clear and presentable message in a format that is easily understood by the audience.

The awareness program’s objective is that users understand not only how to protect the organization’s information, but why it is important to protect that information.

Awareness program’s goal is to get users attention on information security policies and increase awareness level on all security controls and practices in the organization such as a kentico cms company.

One of the goals is to create a security culture across the organization and keep on reminding employees about its importance and their contribution in that.

“Continuous improvement should always be the theme for security awareness and training initiatives, as this is one area where “you can never do enough.””

Summarizing, information security is a behavior and attitude rather than a technology issue. The only thing which can change is the behavior and thinking of the staff through awareness and education. People join organizations with their own beliefs, values, culture and principles. Information security awareness program facilitates those people to understand and take on the organization’s culture, values and ethics. 

This article describes the importance and the association of employees with information security awareness program, and motivational factor to attract employees to be responsive to this program. This is required and is the responsibility of all members in the organization such as a kentico cms company to protect the information assets.

An information security awareness program is a vital need within any organization that wishes to ensure privacy, security, authenticity, effectiveness and availability of information assets. The success of awareness program depends upon management’s consent and continuous support for a kentico company in India.

Bibliography

• https://www.pcisecuritystandards.org/documents/PCI_DSS_V1.0_Best_Practices_for_Implementing_Security_Awareness_Program.pdf
• http://www.deertech.com/e-news/march2013_1.html
• http://en.wikipedia.org/wiki/Security_awareness
• http://www.giac.org/paper/gsec/4340/organization-everyones-responsibility-information-security-awareness/107113

Courtesy: Sanika Taori