The behavior of employees with access to data affects information systems and assets. Employee and contractor behavior is the primary source of costly data breaches. It's also the best way to prevent loss.
Security can't be guaranteed. As Clint Eastwood once said, "If you want a guarantee, buy a toaster." The only secure system is one that's unplugged, turned off, and in a locked room.
Since it's not practical to leave our systems turned off, we need to understand the risks to our systems and prepare ourselves to defend them. Preparation begins with understanding — and that's where awareness comes in.
With all the news stories about hackers, botnets, and breaches involving personal information, it's easy for the security message to sound over-used and tired. It's easy for people to say, "It won't happen here." Yet, studies and surveys repeatedly show that: the human factor (what employees do or don't do) is the biggest threat to information systems and assets.
The best way to achieve a significant and lasting improvement in information security is not by throwing more technical solutions at the problem — it's by raising awareness and training and educating everyone who interacts with computer networks, systems, and information in the basics of information security.
Laws requiring security and privacy awareness or training programs apply to:
The Federal Information System Security Managers' Act (FISMA) requires government agencies to report on their security awareness and training efforts annually.
NIST SP 800-53, Recommended Security Controls for Federal Information Systems, addresses controls that Federal organizations are required to implement for unclassified information systems. One of those controls is "security awareness training."
National Institute of Standards and Technology (NIST) SP 800-53 also says that the awareness program must comply with: 5 Code of Federal Regulations (C.F.R.) Part 930.301 and NIST SP 800-50, Building an Information Technology Security Awareness and Training Program.
5 C.F.R. Part 930.301 states that everyone must receive initial awareness training before accessing systems and refresher training at least annually. It defines 5 specific roles that must receive awareness training:
The NIST Guide for Developing Security Plans for Information Technology Systems states that plans should include the:
OMB Circular A-130, Appendix III, requires that system users receive security awareness instruction prior to being granted access to the system, and it requires periodic refresher training for continued access.
The NIST Computer Security Handbook cites the importance of managers to understand security consequences and costs so that they can factor security into their decisions.