Is There Real Value in Having an Information Security Awareness Program?

by Skeleton Star

Absolutely... Here's Why:

• By creating and maintaining an Information Security Awareness Program as part of an overall Information Security Program, you can greatly increase employee participation in maintaining a safe and secure work environment.
• One of the primary corporate obligations is to protect Corporate Information, and Customer Information of which they are the custodians.

Every employee must understand corporate concern with Information Security, and it is management's responsibility to ensure that ALL personnel are made aware of pertinent practices, and the requirement to understand and heed them.

However, an effective Information Security Program cannot be solely defined in terms of trust. Rather, it must be based upon the same prudent business practices that applied to earlier manual systems; careful definition of individual responsibilities, separation of controls, maintenance of audit trails, protection of vital records, and access to information limited, based on "need-to-know".

An effective Information Security Program includes awareness, education, training, policies, procedures, controls, reviews, and especially, separation of responsibilities. However, good Information Security Practices require more than correct practices to be effective. They must have real and continued management backing and involvement. Management must be pro-active regarding Information Security Practices. They must let their people know it's important through example. They must take pride in their program. They must help bring about attitudinal changes in their people through; strongly administered security awareness programs; bringing about a clear understanding of the reasoning behind Information Security Practices; instilling real concern about Information Security; and instilling dissatisfaction with anything less than great Information Security.

---

Compensation Planning Tool All Businesses Need a Methodology to Compensate Their Employees Appropriately...

Video Headquarters Connecting Online People With Real-Life Videos... Find The Real Life Videos You Want Here...

---

In addition, to be successful with Information Security Practices, management must also organize their team so there are clearly defined roles and responsibilities, with no conflicts of interest. Separation of responsibilities must be an integral part of Information Security. Training must be provided as required.

Here are some suggestions on what your program should include:

• Information handling requirements for classifying data
• Procedures for data / media handling, retention, and disposal
• Computer resource abuse, and virus protection, detection, and reporting
• Physical security requirements for data and equipment
• Data and equipment import / export requirements
• Frequency and need for reviewing invalid log-on and violation reports
• Business Continuity / Disaster Recovery Planning
• Adherence to the laws and ethics that govern us, i.e., copyright infringement, software licensing, export compliance, etc.
• Employee safety / emergency training (for example, evacuation routes, shelter locations, hazardous material training, fire training, blood-borne pathogen awareness)

Here is the Return On Investment (ROI):

If you implement a Program you will enable the great results that will follow from fewer (maybe zero) information security incidents (this is the ROI $), to fewer (maybe zero) audit comments written during an IT audit, and at a minimum you will have accomplished the following:

• Improved the morale of employees by providing them with information they need to perform their jobs effectively.
• Presented Information Security issues to the company leadership team on a consistent basis so that Information Security is identified as important and integral to the way you do business.
• Helped to enable good audit reports by providing employees with knowledge on Information Security issues.
• Strengthened the relationship with your customer by reinforcing good Information Security practices.
• Made employees aware of their responsibilities.
• Helped to enable the protection of information / assets.
• Helped to enable timely recovery in the event of a disaster.

"An Ounce of Awareness is Worth a Pound of Cure!"

---

Skeleton Star is a business whose tagline is: "Providing Business Essentials... Making B2B Easy." Skeleton Star owns and operates several web sites of which the following is key to new entrepreneurs: Business Practices.

The author of this article, at one time, was an IT Staff Auditor for a Fortune 10 company, and later managed the global Information Security Program for the Information Technology organization that supported a Fortune 10 company. Reprinting and republishing of this article is granted only with the above credit included. Permission to reprint or republish does not waive any copyright or other rights.

---

Autopilot Money Machine Check This Out, But Don't Rub Your Eyes... My Friend Ewen Chia Just Made $549,784.82 On Complete Autopilot... And He Will Give You The Exact Same System To Do It Too! Prints 24/7 Profits For You... Automatically!...

Database of Articles Check This Out, But Don't Rub Your Eyes... If You Are Looking For Articles For Your Business Or Your Website You Will Not Believe The Fantastic Offer Being Made...