ThomsonVonSolms1998_IMCS6_4_InfoSecAwarenessEducatingUsers.docx

167 Information security awareness: educating your users ef fectively M.E. Thomson Por t Elizabeth Technikon, Por t Elizabeth, South Africa R. von Solms Por t Elizabeth Technikon, Por t Elizabeth, South Africa This article investigates the evolution of computing, with specific reference to the security issuesinvolved. These issuesare then taken further to determine the need for education in the work- place through an information security awareness program. Techniques borrowed from the field of social psychology, which have been largely ignored in current awareness programs, are highlighted in order to show how they could be utilized to improve the effectiveness of the aware- ness program. Information Management & Computer Security 6 / 4 1998 167173 © MCB University Press ISS N 0968-5227 Introduction T h e u se of i nfo r m a ti o n t ec hn olo g y h a s c h a n ged d r a m a ti c a ll y ove r t h e ye a r s. T h e u se r p r ofile h a s a lso c h a n ged a cco r di n gl y f r o m a sit u a ti o n w h e r e a ll u se r s we r e co m- p u t e r o r i nfo r m a ti o n t ec hn olo g y spe ci a lists to a sit u a ti o n w h e r e m ost u se r s tod ay a r e b a r ely co m p u t e r lite r a t e. T h is a r ti cle w ill a tt e m pt to h ig h lig h t t h e r e a so n s w hy a n i nfo r- m a ti o n se c ur ity awa r e n ess p r og r a m s h o u ld e n jo y m o r e a tt e n ti o n i n a ll o r g a n is a ti o n s. It w ill a lso spe ll o u t t h e objec ti ves of s u c h a p r og r a m a n d t h e pot e n ti a l fo r u ti lisi n g psy - c h olo gic a l p r i n cip les to m ak e t h e p r og r a m m o r e effec ti ve. T h ese a r e p r i n cip les t h a t h ave bee n r efi n ed ove r m a n y ye a r s of r ese a r c h i n t h e soc i a l psy c h olo g y a r e n a, b u t w h ic h h ave bee n l a r gely ig n o r ed by IT p r ofessio n a ls w h e n de velo pi n g i nfo r m a ti o n se c ur ity awa r e- n ess p r og r a m s (K a b ay, 1994, p. 1). Technological advances T h e t ec hn ic a l de velo p m e n t of t h e co m p u t e r a n d a ss oc i a t ed dis cip li n es h a s pl ayed a l a r ge r ole i n t h e p r ofile a n d i nvol ve m e n t of t h e u se r. A des c r ipti o n of so m e of t h ese a dv a n ce s a n d t h ei r i n fl u e n ce o n t h e e n d-u se r w ill h elp to un de r st a n d t h e c ur r e n t sit u a ti o n . T h ese a dv a n ce s w ill be di vided i n to t hr ee st a ges of de velo p m e n t to h ig h lig h t t h e sit u a ti o n of t h e typi c a l IT u se r i n a n o r g a n is a ti o n . Standalone mainframe computing T h is fo r m of co m p u ti n g wa s u sed w h e n co m- p u t e r s we r e fi r st i n t r od u ce d i n b u si n ess . T h e m a c h i n e r y wa s ex t r e m ely l a r ge a n d s u sce pti - ble to e nvi r o nm e n t a l co n diti o n s. T h e r es u lt wa s t h a t it h a d to be h o u sed i n a co m ple t ely se p a r a t e b u ildi n g; h e n ce t h e t e r m st a n d a lo n e co m p u ti n g (Sc h a effe r, 1987, p. 113). W h e n t h is fo r m of co m p u ti n g wa s u sed , t h e se c ur ity co n side r a ti o n s we r e r el a ti vely e a sy to s a tis fy a s t h e follo w i n g w ill i n di c a t e: T h e co m p u t e r ce n t r e wa s h o u sed i n a co m- ple t ely se p a r a t e b u ildi n g. A n yo n e n eedi n g to u se t h e co m p u t e r h a d to be i n t h e co m- p u t e r ce n t r e b u ildi n g; h e n ce p hysi c a l a cce ss co n t r ol wa s t h e m ajo r se c ur ity co n- side r a ti o n . Ge n e r a ll y, t h e typ e of syste m s i n u se we r e si n gl e u se r, i.e. o n ly o n e pe r so n a t a ti m e co u ld wo r k o n t h e m a c h i n e. A n yo n e e n t e r- i n g t h e b u ildi n g wo u ld h ave bee n sc r ee n ed by t h e a cce ss co n t r ol de vi ce a t t h e e n t r a n ce to t h e b u ildi n g, t h e r eb y eli m i n a ti n g t h e n eed fo r a n y fo r m of u se r a u t h e n ti c a ti o n . T h e m ajo r t hr e a ts to t h e co m p u t e r we r e of a n e nvi r o nm e n t a l n a t ur e, i.e. floo ds, e a r t h- q u ak es , fi r es, a n d civi l dis o r de r s. It wa s r el a ti vely e a sy to t ak e p r ec a u ti o n s to m i n- i m ise t h ese t hr e a ts . T h e b u ildi n g co u ld be sit u a t ed i n a n a r e a s afe f r o m floo di n g a n d f r ee of a n y seis m olo gic a l a cti vity. F i r e dete cti o n a n d ex ti n g u is h i n g eq u ip m e n t we r e a lso ve r y effec ti ve. As c a n be see n , t h e t hr e a ts to t h is fo r m of co m p u ti n g we r e of a p hysi c a l n a t ur e a n d ve r y effec ti ve p r ec a u ti o n s co u ld be t ak e n to m i n- i m ise t h e m to a n a cce pt a ble level. All co m- p u t e r p r og r a m s we r e p r oce ssed i n a se c ur e p hysi c a l e nvi r o nm e n t. Elec t r o n ic a ll y, it wa s di ffic u lt fo r a n y p a r ty to g a i n un a u t h o r ised a cce ss to a n y d a t a. T h e u se r s of i nfo r m a ti o n posed n o se c ur ity t hr e a t to t h e i nfo r m a ti o n , be c a u se n o u se r h a d a n y a cce ss to a n y d a t a elec t r o n ic a ll y. U nfo r t un a t ely (f r o m a se c ur ity vie wp oi n t), t h e u se of co m p u t e r s evol ved fur t h e r, r e n de r i n g t h ese se c ur ity p r ec a u ti o n s obs ole t e, a n d fur t h e r se c ur ity m e a s ur es we r e n eeded . Multi-user computing environment T h is fo r m of co m p u ti n g b r o u g h t w it h it n ew t hr e a ts w h ic h n eeded to be co un t e r ed , spe cifi- c a ll y t h e follo w i n g (S h ell ey et a l., 1992, p. 7.16): m o r e pe ople we r e a ble to wo r k o n t h e m a c h i n e a t t h e s a m e ti m e, a n d n ot a lwa ys w it h i n t h e co n fi n es of t h e co m p u t e r ce n t r e; a cce ss co n t r ol to t h e co m p u t e r ce n t r e wa s n o lo n ge r a deq u a t e to dete r m i n e t h e v a lid- ity of u se r s, si n ce wo r k st a ti o n s we r e n ow sit u a t ed i n t h e u se rs wo r k e nvi r o nm e n t; u se r s we r e a llo wed a cce ss to co m p u t e r syste m s elec t r o n ic a ll y; m a n y co m po n e n ts we r e s h a r ed , e.g. m e m- o r y, d a t a b a ses , p r i n t e r s, e tc. T h ese se c ur ity co n side r a ti o n s we r e l a r gely eli m i n a t ed by t h e i m ple m e n t a ti o n of a u se r a u t h e n ti c a ti o n syste m o n t h e m a c h i n e. All u se r s we r e a lloc a t ed a u se r ide n ti fic a ti o n 168 M.E. Thomson and R. von Solms Information security awareness: educating your users ef fectively Information Management & Computer Security 6 / 4 1998 167173 (u se r id ) a n d a p a ss wo r d. T h is u se r id a n d p a ss wo r d we r e u sed to ide n ti fy a n d a u t h e n ti- c a t e a u se r s u cce ss fu ll y. B a sed o n t h is s u c- ce ss fu l a u t h e n ti c a ti o n , t h e ope r a ti n g syste m p r ovided a u t h o r is a ti o n to t h e u se r to u ti lize syste m objec ts . T h e wo r k st a ti o n s i n u se a t t h is ti m e we r e d um b t e r m i n a ls (a ll i n t ell i- ge n ce r esided o n t h e ce n t r a l co m p u t e r ) a n d it w a s r el a ti vely e a sy to r es t r ict u se r s to wo r k i n ce r t a i n a r e a s. T h is typ e of se c ur ity w a s t e r m ed t ec hn ic a l si n ce t h e ope r a ti n g syste m o n t h e m a c h i n e w a s e nfo r ci n g t h e se c ur ity. At t h is p h a se of co m p u t e r evol u ti o n , p hysi c a l a n d t ec hn ic a l se c ur ity m e a s ur es we r e a deq u a t e to e n s ur e effec ti ve i nfo r m a ti o n se c ur ity. Personal computers and networks T h e a dve n t of t h e pe r so n a l co m p u t e r, a s well a s t h e i n c r e a si n g co m plexity a n d r eli a bi lity of n e tw o r k s, h a s b r o u g h t a bo u t a g r e a t c h a l- le n ge i n t h e a r e a of i nfo r m a ti o n se c ur ity : t h e de c r e a si n g p r ice a n d i n c r e a si n g c a p a- bi lities of pe r so n a l co m p u t e r s r es u lt ed i n m a n y pe ople i n t h e o r g a n is a ti o n a cq u i r i n g t h ese m a c h i n es ; t h e eve r i n c r e a si n g n um be r of softw a r e de velo p m e n t p a c ka ges av a il a ble m a de it possib le fo r t h ese pe ople to st a r t de velo pi n g t h ei r ow n syste m s; t h e k n owled ge g a i n ed f r o m de velo pi n g t h ese syste m s co u ld oft e n give t h e m t h e c a p a bi lity to ci r c um ve n t se c ur ity m e a s ur es b u ilt i n to t h e c ur r e n t syste m s; t h e eve r i n c r e a si n g u se of t h e I n t e r n e t m e a n t t h a t t h e r e we r e pot e n ti a l t hr e a ts f r o m o u tsid e t h e o r g a n is a ti o n . T h e a bove iss u es co m bi n ed w it h t h e fa ct t h a t i nfo r m a ti o n syste m s a r e be co m i n g m o r e a n d m o r e c r u ci a l to t h e s u cce ss fu l d a ily ope r a- ti o n s of m a n y o r g a n is a ti o n s h a s b r o u g h t a bo u t t h e n ext m ajo r a dv a n ce i n i nfo r m a ti o n se c ur ity, n a m ely t h a t t h e p r ofile of t h e e n d- u se r is c h a n gi n g. T h e p r ofile of t h e u se r h a s c h a n ged s u bst a n ti a ll y i n t h a t p r evi o u sly t h e u se r w a s ve r y oft e n a pe r so n lo we r dow n i n t h e o r g a n is a ti o n a l st r u ct ur e w h ose m a i n p ur pose w a s to e n t e r d a t a t h a t wo u ld be u sed a t a l a t e r st a ge by so m eo n e h ig h e r u p t h a n t h e m se lves . T h is sit u a ti o n h a s g r a d u a ll y evol ved to t h e c ur r e n t sit u a ti o n w h e r e t h e m a n a ge r i a l pe ople oft e n n eed a cce ss to i nfo r- m a ti o n o n a “ m u st h ave n ow ” b a sis be c a u se of t h e co m petiti ve n ess of b u si n ess . T h e y a lso oft e n de velo p t h ei r ow n s m a ll syste m s to i n t e r p r e t d a t a a cq u i r ed f r o m o n e of t h e m is- si o n c r iti c a l syste m s. T h e d a t a e n t r y p a r ty is a lso oft e n m o r e co m p u t e r k n owled ge a ble t h a n p r evi o u sly. T h is sit u a ti o n co u ld h ave t h e r es u lt t h a t t h ese pe ople co u ld g a i n a cce ss to o r m odi fy d a t a t h a t t h e y we r e n ot s u pp osed to, w h e t h e r it be i n t e n ti o n a l o r a cc ide n t a l. T h is i n c r e a si n g sop h isti c a ti o n of t h e u se r co m bi n ed w it h t h e n eed to g r a n t t h e m a cce ss to t h e i nfo r m a ti o n t h a t t h e y r eq u i r e m e a n s t h a t it is n o lo n ge r possib le to m a i n t a i n effec- ti ve i nfo r m a ti o n se c ur ity w it h p hysi c a l a n d t ec hn ic a l co n t r ol s a lo n e. It is n ow n ecess a r y to ed u c a t e t h e u se r s i n t h e dis cip li n e of i nfo r m a ti o n se c ur ity. T h ei r be h avi o ur h a s to be m odi fied to s u c h a de g r ee t h a t t h e y c a r r y o u t t h ei r d ay-to-d ay a cti vities i n a se c ur ity s u pp o r ti n g m a nn e r. It is i m po r- t a n t t h a t t h is be h avi o ur be s u bco n scio u s, i.e. t h e y m u st c a r r y it o u t w it h o u t h avi n g to t h i n k a bo u t w h a t t h e y a r e doi n g. Fo r ex a m ple si g n i n g off w h e n eve r t h e y le ave t h ei r office, e n s ur i n g t h a t t h ei r p a ss wo r d is n ot a cce ssib le to ot h e r e m plo yees , e n s ur i n g t h a t i nfo r m a- ti o n o n t h e sc r ee n is n ot visib le to a n yo n e t h a t s h o u ld n ot see it , m ak i n g r e g u l a r b a c k u ps of i m po r t a n t d a t a, e tc. I n o r de r to a c h ie ve t h is a n i nfo r m a ti o n se c ur ity aw a r e n ess p r og r a m n eeds to be un de r t ak e n i n eve r y o r g a n is a ti o n . T h is p r o- g r a m w ill ed u c a t e u se r s i n i nfo r m a ti o n se c u- r ity iss u es , a n d w ill a lso co n ti n u a ll y r e m i n d u se r s of t h e iss u es a n d a n y n ew iss u es w h ic h m ay h ave be co m e r elev a n t. T h e objec ti ves of t h is se c ur ity aw a r e n ess p r og r a m w ill be to c h a n ge t h e ide a s a n d be h avi o ur of t h e u se r; t h e r efo r e t h e aw a r e n ess p r og r a m m u st be st r u ct ur ed i n s u c h a w ay t h a t t h e u se rs be h avi o ur a n d a ttit u des a r e m odi fied to e n s ur e t h a t t h ei r a cti o n s a r e se c ur ity co n- scio u s. T h e a bove cle a rly s h ow s t h a t i nfo r m a- ti o n se c ur ity h a s n ow be co m e ve r y r eli a n t o n ope r a ti o n a l m e a s ur es (t h e u se rs be h avi o ur ) a s well a s t h e t ec hn ic a l a n d p hysi c a l m e a- s ur es h ig h lig h t ed e a rlie r. T h e dis cip li n e of soc i a l psy c h olo g y h a s, ove r m a n y ye a r s, co n d u ct ed r ese a r c h i n to t h e a r e a of s u cce ss fu ll y c h a n gi n g t h e a ttit u de a n d be h avi o ur of pe ople, a n d t h e r es u lts of t h is r ese a r c h s h o u ld h elp to m ak e a n y se c ur ity aw a r e n ess p r og r a m m o r e effec ti ve. I n t h e n ext se cti o n so m e of t h ese t ec hn iq u es de velo ped i n t h e soc i a l psy c h olo g y a r e a a r e i n t r od u ce d. T h ese t ec hn iq u es co u ld p r ove u sefu l w h e n a pp lied to a n i nfo r m a ti o n se c u- r ity aw a r e n ess p r og r a m . The application of social psychology F ig ur e 1 r e p r ese n ts t h e typi c a l a ttit u de sys - t e m w h ic h a ll pe ople h ave. T h is a ttit u de sys - t e m w ill h elp to exp l a i n t h e di ffe r e n t a spe cts i nvol ved i n dete r m i n i n g t h e w ay a pe r so n w ill be h ave i n a give n sit u a ti o n (Zi m b a r do a n d Le ippe , 1991, p. 32). 169 M.E. Thomson and R. von Solms Information security awareness: educating your users ef fectively Information Management & Computer Security 6 / 4 1998 167173 Figure 1 An att itude system Behaviour Intentions The plan to act in a cer tain way prior to doing so Behaviour The actual behaviour exhibited in a given situation Attitude Overall evaluation. Includes all other components Cognitions Ideas, beliefs, and knowledge on how one should behave in a given situation Affective Responses Emotions or “gut feelings” Ce n t r a l to eve r yt h i n g is t h e a ct u a l a ttit u de itse lf, b u t i n t e r r el a t ed to it a r e a n um be r of ot h e r fa cto r s: Beh a viou r i n ten tion s: t h is r efe r s to t h e pe r- so ns i n t e n ti o n to be h ave i n a ce r t a i n m a n- n e r un de r ce r t a i n co n diti o n s; Beh a viou r: t h is is t h e a ct u a l be h avi o ur ex h ibited by t h e pe r so n i n a give n sit u a ti o n , n ot n ecess a r ily t h e s a m e a s t h ey i n t e n ded to be h ave i n t h a t sit u a ti o n; Cog n iti on s: t h is r efe r s to a pe r so ns k n owl- ed ge a n d be liefs of h ow o n e s h o u ld be h ave i n a give n sit u a ti o n; A ffecti ve respon ses: t h ese a r e t h e e m oti o n a l o r “g u t fee l” r e a cti o n s s h ow n i n a n y give n sit u a ti o n . F ig ur e 1 cle a rly s h ow s t h a t a ll t h e a r e a s h ig h- lig h t ed a r e i n t e r r