Creating a Security Education, Training, and Awareness Program

Abstract

Security training and awareness is often overlooked or not given sufficient focus in many organizations despite being a critical component of a layered defense. Organizations often purchase expensive hardware and software to help secure their organization, but fail to allocate resources to train employees who will install and configure the product. Similarly, organizations will devote many hours developing polices and procedures to protect sensitive information, but fail to allocate the appropriate resources to ensure awareness of those policies and procedures. This chapter discusses how to design, create, and implement a formal security education, training, and awareness (SETA) program as a component of a layered defense strategy.