Information Security And Employee Behaviour: How to Reduce Risk Through Employee Education, Training And Awareness [Hardcover]

Angus Mcilwraith (Author)

Book Description

ISBN-10: 0566086476 | ISBN-13: 978-0566086472 | Publication Date: February 2006

Research suggests that between 60-75 per cent of all information security incidents are the result of a lack of knowledge and/or understanding amongst an organization's own staff. And yet the great majority of money spent protecting systems is focused on creating technical defences against external threats. Angus McIlwraith's book explains how corporate culture affects perceptions of risk and information security, and how this in turn affects employee behaviour. He then provides a pragmatic approach for educating and training employees in information security and explains how different metrics can be used to assess awareness and behaviour. Information security awareness will always be an ongoing struggle against complacency, problems associated with new systems and technology, and the challenge of other more glamorous and often short term priorities. "Information Security and Employee Behaviour" will help you develop the capability and culture that will enable your organization to avoid or reduce the impact of unwanted security breaches.

Editorial Reviews

About the Author

Angus McIlwraith has worked in the field of Information Security and Business Control for 20 years. He has for many years held (and broadcast) the view that Information Security is not making best use of time and resources by failing to address some fundamental issues. By not doing so, time and money is wasted; in some extreme circumstances, lives are being put at risk unnecessarily. Angus' professional experience was gained mainly in Financial Services. He has worked for Lloyds Bank, American Express, NatWest Bank and Standard Life, as well as working as a consultant to a wide range of international organisations. He has spoken at many conferences, including numerous Information Security Forum (ISF) Congresses, the London based COMPSEC conference, the Institute of Internal Auditors annual conference and the British Computer Society Information Security Specialist Group (BCS ISSG). Angus was an elected Member of the ruling Council of the ISF for eight years and was a member of the UK based Banking Information Security Expert Panel (BISEP). He writes regularly for many publications. He held a monthly column in Information Security Management magazine, and provided a monthly piece in Secure Computing magazine for many years.

Product Details

• Hardcover: 169 pages
• Publisher: Gower Pub Co (February 2006)
• Language: English
• ISBN-10: 0566086476
• ISBN-13: 978-0566086472
• Product Dimensions: 9.4 x 6.9 x 0.9 inches
• Shipping Weight: 13.4 ounces (View shipping rates and policies)
• Average Customer Review: 3.0 out of 5 stars  See all reviews (1 customer review)
• Amazon Best Sellers Rank: #1,603,895 in Books (See Top 100 in Books)

More About the Author

Discover books, learn about writers, read author blogs, and more.

Customer Reviews

Most Helpful Customer Reviews

1 of 1 people found the following review helpful:

3.0 out of 5 stars Interesting, good to know, but lacks practicality, March 23, 2006

By 

Lea K. Kivi - See all my reviews
(REAL NAME)   

Amazon Verified Purchase

This review is from: Information Security And Employee Behaviour: How to Reduce Risk Through Employee Education, Training And Awareness (Hardcover)

Angus McIlwraith's book "Information Security and Employee Behaviour" is interesting and well-written, but not enormously useful with regard to the practical matter of implementing a security awareness program.

The first section, "A Framework For Understanding", succeeds in presenting important individual and group psychological factors to consider when seeking to change employee behavior.

However, the second section, "A Framework For Implementation" just gives high-level implementation steps and then describes in great detail only two aspects of implementing a security awareness program - measuring awareness, and choosing delivery media. No practical methodologies are presented. One has the sense that there are several chapters missing. It would have been a more useful book if all five steps in developing an awareness program proposed by the author in chapter 4 had been elaborated upon.

If you are someone looking for practical help in putting together an entire security awareness program, by far the best book out there at this point is "Managing an Information Security and Privacy Awareness and Training Program by Rebecca Herold.