Evaluating human factors of information security awareness in Taibah University

Abstract

Information security for organizations such as educational sectors is gaining more importance as the implementation of technical solutions deployed to increase business efficiency. Information security technological implementation is insufficient to withstand threats that evolve with wider implementations of technologies the more technology is implemented the more threat probability pushes in. The fact that information security relies on three ties which are the technology, process and people. Processes can govern people behaviour by policies, however people still need a broader understanding of process and technology to be aware of expected threats and how their attitude and behaviours are going to evolve. Information security awareness indicates the understanding and behaviour of in information security. The information security awareness of employees should be measured to improve control strategies such as training or to determine the security maturity of an organization. In this research an adequate instrument, the Human Aspects Information Security Questionnaire (HAIS-Q). This instrument was administered to employees and students of Taibah University by an online web-based survey testing the knowledge, attitudes and behaviour across the models seven policy-based focus areas. Initial results indicate that HAIS-Q to be valid, reliable and suitable for comparable analysis. The model is able to measure information security awareness in its seven coverage focus areas. Results obtained indicated above average ISA level on tested sample using HAIS-Q model .