That training addresses threats in the nature of malicious intrusion from external entities, malicious intrusion and misuse of information access or system credentials from the inside; and malicious intrusion attempts to gain access to systems and information through social engineering methods (Boyce, 2008; Kizza, 2009). In our organization, the ISO schedules IT security training sessions for the entire staff and also establishes security certification schedules that require all employees to complete and pass online tutorials by specific dates.
Discussion Question 3 -- Appropriate INFOSEC Trainings in Organizations
Generally, in-person group classes and individual online tutorials are the most common types of INFOSEC training programs within business organizations (Boyce, 2008; Kizza, 2009). Naturally, different types of organizations have different INFOSEC requirements and concerns and they reflect the types of training that are appropriate...
To determine the specific kinds of INFOSEC training that is necessary for each member of the staff, the individual responsible for IT security oversight, (in our case, the ISO), must consider the types of information to which each individual or each department requires access and then assign the level of INFOSEC training that is appropriate to that level of system and information access and to the levels of access that correspond to those departments or to individual needs (Boyce, 2008; Kizza, 2009).
References
Boyce, J. (2008). Information Assurance: Managing Organizational IT Risks. St. Louis,
MO: Elsevier.
Kizza, J.M. (2009). Computer Network Security. New York: Springer.
Personick, S.D. And Patterson, C.A. (2007). Critical Information Infrastructure
Protection and the Law: An Overview of Key Issues. Washington, DC:…
