WHy do we need information security Awareness?

 Employee and contractor behavior is the primary source of costly data breaches. It's also the best way to prevent loss.
 A new device electronic device security cannot be guaranteed except if unplugged and locked in a private place.

Since it's not practical to leave our systems turned off, we need to understand the risks to our systems and prepare ourselves to defend them.  Preparation begins with understanding — and that's where awareness comes in.

With all the news stories about hackers, botnets, and breaches involving personal information, it's easy for the security message to sound over-used and tired.  It's easy for people to say, "It won't happen here." Yet, studies and surveys repeatedly show that: the human factor (what employees do or don't do) is the biggest threat to information systems and assets.

The best way to achieve a significant and lasting improvement in information security is not by throwing more technical solutions at the problem — it's by raising awareness and training and educating everyone who interacts with computer networks, systems, and information in the basics of information security.
Awareness Isn't Just a Good Idea, It's the Law.

Laws requiring security and privacy awareness or training programs apply to:

    The Federal Government (Federal Information System Security Managers' Act)
    The health care industry (Health Insurance Portability and Accountability Act)
    Financial institutions (Gramm-Leach-Bliley Act and Sarbanes-Oxley Act)
    Publicly-traded companies (Sarbanes-Oxley Act)
    Ecommerce Business (PCI-DSS)

 it is important that everyone should receive initial awareness training before accessing systems and refresher training at least annually. Categories of people that need the awareness:

    All users — security basics

    Executives — security basics and policy level training in security planning and management

    Program and functional managers — security basics and management and implementation level training in security planning and system/application security management, system/application life cycle management, risk management, and contingency planning.

    Chief Information Officers (CIOs), IT security program managers, auditors, and other security-oriented personnel (e.g., system and network administrators, and system/application security officers) — security basics and broad training in security planning, system and application security management, system/application life cycle management, risk management, and contingency planning.

    IT function management and operations personnel — security basics; management and implementation level training in security planning and system/application security management, system/application life cycle management, risk management, and contingency planning.

It is essential that system users receive security awareness instruction prior to being granted access to the system, and it requires periodic refresher training for continued access.