Domain 1. Security and Risk
Management. Security Education,
Training, and Awareness
Security Education, Training, and Awareness - answer Security awareness training,
security training, and security education are three terms that are often used
interchangeably but are actually three different things.
Awareness training reinforces the fact that valuable resources must be protected by
implementing security measures.
Levels Required - answer Security training teaches personnel the skills to enable them
to perform their jobs in
a secure manner.
Awareness training and security training are usually combined as security awareness
training, which improves user awareness of security and ensures
that users can be held accountable for their actions.
Security education is more independent
and is targeted at security professionals who require security expertise to act as in-
house experts for managing the security programs.
Awareness training is the what, security training is the how, and security education is
the why.
Security awareness training should be developed based on the audience.
In addition, trainers must understand the corporate culture and how it will affect security.
The audiences you need to consider when designing training include high-level
management,
middle management, technical personnel, and regular staff.
For high-level management, the security awareness training must provide a clear
understanding of potential risks and threats, effects of security issues on organizational
reputation and financial standing, and any applicable laws and regulations that pertain
to the organization's security program.
