An Information Security Training and Awareness Approach (ISTAAP) to Instil an Information Security- Positive Culture

This paper proposes a unique information security training and awareness approach (ISTAAP) that can be used to instil an information security-positive culture which will assist in addressing the risk that human behaviour poses to the protection of information. An information security culture assessment tool is used as the critical diagnostic instrument to assess the information security culture within the context of ISTAAP. A case study is discussed where the ISTAAP was deployed. This provided empirical data to illustrate the value of ISTAAP to direct employee behaviour through focused training and awareness based on the outcome of the information security culture assessment data