The role of employees in ensuring information security - case study of employee behaviour in two national institutes from the public health field

Razvoj informacijsko-komunikacijskih tehnologij je poleg številčnih prednosti za organizacije prinesel tudi veliko novih tveganj in groženj na področju informacijske varnosti. Vprašanje informacijske varnosti in posledično zaščite premoženja v obliki podatkov je postala pomembna tema sodobnih organizacij. Pri zagotavljanju informacijske varnosti sta poleg programske in strojne podpore ključnega pomena odnos in ustrezno obnašanje zaposlenih, tako pri preprečevanju kot tudi ravnanju v primeru informacijskih varnostnih incidentov. V magistrskem delu smo preučevali vlogo zaposlenih pri zagotavljanju informacijske varnosti v Nacionalnem laboratoriju za zdravje, okolje in hrano ter Nacionalnem inštitutu za javno zdravje. Cilj je bil analizirati stopnjo zavedanja zaposlenih pri zagotavljanju informacijske varnosti in ugotavljati njihovo usposobljenost, da sledijo pravilom in zahtevam, ki jih za to področje postavljata organizaciji. V teoretičnem delu smo preučili teorijo s področja informacijske varnosti, potencialnih informacijskih groženj ter informacijske kulture. V empiričnem delu pa smo s pomočjo anonimnega vprašalnika izvedli spletno anketo, v katero smo vključili zaposlene iz Nacionalnega laboratorija za zdravje, okolje in hrano ter z Nacionalnega inštituta za javno zdravje. Rezultati izvedene raziskave so pokazali, da se zaposleni v obeh organizacijah sicer zavedajo nujnosti visoke stopnje informacijske varnosti, vendar pa se je izkazalo, da so premalo usposobljeni in da ne poznajo vseh pravil in ukrepov, ki sta jih za to področje postavili obe organizaciji.The development of information and communication technologies has brought numerous advantages to organizations but also many new risks and threats in the field of information security. The issue of information security and consequently the protection of property, in form of data, has become an important topic for modern organizations. Besides software and hardware support the attitude and proper behaviour of employees, both in terms of prevention and handling of information security incidents, is of key importance when it comes to ensuring a high level of information security. In the master\u27s thesis, we studied the role of employees at the National Laboratory of Health, Environment and Food and the National Institute of Public Health in providing information security. The aim was to analyse the degree of awareness of employees in providing information security and to determine their ability to follow the rules and requirements set by the organization in this field. In the theoretical part, we examined the theory of information security, potential information threats and information culture. In the empirical part, an anonymous questionnaire was carried out with the help of an online survey in which we included employees of the National Laboratory of Health, Environment and Food and the National Institute of Public Health. The results of the conducted research showed that the employees in both organizations are aware of the necessity of a high-level information security, but they have also proven to be underqualified and not familiar with all the rules and measures put forward by both organizations in this field