Improving Security Awareness and Ownership using a method based on Action Research

ENGELSK: Despite the security training and hours spent in educating users, security tests implemented by the security department show that employees in Norsk Tipping have broken the security guidelines stated in the overall security policy. The security education has been done in large groups of employees and the security department wants to develop the security education and test a new method for awareness training in Norsk Tipping. One of the key features in this education is that the employees should be able to participate more in the education and to have the opportunity for a security dialogue in the organization. The hypothesis for this thesis is that a method based on action research can improve security awareness amongst the employees. Based on literature review and the guidelines provided from the security department a method based on principles from action research seemed promising and would be suitable as method for the security department in Norsk Tipping. The method that was designed in this project was based on four small-group interventions with employees and their line manager in Norsk Tipping. The core concepts in these sessions were co-generation of knowledge and have opportunity to discuss situations provided by the employees. This should make the content more understandable for the employees. By adopting security categories from the ISO/IEC 27001 standard and a cognitive classification from the educational research the method was intuitive and adjustable for Norsk Tipping. The project resulted in a method that was easy to understand for the participants. The evaluation identified that all of the employees found this method positive and several of the employees explained that the dialogue was interesting and the content was more understandable. The group interventions also identified several areas where employees should improve awareness. The security department did also get new knowledge about the different roles to the participants. The method can be used to adjust the security education for the employees in the future