Title: Security Education, Training and Awareness Program
Course: IN 2001 Principle of Information Assurance > Section: Module 5: Chapter Five

Security Education, Training and Awareness Program
1. As soon as the policies outlining the general security policy have been drafted, policies to implement security education, training and awareness (SETA) programs in the organization should follow.
2. The SETA program is a control measure designed to reduce the incidences of accidental security breaches by employees.
3. SETA programs are designed to supplement the general education and training programs that many organizations have in place to educate staff on information security.
4. Security education and training is designed to build on the general knowledge that employees possess to do their jobs and focus on ways to work securely.
5. The SETA program consists of three elements: security education, security training and security awareness.
6. The organization may not be capable of or willing to undertake all three of these elements, but it may outsource them.
7. The purpose of SETA is to enhance security by:
  - Improving awareness of the need to protect system resources
  - Developing skills and knowledge so computer users can perform their jobs more securely
  - Building in-depth knowledge, as needed, to design, implement or operate security programs for organizations and systems

Security Education
1. Everyone in an organization needs to be trained and aware of information security, but not every member of the organization needs a formal degree or certificate in information security.
2. When formal education for appropriate individuals in security is needed, with the support of management, an employee can identify curriculum available from local institutions of higher learning or continuing education.
3. A number of universities have formal coursework in information security.  (See, for example, Kennesaw State University "Center for Information Security").

Security Training
1. Security training involves providing members of the organization with detailed information and hands-on instruction designed to prepare them to perform their duties securely.
2. Management of information security can develop customized in-house training or outsource the training program.

Security Awareness
1. One of the least frequently implemented, but most beneficial programs is the security awareness program.
2. A security awareness program is designed to keep information security at the forefront of the users’ minds as they work day to day.
3. These programs don’t have to be complicated or expensive.
4. The goal is to keep information security in the users’ minds and to stimulate them to care about security.
5. If the program is not actively implemented, employees begin to “tune out” and the risk of employee accidents and failures increases.