Security programmes cannot succeed without considering people
When implementing security polices, information security professionals are constantly faced with a conflict between the security team and the rest of the business. They must ensure that their organisation is adequately addressing information security risks, whilst also communicating the value of security appropriately.
David Ferbrache, Technical Director at KPMG UK, says “No approach can ever succeed without considering people – and as a profession we need to look beyond our computers to understand the business, the culture of the organisations, and, most of all, how we can create a security environment which helps people feel free to actually do their job.”
By gaining an understanding of the psychology of information security, you can ensure your security programme is a success.
Augusta University’s Cyber Institute adopted the book “The Psychology of Information Security” as part of our Master’s in Information Security Management program because we feel that the human factor plays an important role in securing and defending an organization…We want our students to not only understand technical and managerial aspects of security, but psychological aspects as well.”
-Director of Graduate Studies in Information Security Management, Augusta University
Understand human behaviour and users’ motivations
Based on insights gained from academic research and interviews with security professionals from various sectors, this essential guide explains the importance of careful risk management and reveals how to align a security programme with wider business objectives, providing methods and techniques to engage stakeholders and encourage buy-in.
The Psychology of Information Security redresses the balance by considering information security from both end users’ and security professionals’ perspectives, and helps you to understand how a security culture, that puts risk into context, promotes compliance.
Look inside this book
Contents
- Introduction to information security
- Risk management
- The complexity of risk management
- Stakeholders and communication
- Information security governance
- Problems with policies
- How security managers make decisions
- How users make decisions
- Security and usability
- Security culture
- The psychology of compliance
- Conclusion – Changing the approach to security
- Appendix: Analogies
