Conducting Interactive Activities to Enhance the Information Security Culture of the Organisation's Staff

Social engineering is one of the most common threats to the information security of commercial firms, government and other organisations. Various technical and administrative protection mechanisms can be applied to reduce the risks associated with social engineering. This paper proposes an approach to designing measures to improve information security culture based on employee training and behavioural monitoring. Employees in the financial and IT sectors were tested using the proposed framework. Training and subsequent series of coordinated test attacks were used to simulate the actual activities of the attackers and monitor the employees’ reactions to them. From the test results, it was concluded that the employees tested had a high level of awareness of the attackers' methods and were critical of the information they received. Vulnerable employees were identified who needed additional training and improved information security related skills. In this way, potential threats to user data were identified to be serious, and staff were shown to be more convinced that they must apply the rules and adhere to the organisation's information security policy in their day-to-day practices. Subsequent sharing of experiences and collective reflection, combined with the use of incentives, did have a noticeable impact on information security compliance intentions.