Applying social marketing to evaluate current security education training and awareness programs in organisations. Issue 100 (January 2021)

• Record Type: Journal Article
• Authors: Alshaikh, Moneer; Maynard, Sean B.; Ahmad, Atif
• Is Part Of: Computers & security. Issue 100(2021)
• Publication Date: 2021-01
• Subjects: Information security education training and awareness -- Behavioural information security -- Behaviour change -- Social marketing -- Security interventions; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2020.102090
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: The effectiveness of cybersecurity management programs is contingent on improving employee security behaviour. Security education, training, and awareness (SETA) programs aim to drive positive behaviour change in support of cybersecurity objectives. In this paper, we argue that existing SETA programs are suboptimal as they aim to improve employee knowledge acquisition rather than behaviour and belief. We apply social marketing principles to examine SETA practices across six organisations. We find that SETA programs fail to implement the key principles and concepts of social marketing that are essential for positive behaviour change. We therefore propose a novel development process for SETA based on a social marketing approach. We explain how the new approach can be used to develop SETA programs that are focused on behaviour change.