Information security and employee behaviour : how to reduce risk through employee education, training and awareness / Angus McIlwraith

Research suggests that between 60-75% of all information security incidents are the result of a lack of knowledge and/or understanding amongst an organization's own staff. And yet the great majority of money spent protecting systems is focuced on creating technical defences against external threats. Angus McIlwraith's book explains how corporate culture affects perceptions of risk and information security, and how this in turn affects employee behaviour. He then provides a very pragmatic solution involving strategies and techniques for educating and training employees in information security and explains how different metrics can be used to assess awareness and behaviour.