TO: YOU AS CISO FROM: James Preston, CEO SUBJECT: Security Awareness Training Pr
ID: 3914654 • Letter: T
Question
TO: YOU AS CISO
FROM: James Preston, CEO
SUBJECT: Security Awareness Training Program
I’m concerned about the new security awareness training program that you are rolling out across the company. It seems as though that you want all staff (including me) to participate in a two-hour training event in a few weeks. Why don’t we just target those who seem to have more security incidents? We did spend nearly $100k on a helpdesk system to generate these kinds of reports that could be leveraged for this. I need to justify to the Board, the CFO, and department heads the costs of this training. As for me, I’m afraid my schedule is too packed right now to complete this training on your timeframe. I will have to take it next time around.
So you are the CHIEF INFORMATION SECURITY OFFICER and JAMES PRESTON is the CHIEF EXECUTIVE OFFICER. The Chief Executive Officer brought this issue in a meeting
I’m concerned about the new security awareness training program that you are rolling out across the company. It seems as though that you want all staff (including me) to participate in a two-hour training event in a few weeks. Why don’t we just target those who seem to have more security incidents? We did spend nearly $100k on a helpdesk system to generate these kinds of reports that could be leveraged for this. I need to justify to the Board, the CFO, and department heads the costs of this training. As for me, I’m afraid my schedule is too packed right now to complete this training on your timeframe. I will have to take it next time around.
What do you think as a CHIEF INFORMATION SECURITY OFFICER, what is your thought about this.
Explanation / Answer
As the Chief Information Security Officer, it is obviously more important to me that the security awareness program be imparted to everybody. The Security awareness program helps people identify the types of attacks, vulnerabilities etc. The primary idea of the program is to allow everyone to identify when the system is under attack. The sooner the attack is identified, the sooner it can be dealt with. Therefore if everyone is made aware about these attacks and how they can be identified, the attacks can be dealth with long before it can do any damage to the system. It is something that will not be tractable due to the cost involved, but it can be beneficial to the company in the long run. Also, it is true that the program will be more beneficial to the people concerned with such security incidents, but since attacks can take place in several levels, it is always best to be prepared. Therefore the pros outweigh the cons.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.