Measuring an information security awareness program

Research shows security awareness lacks a uniform definition. This thesis explores the various attempts that have been made to define security awareness and then presents a clear and concise definition of security awareness. Due to the lack of a behavior-oriented measurement of security awareness has relied on the use of self-reported surveys and questionnaires and quizzing of users through these same types of instruments. These attempts assume that knowledge of security awareness leads to correspondingly correct behavior, without attempting any field validation that this paradigm holds true for security awareness activities. This thesis goes beyond that self-reporting methodology by measuring the behavior of end-users. It compares that behavior with policy to determine the actual compliance percentage and draws conclusions from these results.