Developing Security Metrics to Evaluate Employee Awareness: a Case of a Ministry in Namibia

Abstract

Employees that lack security awareness may cause a threat to an organisation unintentionally. A mixed research method was used to conduct a case study to evaluate the security awareness levels of employees in one ministry to reduce the risk associated with security threats.

A survey using a questionnaire was carried out with the ministry employees from four different departments. Collected data was quantitatively analysed to gauge the security risk of the organisation. Analysed survey results were used to develop security metrics using the Goal Question Metric approach and security objectives as measurements. The metric evaluated the security awareness level of employees at the ministry. Employees’ responses were validated using helpdesk statistics on incident reporting and antivirus statistics.

The security metrics aim to assist the Information Technology department to detect security breaches early, and then develop a security awareness program and policies to promote security best practices. On the other hand the metrics can be used to encourage top management to get involved. The results show that employees’ awareness level was mostly low or elevated. Security standards and best practices are recommended based on the findings of risk rating per security category.