Key facts and figures about the AR Community and its members

Transcription

1 Key facts and figures about the AR Community and its members May 2009

2 Key facts and figures about the AR Community and its members 1

3 Contents ENISA 3 THE AWARENESS RAISING COMMUNITY A SUCCESS STORY 4 THE AR COMMUNITY A GROWING GROUP 5 HOW BIG IS THE AR COMMUNITY? 7 THE GENDER GAP 11 MEMBERSHIP GROWTH 12 MEMBERS AT WORK 14 THE JOBS MEMBERS DO 15 FOR WHICH TARGET GROUPS ARE MEMBERS RAISING INFORMATION SECURITY AWARENESS? 16 THE AR COMMUNITY AT WORK 17 Achievements 18 CONTACT DETAILS 19 2

4 ENISA The European Network and Information Security Agency (EN- ISA) is an EU Agency established to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard for information on good practices. Moreover, the Agency facilitates contacts between the European institutions, Member States and private business and industry actors. To this end, ENISA is engaged in positively influencing public behaviour towards information security, changing the mindset of the human element in order to achieve greater information security awareness. 3

5 The awareness raising community a success story The Awareness Raising (AR) Community is a subscription-free Community open to experts who have an interest in engaging in raising information security awareness within their organisations. The AR Community was launched last February and is designed to engage with ENISA in its mission to foster a culture of information security. As a point of contact for matters related to information security awareness, the AR Community has grown to 45 nations, comprising 308 members. All European Union (EU) and European Economic Area (EEA) countries are represented apart from Slovakia. marks the beginning of a deep engagement not only with sharing but also with analysis of information security good practices across Europe. Through a series of graphs and charts, this booklet presents basic facts and figures about the AR Community and its members. The cut-off date for data used in this publication was May Though members have a diverse range of skills and knowledge of ICTs, and differing interests and levels of expertise and priorities, they are united in helping the AR Community become the intellectual backbone of the exchange of information security good practices. Thus, the establishment of the AR Community 4

6 The AR Community a growing group ENISA began building an AR Community in late To enhance the capacity of such a Community, promote knowledge sharing and establish and support dialogue within institutions of Member States and other stakeholders, the Agency created a new way of coming together and sharing information. Monthly conference calls were organised from March 2007 and were joined by about 20 participants from 8 European countries: Austria, Belgium, Germany, Ireland, Italy, Luxembourg, the Netherlands and the United Kingdom. EU and EEA countries represented in the AR Community During 2007, following the positive feedback received by stakeholders and the common willingness to create a recognised and established Information Security Awareness Community, ENISA included in the framework of the multi-thematic annual programme of the Agency ( Developing and maintaining cooperation models ) the creation of the AR Community. EU countries EEA countries 5

7 Later in 2007, the work programme of ENISA was approved, giving this responsibility to the Awareness Raising section and thus laying the foundations of the AR Community. The AR Community worldwide Austria, Belgium, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, India, Ireland, Italy, Malta, the Netherlands, Norway, Portugal, Romania, Slovenia, Spain, Sweden, Switzerland, Turkey, the United Kingdom, the United Sates, and Vietnam joined in February 2008, followed by Egypt, Luxembourg, Morocco, New Zealand, and Turkey in April 2008, Australia, Latvia and Cyprus in May 2008, Lithuania and Poland in June 2008 and Bulgaria, Czech Republic and Sierra Leone in July The growth of the community steadily continued in the second half of 2008 by having people from FYROM, Israel and Lichtenstein as new members. From January to May 2009, the AR Community grew by 60 % and got its first members from China, Canada, Malaysia and Mexico. The AR Community sees different people and cultures as an asset in promoting a culture of information security. 6

8 How big is the AR Community? The AR Community s population is 25 % smaller than the CERT Community s population. In fact, the CERT Community (which was established in the 1990s) has 200 worldwide teams with an average of 6 members per team. This CERT community trend could have important implications for the future of the AR Community. 7

9 The AR Community covers 5 continents Africa, Asia, Europe, North America and Oceania and a large number of countries are represented. 8

10 The AR Community has 308 members. The largest membership is from Europe. 300 Members by continent Europe North America Africa Asia Continent Oceania 9

11 All EU and EEA countries are represented apart from Slovakia. Members by EU/EEA Countries UK ES IT BE NL GR DE DK FR PT IE NO MT SE CZ EE RO AT CY BG PL SI LU IS HU FI LT LI LV SK Country 10

12 The gender gap More men than women are registered in the AR Community. This is perhaps due to the fact that information security awareness matters fall in the technical sector where women are often not well represented. 11

13 Membership growth AR Community membership increases through a combination of push and pull activities, although the strength for push activities was higher than the corresponding pull activities. Most of the AR Community s population growth is due to a common recognition of the importance of information security awareness. Recent events have raised concerns, leading pri- Membership growth Feb-08 Mar-08 Apr-08 May-08 Jun-08 Jul-08 Aug-08 Sep-08 Oct-08 Nov-08 Dec-08 Jan-09 Feb-09 Mar-09 Apr-09 Month 12

14 vate and public organisations to understand that while policies and technology are certainly a critical part of any information security programme, these measures alone cannot deliver sufficient information security in practice. Awareness of the related risks and available safeguards is the first line of defence for security. People are the real perimeter of the network and their behaviour is a vital aspect of the total security picture. Forecast* of membership growth until the end of Number of Members Q1-08 Q2-08 Q3-08 Q4-08 Q1-09 Q2-09 Q3-09 Q4-09 * Forecast calculated using linear regression analysis Month 13

15 Members at work The AR Community is a subscription-free community open to experts who have an interest in engaging in raising information security awareness within their organisations regardless of the sector to which they belong. Cultural diversity and different levels of knowledge and experience in matters related to information security awareness are highlighted; indeed, these variations are an asset for the entire Community. 14

16 The jobs members do The AR Community is a subscription-free community open to experts who have an interest in engaging in raising information security awareness within their organisations regardless of the sector to which they belong. Cultural diversity and different levels of knowledge and experience in matters related to information security awareness are highlighted; indeed, these variations are an asset for the entire Community. Percentage of members represented in Industry, Goverment, Academia and Other Industry Goverment Academia Other* *Intergovernmental Organisations, NGOs, Public associations Sector 15

17 For which target groups are members raising information security awareness? AR Community members are engaged in raising information security awareness for an average of 4 target groups. One third of the members concentrate their activities on one target group only, while 4% of members concentrate their activities on 10 or more target groups. Target Groups 60% 50% 40% 30% 20% 10% 0% Industry Public sector Employees Local governments General public SMEs Academia Home users Media Children/ Parents Others 16

18 The AR Community at work The AR Community s work increases through a combination of activities which show the continuous involvement of members of the Community. ARNews and a calendar of events are prepared using inputs received by experts and then distributed to Community members who wish to receive periodic correspondence. Furthermore, the members can participate in virtual working groups (VWG) which enable the exchange of information on awareness security topics and the preparation of white papers which will be used to educate readers and help people deal with information security matters. Along with this, the AR Community offers the chance to participate in presentations at events and to attend and contribute to monthly conference calls. The AR Community holds regular conference calls for sharing emerging good practices, discussing cutting-edge topics and key issues in the information security field. 17

19 Achievements In 2008, some AR Community members participated in two VWGs which enable the preparation of white papers on how to obtain support and funding from senior management and how to organise awareness programmes in financial organisations. The paper Obtaining support and funding from senior management seeks to raise awareness among senior management on the importance and criticality of endorsing information security awareness within an organisation. Gaining management support and sponsorship for an awareness programme was recognised as the most crucial aspect of the entire initiative. It is vital to build consensus amongst decision-makers that the awareness programme is important and worthy of funding. Even though many managers express their desire to support security initiatives, putting it into action is another story. This is the reason why ENISA addressed private organisations staff and decision-makers providing an introduction on the importance of gaining support and funding from senior management of companies. Moreover, it provided a valuable tool to take the first steps towards the preparation and implementation of an information security awareness initiative. Moreover, a more in depth analysis was conducted for the financial services industry such as retails and wholesale banks, investment firms, insurance companies and so on. Data security is a key risk for these organisations by the nature of their business. They are generally hold lots of personal and financial data and their safeguard is crucial responsibility for them. A set of twenty recommendations were included in the paper How to organise awareness raising programmes in financial organisations to provide a valuable tool to understand the importance of data loss for this industry sector and prepare awareness raising and training programmes. 18

20 Contact details For contacting ENISA or for general enquiries about the AR Community, please use the following details: Isabella Santa, Senior Expert Awareness Raising, Internet: Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA Regulation (EC) No 460/2004. This publication does not necessarily represent state-of the-art and it might be updated from time to time. Third party sources are quoted as appropriate. ENISA is not responsible for the content of external sources including external websites referenced in this publication. This publication is intended for educational and information purposes only. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. European Network and Information Security Agency (ENISA),

21 TP-AC EN-C Design: Illustrations: Nektarios Matsikas ISBN-13: ISSN: