The Just Enough Security (JES) approach to information assurance is based on the belief that no one safeguard can completely protect your critical information assets from a highly motivated threat. The JES security model combines multiple layers of safeguards with simple risk management tools to help you achieve both the security of your information assets and a return on your security investment. To allow you to quickly apply the basic principles of JES, this book helps you build the necessary skills in three steps. Part 1 of this book contains three primers to ensure you have the basic technical knowledge necessary to understand each layer of the JES model. These primers include networking, security, and risk management. Part 2 introduces the various layers of the JES model with detailed explanations of how to implement each. Finally, business continuity and incident management principles are discussed in Part 3.

Expert guidance on the art and science of driving secure behaviors Transformational Security Awareness empowers security leaders with the information and resources they need to assemble and deliver effective world-class security awareness programs that drive secure behaviors and culture change. When all other processes, controls, and technologies fail, humans are your last line of defense. But, how can you prepare them? Frustrated with ineffective training paradigms, most security leaders know that there must be a better way. A way that engages users, shapes behaviors, and fosters an organizational culture that encourages and reinforces security-related values. The good news is that there is hope. That’s what Transformational Security Awareness is all about. Author Perry Carpenter weaves together insights and best practices from experts in communication, persuasion, psychology, behavioral economics, organizational culture management, employee engagement, and storytelling to create a multidisciplinary masterpiece that transcends traditional security education and sets you on the path to make a lasting impact in your organization. Find out what you need to know about marketing, communication, behavior science, and culture management Overcome the knowledge-intention-behavior gap Optimize your program to work with the realities of human nature Use simulations, games, surveys, and leverage new trends like escape rooms to teach security awareness Put effective training together into a well-crafted campaign with ambassadors Understand the keys to sustained success and ongoing culture change Measure your success and establish continuous improvements Do you care more about what your employees know or what they do? It's time to transform the way we think about security awareness. If your organization is stuck in a security awareness rut, using the same ineffective strategies, materials, and information that might check a compliance box but still leaves your organization wide open to phishing, social engineering, and security-related employee mistakes and oversights, then you NEED this book.