Archives

The continued proliferation of crude and poorly disguised malware, such as those spread by execution of email attachments, has highlighted the failure of large-scale security education to convey simple messages such as “don’t open email attachments sent by strangers.” Computer security education, like public health education, is not a ‘one-size-fits-all’ endeavor. Needs, goals, and curricula to achieve these goals must be carefully assessed for the population targeted. Once the intervention has been delivered, its results must then be evaluated to assess the impact of the program. This paper describes a public health-based framework for needs assessment in security education.