Is3pace: casting the information security spell for cultural change

Abstract

West Virginia University recognizes the vital role that information resources play in the mission critical operations of education, research, service, and administration. The challenge is trying to balance the academic tradition of open information exchange and collaboration with administrative requirements for efficient, proactive, and cost-effective security measures. To create such an environment, WVU charged the Information Security Program with the goal of driving the cultural changes required to integrate security standards and practices into daily operations. One of the key components of this effort is the Information Security, Services, and Systems Promoting Awareness, Communication, and Education (iS3PACE) information security collaborative. Several key operating units contribute to the collaborative to ensure the delivery of consistent, coordinated information security directives, guidelines, and practices. iS3PACE started with building awareness by engaging administrators, staff, and students through various print and formal media. Contests, on-campus symposiums, poster displays, distributing security tips, and an award-winning calendar served to raise security awareness. Formal training began with the delivery of ISO standard Information Security training to students, staff, and faculty. The ultimate goal of iS3PACE is to offer every incoming freshman and all employees orientation and refresher information security training. Instilling information security awareness and establishing everyday security practices is not magical. It is the result of making information security an everyday practice&and that is an "enchanting outcome".