Teachers’ awareness, knowledge and practice of information security in school

Abstract

We found that the teachers in our respondent schools lacked formal training on topics of information security. Most of them did not know what phishing, backdoors and keyloggers are, and many reused passwords across multiple sites. The teachers were also concerned about lacking the knowledge to properly teach their students about information security and netiquette. The principals did not consider information security to be a primary concernand the IT-department employees had varying knowledge of information security.Meanwhile the municipality has been focused on procuring hardware and softwarefor the teachers and students, and ensuring proper use of these digital teaching aids, while neglecting the information security aspect. Based on our findingsand literature from the IS field, we have developed an overview of the 15 key problem areas we identified withimprovement suggestions.Allour suggestions are concrete measures to transition towards a more information security friendly organizational culture.Thischange in culture must be encouraged by the municipality.We suggestarranging a yearly information security weekand workshops, partnering up with already existing national incentivesto increase teacher knowledge.We also suggestshort weekly discussionson information security led by an information security champion to keep awareness levels high.Furtherstandardization of the applications used in schools and the introduction of a password manager andmoremulti-factor authenticationare also encouraged.