Corporate Information Security Education: is Outcomes Based Education the Solution?

Today's global economy is increasingly dependent on the creation, management, and distribution of information resources. Information and its use permeate all aspects of modem society. Most modem organizations need information systems to survive and prosper. Information has become a valuable commodity and as such needs to be protected. This protection is typically implemented in the form of various security controls. In order for these controls to be effective, the users in the organization need to be educated regarding these controls. Recent studies have indicated that current user education programs fail to pay adequate attention to behavioral theories. This paper examines the educational principles an information security user education program should adhere to. It then introduces outcomes based education (OBE) and finally argues that OBE is ideally suited for the needs of information security.