Assessment methodology for the categorization of ICT system users security awareness

The ICT system's users can significantly affect overall security level of the system, but problem is that most security solutions do not take into consideration user as possible critical security component of the system. In this work assessment methodology is proposed to evaluate users' awareness regarding security issues. For purpose of collecting data on ICT system user's awareness special questionnaire was developed based on previously defined ontology domain regarding e-mail users' behavior. The cluster analysis method was applied in order to group users into categories regarding level of their awareness about security issues. Cluster analysis gave six clusters of users on which Chi-square analysis was applied in order to detect potential relationship between level of awareness and gender, age, professional qualification and number of e-mail addresses used. The variables used to predict group membership were identified by applying discriminant analysis. The evaluation and categorization of users' awareness should help in developing new concepts of security solutions with taking into consideration user as component of the ICT system.