Security Awareness Training MAnd Education (S T )

1 -. AD-A257 908 -,~~~ ~ ~ ..tSecurity Awareness Education (S T )A Survey OfDOD InstallationsDTIC6 819 Joseph P. ParkerBDM International, A. RiedelDefense Personnel Security Research CenterMartin F. WiskoffBDM International, - -t4 1 ( -xApproved for Public Distribution:92-A071 Distribution Unlimited11111111 111ilI ~l~I~ li! 11II~ ~Defense Personnel Security Research Center99 Pacific Street, Building 455-EMonterey, CA 93940-248 1 Security C-ASS FCA- ON O0 T" S PAGEFrApprOvedREPORT DOCUMENTATION PAGE jof;o 2704-018 8la REPORT SEC,.jR,TY CLASSIFiCATION Tb RESTRIC',VE MAR', %GSUNCLASSIFIED2a Security CLASSIFICAT!ON AUTHORiTY 3 DiSTRiBTON AVA AB-L,TY 0; REPO,-2b DECLASSIFICATION, DOWNGRADING SCHEDULE4 PERFORMING ORGANiZATION REPORT NUMBER(S) 5 ORGANZATiON REPORT ,PERS-TR-92-0076a NAME OF PERFORMING ORGANIZATION 6b OFF!)

2 CE SYMBOL 7a NAME OF MONITORiNG ORGAN ZA, ,ONBDM Corporation, Inc. (if applicable)6c. ADDRESS (City, State, and ZIP Code) 7o ADDRESS (City. State and ZIP Code)2600 Garden Road, Suite 230 Monterey, CA 939408a NAME OF FUNDING SPONSORNG Bb OFFICE SYMBOL 9 PROCREMEN- INSTRij.$ENjT DE%- T CA- ON N0,/3 EORGANIZATiON Defense Personne (if applicable)Spriiritv Rpqpnrrh rpnt-pT (PFRIRFR178c. ADDRESS (City, State, and ZIP Code) 10 OF Y,,':JG NjMBERS99 Pacific St., Bldg. 455-E PDOGRAM PPO)ECT J'ASW CVOC- -% TMonterey, CA 93940-2481 ELEMENT NO NO NO jCC-SSO, NOTI ThTLE (Incfude Security Classificaton) Security Awareness Training and Education (SATE): A Survey of DoD Installations12 PERSONA. AUTHOR(S)Parker, J. Riedel, J. A., & Wiskoff, M. TYPE OF REPORT 3b TIME COVERED 14 DATE OF REPORT (Year, Month.)

3 Day) 5 PAGE COuN%-Technical| FROM _TO 1992 Oiinp 716 SuPPLEMEN-ARY NOTAT-ON17 COSAP CDJES 18 SUBJECT TERMS (Continue on reverse if necessary and identify by block number)FIE D GROUP SuB-GROUP Security Awareness ; Security Education ; Personnelsecurity; Information Security ; Security briefing;SATE19 ABS-RACT (Continue on reverse if necessary and identify by block number)This report presents the results of a survey designed to describe the shape of currentSecurity Awareness Training and Education (SATE) programs in DoD, focusing on themilitary services. Overall, the Security representatives who were interviewed ratedtheir SATE programs as moderately successful. However, five areas are identifiedwhere modest changes could improve the effectiveness of such programs. They are:instructional media enhancements, Security manager Training , SATE policy andrequirements, Security manager support, and Security inspections.

4 Recommendationsin each of the five areas are D STR:Bu~iON AVA LABLiTY OF ABSTRACT 21 ABSTRACT SECUR,Ty CLASSiF,CATiONC jNCLASSIc'ED 'JL,,."'ED N- SAME AS ROT 0 -T,( rJSEPS UNCLASSIFIED22a NAME OF RFSPONS: 8 ''D * D,,AL 22U fELEPHONE (Include AreaCoue) 2,L OFiLE V ijROGER P. DENK. Director (NALn 6 ALA-94 ARIDD Form 1473, JUN 86 Previous editionsare obsolete Security :CAT'O% O, T N -A01'S/N 0102-LF-014-6603 PERS-TR-92-007 June 1992 Security Awareness Training AND Education (SATE):A SURVEY OF DOD INSTALLATIONSM11iJoseph P. ParkerBDM International, Inc. __ __ __ __ '_,Accesion For I NTIS CRA,&IJames A. Riedel DTIC IABD efense Personnel Security Research Center Unanlou'-cedJustificationMartin F. W iskoff By .. International, Inc. Dist ibution IAvailability CodesAvail abdlorDis SpecialThe work contained in this report was funded underPurchase Order N00014-87-D-0715-3006 Defense Personnel Security Research Center99 Pacific Street, Building 455-EMonterey, California 93940-2481 PREFACEAn integral and mandatory part of the Department of Defense (DoD) securityprogram involves educating cleared personnel concerning their individual responsibilitiesfor safeguarding classified information and the possible grave consequences of failing toprotect the nation's secrets.))

5 It is unknown what impact this Security Awareness educationhas on individual Security knowledge, attitudes, and behavior, though it is generallyaccepted that these programs are critical to the protection of the nation's have been expressed in recent congressional hearings and testimony withregard to the effectiveness and efficiency of Security Awareness programs in the DoD. Informulating the research agenda for the Defense Personnel Security Research Center(PERSEREC), several DoD components stressed the need for research directed towardthe improvement of Security Awareness Training and Education (SATE).This research presents the results of a survey designed to describe the shape ofcurrent SATE programs in DoD. This report details many of the problems facing theindividuals responsible for carrying out such programs and suggests areas in whichmodest changes could make a large difference in the effectiveness of such authors would like to thank the organizations and individuals who providedvaluable assistance in the preparation of this report.

6 Security personnel at each of theparticipating installations gave generously and willingly of their time, as did officials inseveral government Security organizations and agencies. Our thanks also go to ErnieHaag of HumRRO for help in the survey design and data collection, to Suzanne Woodof PERSEREC for background research, and to Lynn Fischer of the Department ofDefense Security Institute (DoDSI) for his review of the survey instrument and June 1992 Security Awareness Training AND Education (SATE):A SURVEY OF DOD INSTALLATIONSEXECUTIVE SUMMARYJ oseph P. ParkerJames A. RiedelMartin F. WiskoffBackgroundSince 1985 a number of reports have been issued by commissions andCongressional committees in which recommendations to improve Security awarenesstraining and Education (SATE) in government have been proposed.

7 In response, officeswithin the Department of Defense (DoD) and the Military Services have indicated theneed to increase our knowledge of how SATE programs are being conducted and toassess their strengths and weaknesses as a prerequisite to introducing present study seeks to obtain information concerning the state of securityawareness Training and Education at Service installations. Specifically, the study attemptsto determine:1. the amount and adequacy of the time devoted to the coverage ofvarious Security topics and disciplines;2. the quality and availability of media and Training methods used inSATE;3. the level of compliance with SATE regulations, the mechanisms thatare in place to ensure compliance, and indicators of program effectiveness;4. the level of support for SATE expressed in command emphasis,personnel and funding resources, and general receptivity;5.

8 The adequacy of regulations which govern SATE at different levels; the adequacy of Security staff Training and development and the trainingsources and methods that are used;7. the current and potential effectiveness of specific SATE for the survey project was initiated by meetings with Serviceheadquarters representatives and installation Security staff members involved ininformation and personnel Security . Information concerning SATE programs andrecommendations for their improvement was obtained in these the basis of these discussions, two survey forms were constructed. The firstwas a detailed interview protocol which contained a mix of closed questions ( , yes/no,multiple choice, and rating items) and open-ended questions. The second form was a100-item questionnaire comprised almost entirely of rating were collected between July and October 1990 at a total of 58 sites (18 Army, 12 Navy, 23 Air Force, 4 Marine Corps and one DoD).

9 At each site a researcherinterviewed the installation Security office representative for approximately 2 1/2 hoursusing the structured survey form. The second form was also completed by theinterviewee. Meetings were also held with small numbers of unit Security representativesand/or Security staff at which time only the second survey form was data were received from a total of 111 individuals. Forty-seven securityoffice representatives completed the interview form and all but seven of these alsocompleted the questionnaire. Sixty-four unit Security representatives--mostly unit securitymanagers--completed only the questionnaire. A total of 104 questionnaire forms and 47interview forms were addressing each of the areas specified in the objectives are presented inthe report.

10 Overall, Security managers rated their SATE programs as moderatelysuccessful. They felt that they had provided personnel with the required securityindoctrinations and had positively contributed to the Security inspection and , two primary areas were identified where additional assistance to thesecurity manager could improve SATE programs:iv1. Security professionals repeatedly expressed concern with the limitedavailability and poor quality of media products. Lack of a reliable, sufficiently comprehensive distribution system also prevented themfrom acquiring more commonly available SATE publications and Newly assigned unit Security managers lacked appropriate experience ortraining in their positions. Training opportunities were not readilyaccessible due to the location of the Training , limited class sizes anddifficulty in attending Training away from the work other areas were mentioned wh~re lesser, but nonetheless could be made to SATE effectiveness:3.