Syllabus

UNIVERSITY OF WISCONSIN-MILWAUKEE

School of Information Studies

INFOST (784) – Information Security Management

Instructor : Dr Jacques du Plessis

Email : jacques@uwm.edu

Phone : 414.229.2856

Office Hours : Online: email, phone, web chat

Meeting Times : Online Asynchronous

CATALOG DESCRIPTION:

Investigation of key aspects of information security management such as policy, risk analysis and management, education and awareness training, legal compliance, ethical and legal conduct. 3 credits.

GENERAL DESCRIPTION:

This course prepares the graduate student to employ the theoretical and conceptual underpinnings to improve information security behavior and develop skills in a work-related context in private, public or government enterprises. The course is designed to assess decisions and policies to improve information security management. The academic engagement will cover the following topics: (i) policy development, (ii) risk analysis and management, (iii) security information dissemination, education and awareness training, (iv) legal compliance, and (v) ethical and legal conduct. Students will be prepared to reflectively respond to the human factors of information security management.

PREREQUISITES:

Graduate Student Status;

InfoSt 583 completed.

REQUIREMENTS:

Software Wordprocessing - (GoogleDocs/MSWord/OpenOffice), Audio and Video Editing (Free: Audacity/Lightworks; or Commercial: e.g. Camtasia; UWM: Kaltura CaptureSpace Lite)

Hardware Computer OS - Windows, Mac, Linux;Video Hardware: Webcam, Camcorder, or Smartphone

Equipment Optional - Microphone, Pop filter, Lighting for video recording

Skills Recorded Oral Presentation - You need to be able to make a video recording of yourself and present it online. Able to edit your video and upload it online (such as your SOIS web location, YouTube, Vimeo, etc). The focus is on your presentation. You may use the technical support of others.

METHOD:

• Lectures, independent reading and research, case studies, online discussion, assignments, student presentations, and guest speakers (as available).
• Students requiring special accommodations should contact the instructor as early as possible for accommodations. For detailed information about these accommodations, please visit (http://www4.uwm.edu/secu/docs/faculty/1895R3_Uniform_abus_Policy.pdf).

TEXTBOOKS:

• The Psychology of Information Security Resolving conflicts between security compliance and human behaviour by Leron Zinatullin. IT Governance Ltd 2016. ISBN: 1849-28789-9
• Information Security Policies, Procedures, and Standards - A Practitioner's Reference by Douglas Landoll. CRC Press, 2016 ISBN: 1482-24589-2
• The Corporate Culture Survival Guide by Edgar H. Schein. Jossey-Bass Press, 2009 ISBN: 0470-29371-3. Accessible online at (http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.465.7545&rep=rep1&type=pdf).
• Other materials include assigned readings, videos and audio streams

OBJECTIVES/OUTCOMES:

Upon completion of the course, students will be able to:

1. HUMAN BEHAVIOR: Understand how to prevent or remedy human behavior as a risk to information security in the enterprise.
2. RISK: Critically analyze, evaluate and articulate the diverse aspects of the information security risk to the organization and compose persuasive arguments to management regarding the need for respond to identified security risks.
3. COMPLIANCE: Investigate and expound on a specific sector (such as health care, defense or education) from a legal compliance perspective. Elaborate on the need for policies and social infrastructure to manage and execute compliance.
4. POLICY: Assess, evaluate and compare policies in place and improve or create policies to serve the information security needs. Debate the benefits versus the detriments of security policies and how it may impact individual behaviors, company culture as well as the broader society.
5. LEGAL & ETHICAL: Identify and discuss human actions that compromise or violate legal and/or ethical behavior in both the contexts to threaten information security and to prevent information security risk.
6. AWARENESS & EDUCATION: Develop concept frameworks for the most efficient and effective implementation of information sharing and dissemination, education campaigns, and awareness training programs. Propose how to minimize various cultural, economic, and generational factors within a diverse group and how to maximize positive forward progression goals.
7. INFOSEC LIFE CYCLE: Explore and evaluate the information security life cycle to secure information, e.g. planning, acquisitions, training and development.

COURSE SCHEDULE:

Week Time Allocation, Topics, and Objectives

1 [hr:min] INTRODUCTION • Objectives: 1 2 3 4 5 6 7

[1:00] Lecture

[0:30] Ch1 - Zinatullin: Introduction]

[1:00] Readings: Social Engineering

[0:42] Video: DefCon 21: Social Engineering

[2:00] Research Questions: Human behavior and InfoSec

[0:52] Video: Human behavior and information security

[2:00] Research Questions: Social Engineering

[1:00] Assignment: Participate in unit discussions

[9:04] Total Time Commitment (Approx.)

2 [hr:min] RISK MANAGEMENT • Objectives: 1 2 - 4 - 6 -

[1:00] Lecture

[0:40] Ch2 - Zinatullin: Risk Management

[0:50] Ch3 - Zinatullin; Complexity of Risk Management

[2:20] Video: InfoSec Risk Management

[0:40] Readings: Risk Management

[2:00] Research Questions: InfoSec Risk Management

[2:00] Assignment: Participate in unit discussion

[8:10] Total Time Commitment (Approx.)

3 [hr:min] COMMUNICATION • Objectives: 1 2 3 4 5 6 7

[1:00] Lecture

[0:50] Ch4 - Zinatullin: Stakeholders & Communication

[0:41] Video: Stakeholder Communication

[1:00] Readings: Lines of Communication

[1:00] Readings: Awareness Training; Education

[2:00] Research Questions: Awareness Training; Education

[2:00] Assignment: Participate in unit discussion

[8:31] Total Time Commitment (Approx.)

4 [hr:min] GOVERNANCE and POLICY • Objectives: 1 2 3 4 5 6 7

[0:50] Lecture

[1:00] Ch5 - Zinatullin: Information Security Governance

[1:00] Ch1 - Landoll: Introduction

[1:00] Ch2 - Landoll: Information Security Policy Basics

[1:00] Ch3 - Landoll: Information Security Policy Framework

[0:15] Video: InfoSec Governance (Part 1)

[0:15] Video: InfoSec Governance (Part 2)

[0:12] Video: InfoSec Governance (Part 3)

[0:14] Video: InfoSec Governance (Part 4)

[0:06] Video: InfoSec Governance (Part 5)

[2:00] Research Questions: InfoSec Governance

[2:00] Assignment: Participate in unit discussion

[9:52] Total Time Commitment (Approx.)

5 [hr:min] POLICY MANAGEMENT • Objectives: 1 2 3 4 5 6 7

[1:00] Lecture

[0:40] Ch4 - Landoll: Information Security Policy Details

[0:40] Ch5 - Landoll: Information Security Procedures and Standards

[1:00] Ch6 - Zinatullin: Problems with Policies

[0:55] Video: InfoSec Policy Development

[2:00] Research Questions: Policy Management

[2:00] Assignment: Participate in unit discussion

[8:15] Total Time Commitment (Approx.)

6 [hr:min] DECISION MAKING • Objectives: 1 2 3 4 5 6 7

[1:00] Lecture

[1:00] Ch7 - Zinatullin: Decision Making from a Managerial Perspective

[0:15] Video: Cyber and the Board

[1:00] Ch8 - Zinatullin: User Decision Making

[1:00] Research Questions: Decision Making

[2:00] MIDTERM

[2:00] Assignment: Participate in unit discussion

[8:15] Total Time Commitment (Approx.)

7 [hr:min] SECURITY and USABILITY • Objectives: 1 2 3 4 5 6 7

[1:00] Lecture

[1:00] Ch9 - Zinatullin: Security and Usability

[0:30] Video: Security and Usability

[2:00] Research Questions: Usability

[2:00] Assignment: Participate in unit discussion

[6:30] Total Time Commitment (Approx.)

8 [hr:min] SECURITY CULTURE • Objectives: 1 2 3 4 5 6 7

[1:00] Lecture

[1:00] Ch10 - Zinatullin: Security Culture

[0:50] Video: Creating a Culture of Information Security

[1:00] Readings: Ethical Aspects

[0:04] Video: Computer Ethics

[0:40] Video: Computer Security Ethics

[1:00] Research Questions: Security Culture

[1:00] Research Questions: Ethics in InfoSec

[2:00] Assignment: Participate in unit discussion

[8:34] Total Time Commitment

9 [hr:min] COMPLIANCE • Objectives: 1 2 3 4 5 6 7

[1:00] Lecture

[1:00] Ch 11 - Zinatullin: Psychology of Compliance

[1:00] Readings: Legal Compliance

[2:30] Video Research

[2:00] Research Questions: Usability

[2:00] Assignment: Participate in unit discussion

[9:30] Total Time Commitment (Approx.)

10 [hr:min] CHANGING the CULTURE • Objectives: 1 2 3 4 5 6 7

[1:00] Lecture

[1:00] Ch12 - Zinatullin: Changing the Approach to Security

[4:00] Schein: The Corporate Culture Survival Guide

[0:25] Video: Changing the Mindset

[0:50] Video: Change the Culture, Change the Game

[1:00] Research Questions: Changing the Culture

[2:00] Assignment: Participate in unit discussion

[10:15] Total Time Commitment (Approx.)

11 [hr:min] CASE STUDY 1 • Objectives: 1 2 3 4 5 6 7

[1:00] Ch6 - Landoll: Information Security Policy Projects

[4:00] Assignment: Participate in unit discussion - Case Study

[2:00] Assignment: Oral Presentation Preparation

[7:00] Total Time Commitment (Approx.)

12 [hr:min] CASE STUDY 2 • Objectives: 1 2 3 4 5 6 7

[6:00] Assignment: Fieldwork Report

[2:00] Assignment: Participate in unit discussion - Case Study

[1:00] Assignment: Oral Presentation Preparation

[9:00] Total Time Commitment (Approx.)

13 [hr:min] FIELDWORK and ORAL PRESENTATION • Objectives: 1 2 3 4 5 6 7

[6:00] Assignment: Fieldwork Report

[3:00] Assignment: Oral Presentation Preparation

[9:00] Total Time Commitment (Approx.)

14 [hr:min] FIELDWORK and ORAL PRESENTATION • Objectives: 1 2 3 4 5 6 7

[6:00] Assignment: Fieldwork Report

[2:00] Assignment: Oral Presentation

[2:00] Assignment: Unit Discussion on Oral Reports

[10:00] Total Time Commitment (Approx.)

15 [hr:min] FIELDWORK and ORAL PRESENTATION • Objectives: 1 2 3 4 5 6 7

[6:00] Assignment: Fieldwork Report Submission

[4:00] Final Exam (and preparation)

[10:00] Total Time Commitment (Approx.)

[141:46] Total SEMESTER Time Commitment (Approx.)

COURSE POLICIES:

Rules of academic conduct require that you not use the work of others without clearly indicating it as such. You may not resubmit work that has already been used in fulfillment of the requirement of this or any other course. Academic misconduct may result in a lowered grade, no credit for a given assignment, or removal from the course. It is expected students will consult and appropriately cite the research and professional literature where merited. This means citing a variety of credible sources. Limiting yourself to an online source like Wikipedia as the entirety of your research efforts is unacceptable. Grades will also be reduced for papers that include irrelevant content to “fill up space” with large white spaces, or language that is void of value, just to meet the length specifications for a paper.

Written assignments are due on the specified date, late work is not accepted unless an emergency is involved, then the student must contact the instructor as soon as possible. Papers are to be double-spaced using a 12-point kerned font such as Times New Roman with 1 inch margins. Rely on a commonly used style manual for your submissions (e.g. Turabian, Chicago, APA, MLA). These are available in the Library or UWM Bookstore or may be purchased through online book vendors.

ASSIGNMENT DESCRIPTIONS

DISCUSSION PARTICIPATION (26%):

Participation will be based on your regular and substantive weekly contributions in online discussions for units 1 – 12, and 14. Students are expected to engage in the online discussion on a weekly basis to interact with class members — to share findings, raise questions and insert new subtopics, specifically on the course objectives in bold on the Course Schedule. Absence from a unit's discussion will lower the student’s participation grade by two overall percentage points.

Oral Assignment Grading Rubric:

• POINTS 12
  • Personal Contributions 7 ⇦ Two or more contributions with relevance and focus and with a thorough analysis of the subject matter that stimulate thought, exposes challenges, and demonstrates strong ownership of thought.
  • Group Participation Points 5 ⇦ For more than two group members, post a reflective recognition.
• POINTS 9
  • Personal Contributions 5 ⇦ Two or more contributions with relevance and focus and an adequate analysis of the subject matter.
  • Group Participation Points 4 ⇦ For more than one group member, post a reflective recognition.
• POINTS 6
  • Personal Contributions 3 ⇦ At least one contribution with relevance and focus and with a limited analysis of the subject matter.
  • Group Participation Points 3 ⇦ For at least one group member, post a reflective recognition.
• POINTS 2-4
  • Personal Contributions 2 ⇦ At least one contribution without an analysis and presenting issues such as a lack of focus, relevance, or consistency.
  • Group Participation Points 2 ⇦ For at least one group member, post a basic recognition of the contribution.
• POINTS 0
  • Personal Contributions 0 ⇦ No personal contribution.
  • Group Participation Points 0 ⇦ No response to the postings of others.

Midterm (12%) & Final (12%) = 24%

The two exams will be your documented reflections based on the questions for each of the 10 sections, each with its specific targeted learning outcomes.

Midterm: Units 1 - 6 are due as indicated on the CALENDAR page.

Final: Units 7 - 10 are due after week 14 on the CALENDAR page.

Fieldwork Report (30%):

The instructor will arrange for collaboration with local companies. You are allowed to seek to work with a company of your choice. Your will focus on either COMPLIANCE, or POLICY. You will gather information about the chosen enterprise and your fieldwork report will be an analysis of either compliance or policy. In order to be effective you will first research best practices, then do an assessment of the company to evaluate how they got to their current status and what there future plans are. Based on their information provided, you will make your own assessments of how well they are meeting expectations. It is advisable to make a rubrics by which you can make your assessments. Confirm their achievements and highlight improvements to recommended and what it would take to action such items. Make sure that you change names and places and any identifying information to protect the image of the company. You will not be required to sign a non-disclosure agreements. For consideration: HR issues, management styles, awareness, political will, financial priorities, current commitments and future plans. The final report is to be at minimum 7 pages double-spaced with at least 12 references in the bibliography. You have to go beyond the ability to gather sources and synthesize the findings. Your own reflection is essential. It is your voice in your work that has to become clear.

Plagiarism Policy: If you are found guilty of plagiarism, depending on the case, you risk getting a failing grade for the course.

Oral -- Position Presentation (20%)

Topic Focus

Address on one of the following:

If you are addressing leadership, do a thorough analysis on paper of your approach, so that you can be systematic and to the point. The most common weakness in a presentation is to take forever to get to the point. Some of the following might help you in this process: clarify the context, like:

• What is the problem and why?
• What are the risks, - the impact (in concrete terms [e.g financial, morale, legal, ethical, employee retention, time loss, branding, etc.) of not addressing this matter?
• Where is the risk most critical?
• Persuade (if needed) how to prevent or maximally mitigate the threat. Speak to what you will do should the security event happen.

Technical Expectations:

• Capture a video presentation of between 8 - 10 minutes.
• Suggested platforms: YouTube, Vimeo, your web space on SOIS or Techsmith's Screencast.com or get email confirmation from the instructor to use another platform.
• Capturing options: Computer-based such as GoToMeeting, Camtasia Relay, or use a smartphone or videocam or similar video presentation technology. Not Acceptable: A slide presentation with audio added.
• Save your video to your chosen platform (e.g. Youtube, Vimeo, Screencast, Dropbox, or your web space with SOIS) and submit the link to the presentation by email and in the course dropbox. It has to be shareable with the class. It is your choice to list the presentation as public or keep the link private.
• Before doing the master presentation, do several short test recordings to avoid technical issues such as: crackling and popping sounds, a humming sound in the background, or you bumping the mic, mouth-microphone positioning, visual appeal of the presence you want to portray, etc.
• It is about the message, and a key part of the message is you embodied in the presentation. Exude professionalism. Informality often sounds incompetent.
• Note: You may use the technical support of others in the production of the video.

Oral Assignment Grading Rubric:

EXCELLENT

Issue presentation (clarity, time balance)

4 ⇦ i. Succinct/pithy;

ii. Clear description of the issue;

iii. Within 2 minutes

Reasoning (insight into alternative approaches, merits and issues of each approach.

5 ⇦ Elaborates on all reasonable approaches with credible insight (breadth and depth) about the merits and issues of alternative approaches.

Findings (clarity and own voice in reaching convincing conclusions based on breath and depth of insight)

5 ⇦ Clarity and a convincing voice in breadth and/or depth of the conclusions reached.

Totals Presenting: 14%

Technical quality of video

2 ⇦ The quality of the video appears fresh and crisp.

Technical quality of audio

2 ⇦ The quality of the audio sounds fresh and crisp.

Editing issues (E.g. cuts, transitions, fade in and out, title screen, conclusion)

2 ⇦ The quality of the edits feels professional.

Totals Technical 6%

ACCEPTABLE

Issue presentation (clarity, time balance)

3 ⇦ Deficient in one of the three areas:

i. Succinct/pithy;

ii. Clear description of the issue;

iii. Within 2 minutes

Reasoning (insight into alternative approaches, merits and issues of each approach.

4 ⇦ Lacking some breadth or depth in presenting the merits or issues of alternative approaches.

Findings (clarity and own voice in reaching convincing conclusions based on breath and depth of insight)

4 ⇦ Lacking some breadth and/or depth of the conclusions reached.

Totals Presenting: 11%

Technical quality of video

1.5 ⇦ The video quality does not draw attention to itself.

Technical quality of audio

1.5 ⇦ The audio quality does not draw attention to itself.

Editing issues (E.g. cuts, transitions, fade in and out, title screen, conclusion)

1.5 ⇦ The edits do not draw attention to itself.

Totals Technical 4.5%

NEEDS IMPROVEMENT

Issue presentation (clarity, time balance)

2 ⇦ Deficient in two of the three areas:

i. Succinct/pithy;

ii. Clear description of the issue;

iii. Within 2 minutes

Reasoning (insight into alternative approaches, merits and issues of each approach.

3 ⇦ Clear deficiency in breadth and/or depth of the presented merits or issues of alternative approaches.

Findings (clarity and own voice in reaching convincing conclusions based on breath and depth of insight)

3 ⇦ Clear deficiencies in breadth and/or depth of the conclusions reached.

Totals Presenting: 8%

Technical quality of video

1 ⇦ The video quality does draw some attention to itself.

Technical quality of audio

1 ⇦ The audio quality does draw some attention to itself.

Editing issues (E.g. cuts, transitions, fade in and out, title screen, conclusion)

1 ⇦ The edits draw some attention to itself.

Totals Technical 3%

DEFICIENT

Issue presentation (clarity, time balance)

1 ⇦ Deficient in all three areas:

i. Succinct/pithy;

ii. Clear description of the issue;

iii. Within 2 minutes

Reasoning (insight into alternative approaches, merits and issues of each approach.

1 ⇦ Stark deficiency in breadth and depth of the presented merits or issues of alternative approaches.

Findings (clarity and own voice in reaching convincing conclusions based on breath and depth of insight)

1 ⇦ Stark deficiencies in breadth and depth of the conclusions reached.

Totals Presenting: 3%

Technical quality of video

0 ⇦ The video quality is clearly inadequate and will not be acceptable in a professional setting.

Technical quality of audio

0 ⇦ The audio quality is clearly inadequate and will not be acceptable in a professional setting.

Editing issues (E.g. cuts, transitions, fade in and out, title screen, conclusion)

0 ⇦ The edits are clearly inadequate and will not be acceptable in a professional setting.

Totals Technical: 0%

GRADING SCALE:

A (100-96) A- (95-91)

B+ (90-87) B (86-84) B- (83-80)

C+ (79-77) C (76-74) C- (73-70)

D+ (69-67) D (66-64) D- (63-60)

F (Below 60)

UWM AND SOIS ACADEMIC POLICIES

UWM policies and resources to all students. Follow 'Syllabus Links' at: http://uwm.edu/secu/wp-content/uploads/sites/122/2016/12/Syllabus-Links.pdf

• Students with disabilities
• Religious observances
• Active military duty
• Incompletes
• Discriminatory conduct
• Title IX / Sexual Violence
• Academic Misconduct
• Complaint procedures
• Grade appeal procedures
• LGBT+ resources

Panther Planner and Undergraduate Student Handbook useful to undergrads: http://www4.uwm.edu/dos/student-handbook.cfm

• Report it
• Anonymous Hotline
• Student Handbook
• Campus Health and Safety
• Emergency Grant
• Mental Health Resources
• Sexual Assualt Awareness
• Equity and Diversity - Title IX

Master's Toolbox (For master's students): http://uwm.edu/graduateschool/masters-toolbox/

SOIS FAQ, Forms, Policies: https://uwm.edu/informationstudies/resources/faqs/

INSTRUCTIONAL MATERIALS BIBLIOGRAPHY

• Zinatullin, L. (2016). The Psychology of Information Security Resolving conflicts between security compliance and human behaviour. IT Governance Publishing. ISBN: 1849-28789-9
• Landoll, D. (2016). Information Security Policies, Procedures, and Standards - A Practitioner's Reference CRC Press. ISBN: 1482-24589-2
• Schein, E.H. (2009). The Corporate Culture Survival Guide Jossey-Bass Press. ISBN: 0470-29371-3. Accessible online at (http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.465.7545&rep=rep1&type=pdf).
• [HackersOnBoard]. (Nov. 16, 2013). Defcon 21 - Social Engineering: The Gentleman Thief [Video File]. Retrieved from https://www.youtube.com/watch?v=1kkOKvPrdZ4.
• [Center for Secure and Dependable Systems, University of Idaho]. (May 6, 2014). Human behavior and cyber security [Video File]. Retrieved from https://www.youtube.com/watch?v=qm2WWMbrYMc.
• [Open Learning]. (Apr 24, 2016). Certified Information Security Manager, CISM, Course 02, Information Risk Management [Video File]. Retrieved from https://www.youtube.com/watch?v=U5aKT_GYljs.
• [Informa Middle East]. (Nov. 23 2015). Webinar: Stakeholder Communication - Creating A Robust Stakeholder Communication Plan [Video File]. Retrieved from https://www.youtube.com/watch?v=FIqznmRBR8k
• [ARECyber LLC]. (Aug. 4, 2017). CISM Section 1 l Information Security Governance - Part 1 l CISM Certification l ARECyber LLC [Video File]. Retrieved from https://www.youtube.com/watch?v=7zNYb51CZTk
• [ARECyber LLC]. (Aug. 8, 2017). CISM Section 1 l Information Security Governance - Part 2 l CISM Certification l ARECyber LLC [Video File]. Retrieved from https://www.youtube.com/watch?v=BX-No1KPwxI
• [ARECyber LLC]. (Aug. 11, 2017). CISM Section 1 l Information Security Governance - Part 3 l CISM Certification l ARECyber LLC [Video File]. Retrieved from https://www.youtube.com/watch?v=gsQQRKmyh54
• [ARECyber LLC]. (Aug. 15, 2017). CISM Section 1 l Information Security Governance - Part 4 l CISM Certification l ARECYBER LLC [Video File]. Retrieved from https://www.youtube.com/watch?v=5ByDiWm_zYo
• [ARECyber LLC]. (Aug. 18, 2017). CISM Section 1 l Information Security Governance - Part 5 l CISM Certification l ARECyber LLC [Video File]. Retrieved from https://www.youtube.com/watch?v=__Idl_qnO18
• Pierce, Marvin. (Feb. 4, 2017). Information Security Policies - Development [Video File]. Retrieved from https://www.youtube.com/watch?v=nwvygzSeP4U
• [Information Security Forum]. (Nov. 27, 2017). Cyber and the Board: Stop Making Excuses and Start Making the Decisions that Matter [Video File]. Retrieved from https://www.youtube.com/watch?v=RP_tnn-K2pA
• [USENIX Enigma Conference]. (Feb. 16, 2016). USENIX Enigma 2016 - Security and Usability from the Frontlines of Enterprise IT [Video File]. Retrieved from https://www.youtube.com/watch?v=yvceztcMn6w
• [The Bunker]. (Aug. 1, 2016). GDPR - Creating a culture of information security [Video File]. Retrieved from https://www.youtube.com/watch?v=FQYZFM9B_HU
• [ALPHTN]. (Jan. 5, 2017). Security Awareness Training: Computer Ethics [Video File]. Retrieved from https://www.youtube.com/watch?v=XF7qFE3Yc-I
• Schreuders, Z. Cliffe. (Dec 23, 2014). Ethics: Computer Security Lectures 2014/15 S1 [Video File]. Retrieved fromhttps://www.youtube.com/watch?v=ubwmFcXvxdc
• [n.a.]. (n.a.). Information Security Compliance [Video Files]. Retrieved from https://www.youtube.com/results?search_query=Information+security+compliance
• Al--Shammari, Reem Faraj [KIACS Cyber Security Conference]. (Apr. 11, 2017). Day 1: Session 3: Information Security Culture "Changing the Miindset" [Video File]. Retrieved from https://www.youtube.com/watch?v=DPXy4rvyXRk
• [DOOR Training & Consulting CANADA]. (Jan. 7, 2017). Change the Culture, Change the Game Webinar [Video File]. Retrieved from https://www.youtube.com/watch?v=falGNh-W0AU