Tietoturvatietoisuusohjelman vaatimukset Kelan tietoturvayksikössä - Vento, Eero (2024)
We live in a world where romance scammers exploit innocent people for financial gain, sensitive health information is sold on the dark web, and cyberattacks can disrupt access to bank accounts. Today, the digital dimension is an integral part of our lives. Daily tasks are connected to the internet in one way or another. In almost all cyberattacks, human behavior plays a crucial role. The human factor is undoubtedly one of the most critical aspects that organizations must consider in security management. Society depends on internet-based services supported by the operations of companies and public sector organizations. One essential function is the implementation of social security, in which Kela, as an independent public institution, plays a significant role. Kela applies the internationally recognized ISO/IEC 27001 standard for managing information security. The standard sets requirements for information security awareness. To meet the requirements, Kela aims to design and implement an information security awareness program. This work has begun within Kela’s Information Security Unit, which has started to identify program requirements based on standards, frameworks, legislation, regulations, and the expectations of internal and external stakeholders. This effort is documented in this Master’s thesis, which uses a case study research strategy, employing interviews and document analysis as the primary methods. The research methods are supported by the literature review based on existing studies. Data sources include Kela’s public documentation, experts from Kela, relevant legislation, and international standards and frameworks. The thesis resulted in a set of requirements to be used as the foundation for designing Kela’s awareness program. Key findings emphasized requirements related to management support, resourcing, planning, content, implementation, and continuous improvement. The findings highlighted the importance of aligning the awareness program with the organizational strategy, ensuring sufficient time allocation, incorporating risk assessment in the planning phase, and employing diverse communication strategies.