Key facts and figures about the AR community and its members

Key facts and figures about the AR community and its members June 2008

Key facts and figures about the AR community and its members

Contents ENISA and the AR section 3 The awareness raising community a success story 4 The AR community a growing group 5 How big is the AR community? 7 The gender gap 12 Members at work 14 The jobs members do 15 For which target groups are members raising information security awareness? 16 The AR community at work 17 Contact details 18

ENISA and the AR section The European Network and Information Security Agency (ENISA) is an EU agency established to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard for information on good practices. Moreover, the agency facilitates contacts between the European institutions, Member States and private business and industry actors. To this end, the AR section of ENISA is engaged in positively influencing public behaviour towards information security, changing the mindset of the human element in order to achieve greater self-awareness.

The awareness raising community a success story The awareness raising (AR) community is a subscription-free community open to experts who have an interest in engaging in raising information security awareness within their organisations. The AR community was launched last February and is designed to engage with the awareness raising section of ENISA in its mission to foster a culture of information security, with the aim of supporting the section in its activities. As a point of contact for matters related to information security awareness, the AR community has grown now to 35 nations, comprising 150 members. Not all European countries participate, but the AR community welcomes membership applications from any European or non-european country. good practices. Thus, the establishment of the AR community marks the beginning of a deep engagement not only with sharing but also with analysis of information security good practices across Europe. Through a series of graphs and charts, this booklet presents basic facts and figures about the AR community and its members. The abbreviations used for each country are those given in the key on the inside front cover. The cut-off date for data used in this publication was June 2008. Though members have a diverse range of skills and knowledge of ICTs, and differing interests and levels of expertise and priorities, they are united in helping the AR community become the intellectual backbone of the exchange of information security The AR portal on the ENISA website enables readers to learn more about AR community activities, publications and events.

The AR community a growing group The AR section began building an AR community in late 2006. To enhance the capacity of such a community, promote knowledge sharing and establish and support dialogue within institutions of Member States and other stakeholders, the AR section created a new way of coming together and sharing information. Monthly conference calls were organised from March 2007 and were joined by about 20 participants from eight European countries: Austria, Belgium, Germany, Ireland, Italy, Luxembourg, the Netherlands and the United Kingdom. EU and EEA countries represented in the AR Community During 2007, following the positive feedback received by stakeholders and the common willingness to create a recognised and established information security awareness community, the AR section included in the framework of the multi-thematic annual programme of the Agency ( Developing and maintaining cooperation models ) the creation of the AR community. EU countries EEA countries

Later in 2007, the work programme of ENISA was approved, giving this responsibility to the AR section and thus laying the foundations of the AR community. The AR Community worldwide Austria, Belgium, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, India, Ireland, Italy, Malta, the Netherlands, Norway, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, the United Kingdom, the United Sates, and Vietnam joined in February 2008, followed by Egypt, Luxembourg, Morocco, New Zealand, and Turkey in April 2008, Australia, Latvia and Cyprus in May 2008 and Lithuania in June 2008. The AR community sees different people and cultures as an asset in promoting a culture of information security.

How big is the AR community? The AR community is approximately half the size of the CERT community, but its population is 10 % smaller. In fact, the CERT community (which was established in the 1990s) has 200 worldwide teams with an average of six members per team. This CERT community trend could have important implications for the future of the AR community.

The AR community covers 5 continents Africa, Asia, Europe, North America and Oceania and a large number of countries are represented.

The AR community has 150 members. The largest membership is from Europe. 160 Members by continent 140 120 100 80 60 40 20 0 Europe North America Africa Asia Oceania Continent

The EU members are not spread evenly across the continent: some countries are not yet represented, for instance Bulgaria, Czech Republic, Liechtenstein, and Poland. Members by EU country 18 16 14 Number of Members 12 10 8 6 4 2 0 GB IT BE DE GR NL DK ES NO MT SE FI FR IS IE AT HU PT SI CY EE LT LU LV RO SK Country 10

The gender gap More men than women are registered in the AR community. This is perhaps due to the fact that information security awareness matters fall in the technical sector where women are often not well represented. 11

Membership growth AR community membership increases through a combination of push and pull activities, although the strength for push activities was higher than the corresponding pull activities. Most of the AR community s population growth is due to a common recognition of the importance of information security awareness. Membership growth from February to June 2008 160 140 120 100 80 60 40 20 0 Mid Februray End Februray Mid March End March Mid April End April Mid May End May Mid June Month 12

Forecast* of membership growth until the end of 2008 300 250 200 150 100 50 0 Februray March April May June July August September October November December Month * Forecast calculated using linear regression analysis 13

Members at work The AR community is a subscription-free community open to experts who have an interest in engaging in raising information security awareness within their organisations regardless of the sector to which they belong. Cultural diversity and different levels of knowledge and experience in matters related to information security awareness are highlighted; indeed, these variations are an asset for the entire community. The aim is to increase the number of members working for academia and government as they count for only a third of the number working for industry. 14

The jobs members do Since the launch of the AR community, 57% of members have been working in industry, 20 % in government and 15% in academia. The figure for other sectors, such as public associations, intergovernmental bodies (such as the European Commission and agencies) and NGOs, accounts for 8% of the total number of members. Recent figures show that while industry membership levels continue to rise, the number of government and academia members remain relatively stable. 60 Percentage of workforce represented in Industry, Goverment, Academia and Other 50 40 30 20 10 0 Industry Goverment Academia Other* *Intergovernmental Organisations, NGOs, Public associations Sector 15

For which target groups are members raising information security awareness? AR community members are engaged in raising information security awareness for an average of four target groups. Some 33.3 % of members concentrate their activities on one target group only, while 4.7% of members concentrate their activities on 10 or more target groups. Raising Awareness by Target Group 90 80 70 60 50 40 30 20 10 0 Industry Public sector Employees Local governments General public SMEs Home Children users Academia Parents Media Others Target Group 16

The AR community at work The AR community s work has increased through a combination of activities which sees the continuous involvement of members of the community. ARNews and a calendar of events are prepared using inputs received by experts and they are then distributed to community members who wish to receive periodic correspondence or AR publications. Along with this, the AR community offers the chance to participate in presentations at events (including the AR ENISA ones) and to attend and contribute to monthly conference calls. The AR community holds regular conference calls for sharing emerging good practices, discussing cutting-edge topics and key issues in the information security field. AR community members can participate in virtual working groups which enable the exchange of information on awareness security topics and the preparation of White Papers which will be used to educate readers and help people deal with information security matters. Using the AR portal, it is possible to access conference call material, receive up-to-date information on awareness raising section activities, publications, events and most importantly connect with other members in the community. 17

Contact details For contacting ENISA or for general enquiries about the AR community, please use the following details: e-mail: Isabella Santa, Senior Expert Awareness Raising, awareness@enisa.europa.eu Internet: http://www.enisa.europa.eu/ Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA Regulation (EC) No 460/2004. This publication does not necessarily represent state-of the-art and it might be updated from time to time. This publication is intended for information purposes only. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. European Network and Information Security Agency (ENISA), 2008 18

Design: csaitis@ochra.gr Illustrations: Nektarios Matsikas