Information security awareness training can be best defined as training conducted in an organization so that the staff can understand the importance of security within an organization. Today environment, information threats can’t be left in the hand of the Information Security team as newer threats are arising from social engineering. An informed user community will ensure such threats are contained and the users are informed on what to do when an incident occurs. Is it necessary to conduct user awareness training? This is a question I was personally...