Which statement reflects a security education and training principle from the 1997 report?

Which statement reflects a security education and training principle from the 1997 report?

• A. Use two-factor authentication
• B. Establish security education and training
• C. Develop policies for software discipline
• D. Use encryption to protect information in transit

Answer: (B)

Focusing on people and how they interact with security is the core idea here. The 1997 report emphasized that organizations must establish security education and training to ensure everyone understands security policies, knows how to recognize risks (like phishing or social engineering), and follows secure practices in daily tasks. This principle helps reduce human error, which is a common gap in overall security. Among the options, the statement about establishing security education and training directly captures this focus on people and awareness. The other choices describe specific technical controls (like authentication or encryption) or policy development for software practices. While those are important parts of a security program, they do not embody the educational and training aspect that strengthens users’ security behavior.

Focusing on people and how they interact with security is the core idea here. The 1997 report emphasized that organizations must establish security education and training to ensure everyone understands security policies, knows how to recognize risks (like phishing or social engineering), and follows secure practices in daily tasks. This principle helps reduce human error, which is a common gap in overall security.

Among the options, the statement about establishing security education and training directly captures this focus on people and awareness. The other choices describe specific technical controls (like authentication or encryption) or policy development for software practices. While those are important parts of a security program, they do not embody the educational and training aspect that strengthens users’ security behavior.