Cybersecurity Awareness Training Research Articles

Evaluating protection motivation based cybersecurity awareness training on Kirkpatrick's Model

ContextCybersecurity behavioral literature has a significant number of studies on training and awareness. However, there is lack of theoretical underpinnings in developing intervention to allow for positive behavioral change and evaluating them. The evaluation of theory based cybersecurity training warrants the use of program evaluation techniques. ObjectiveThe protection motivation theory (PMT) was employed to understand the behavioral change after the implementation of cybersecurity training. The evaluation was done on three levels of Kirkpatrick's evaluation model – reaction, learning and behavior. MethodA pre-post quasi experimental design was adopted in this research. A total of 154 undergraduate students from computing and digital arts backgrounds took part in the research. ResultsThe results of the study showed that the PMT based training was effective in increasing the threat knowledge of the students along with the increase in information of countermeasure strategies. From the two components of the PMT, self-efficacy was found to be the significant predictor of the cybersecurity behavioral intention in both pre-test and post-test PMT models. The cybersecurity training increased the self-efficacy of the students significantly and contributed towards cybersecurity behavioral intention change. The findings of this study imply that in designing the cybersecurity trainings, educators should dominantly take into account the self-efficacy component of the PMT.

A Survey of Cyber Crime Awareness Among Netizens of Higher Education Institutions: A Case Study of Zetech University

Protecting the integrity and confidentiality of information in sophisticated network systems is becoming increasingly vital and difficult. The computer may have been used in order to commit the crime and in other cases the computer may have been the target of the crime. The purpose of this research was to determine the level of awareness of cyber-attacks among students and staff of higher education institutions and to propose mechanisms to overcome cybercrimes attacks. A mixed technique approach was utilized in the study. The study was conducted at Zetech University with a purposively randomly selected population of 260 staff and students, and a sample of 150 was obtained. The descriptive statistics was used in the quantitative design to show the distribution of scores using a few indices. According to the findings, 63.4 percent of the participants had no cyber security awareness training, whereas 36.6 percent had. It is impossible to exaggerate the value of workplace cyber security awareness. The majority of participants (91.1%) were aware of the many sorts of cybercrimes, whereas 8% were unsure. 58.9% of respondents strongly concurred that they had never trusted websites that asked for their bank card information. Focusing on cyber security awareness reduces cybercrimes by more than 50%, according to 65.2 percent of participants. 72.3 percent firmly agreed that using encryption techniques to safeguard sensitive information was a good idea. The study's findings demonstrate that a rise in cybercrime is causing physical harm to individuals, with the majority of respondents saying that hackers had stolen their data and harmed them. Based on our research, we advise higher education institutions to invest in cutting-edge research facilities, place more emphasis on internal and external cyber security research and development, and emphasize that top management allocates sufficient financial resources to IT infrastructure and cyber security awareness trainings. Higher education institutions should regularly host conferences and training sessions for all staff and students on cyber security. The team in charge of overseeing the networks and IT infrastructure must make sure that email filtering and intrusion detection systems have been put in place to detect harmful assaults on university networks and systems.

Engagement and Players' Intended Behaviors in a Cybersecurity Serious Game

Serious games have been shown to be effective in engaging end-users for various types of training. However, the research in cybersecurity awareness training with serious games is scarce. The authors are interested in (1) the engagement factors that could predict users' intended behavior after learning and (2) whether or not playing a game repeatedly can affect engagement. They assessed players' coping and threat appraisal and measured their multidimensional (i.e., cognitive, affective, behavioral) engagement in cybersecurity awareness. The participants (N=122) in this experiment were randomly assigned to either three or five rounds of gameplay of a commercial cybersecurity awareness serious game. The findings revealed that users' engagement levels were significantly better sustained through five sessions of gameplay with cognitive (but not affective or behavioral) engagement. Serious game developers should include more activities in the cognitive dimension, rather than the affective or behavioral dimensions to assure high engagement and influence the intended cybersecurity awareness behaviors.

Cyberattacks on local governments 2020: findings from a key informant survey

ABSTRACT Based on empirical data from a survey that we conducted in 2020 of key informants in local governments (CIOs, CISOs, and IT Directors), this paper examines patterns of cyberattacks, types of attackers, the frequencies of incidents and breaches of local government IT systems, and purposes of attacks. The paper also examines whether and to what extend local governments offer cybersecurity awareness training to their officials and staff and whether a nexus exists between training and these persons support for cybersecurity in their governments. Throughout the paper, we compare data from the 2020 survey with data from a nationwide local government cybersecurity survey that a team that included the authors conducted in 2016. We conclude with recommendations to local governments to improve their practice and management of cybersecurity in their organisations.

A Quantitative Study of Risk Scores and the Effectiveness of AI-Based Cybersecurity Awareness Training Programs

Cybersecurity awareness training plays a dynamic role for organizations in certifying resources' accessibility. This paper determines the correlation between an employee's risk score and the effectiveness of AI-based security awareness training that deals with cyber threats. The research uses the Unified Theory of Acceptance and Use of Technology to update prior research, revealing that at-risk employees' behavior and information security awareness training implementation make up successful interventions. However, those studies did not discuss AI training, and so this research fills that literature gap. This study used a quantitative research design. The researcher analyzed survey responses using Pearson's Correlation and an independent t-test to determine statistically significant relationships and differences between employees' risk scores and an AI-based security awareness training programs' effectiveness. The calculations came from a sample of 200 participants from two different organizations. The Pearson product correlation of employee's risk scores and the effectiveness of the security awareness training program was statistically significant. The researcher also conducted an independent-samples t-test to compare the employees' risk scores by gender. There were no significant differences in scores. Male was higher than female ones. The mean difference was minimal. The findings herein help interpret the role of information security awareness training in the workplace, promoting behavioral changes that would impede data violations by including the users' vulnerability and the severity of intimidation, and the response to a threat in prognosticating behavior intentions.

Prevention of Phishing Attacks Using AI-Based Cybersecurity Awareness Training

Machine learning has been described as an effective measure in avoiding most cyberattacks. The development of AI has therefore promoted increased security for most computer attacks. Phishing attacks are risky and can be prevented through AI-based solutions. This factor suggests the need for increased awareness of cybersecurity through AI. Developing awareness for most people will prevent these types of attacks. The research paper describes how the awareness of AI-based cybersecurity could ensure a reduction of phishing attacks. The paper, therefore, showcases the effectiveness of AI-based cybersecurity awareness training and how it may influence cyber-attacks.

Reviewing Cybersecurity Awareness Training Tools Used to Address Phishing Attack at the Workplace

Reviewing Cybersecurity Awareness Training Tools Used to Address Phishing Attack at the Workplace

Senior Citizen Activity Centre E-commerce and Cybersecurity: The Way Ahead to IR 4.0

Background - The Malaysian ageing community’s IT aptitude is limited and is a key factor preventing Malaysia’s ageing population from successfully entering Industry 4.0. This study aims to digitalize Malaysian older people with e-commerce. This will require cybersecurity awareness training due to potential cybersecurity threats when conducting business online. Furthermore, this study advances the Industry 4.0 initiatives set by Malaysia’s National Industry 4.0 Policy Framework by means of a voluntary community-based training program. It also creates a policy that elevates Malaysia’s senior citizens’ current level of ICT innovation baseline commensurate with Industry 4.0 transformation standards. Methods – Participatory action research was conducted with members in a Senior Citizen Activity Centre (PAWE) through focus group discussions. Each focus group consisted of 6-8 people. Through identifying the community’s problem in the focus groups, an e-commerce platform was developed for the elderly to commercialise their existing products. The dissemination of e-commerce training and cybersecurity awareness were also conducted as part of mitigating fraud relating to online transactions. Results – The findings show that PAWE members’ IT aptitude was limited, that they needed assistance with understanding the e-commerce platform, and that they had limited cybersecurity awareness. Conclusions – The country’s ageing population programs and services are preparing for an ageing nation. In order for Malaysia’s ageing population to become self-sustainable, researchers suggest that Malaysian older persons become entrepreneurs. Third generation entrepreneurs must also be supported by social innovation, technological innovation, and cybersecurity awareness, which leads to achieving IR 4.0 and meets the economic, social and sustainable environmental goals.

Gender differences in predictors of technology threat avoidance

PurposeThe purpose of this paper is to examine gender differences in predictors of technology threat avoidance motivation and behavior among working US adults. Implications were considered in regard to cybersecurity awareness training motivation and perceptions of need for protective cybersecurity behavior in the workplace.Design/methodology/approachA single-shot regression-based study used ordinal regression supported by K-means clustering to evaluate the moderating effects of gender on predictors of technology threat avoidance motivation and behavior on a sample of n = 206 US adult workers.FindingsThe regression model explained 47.5% of variance in avoidance motivation and 39% of avoidance behavior variance. Gender moderated predictive associations between several independent variables and avoidance motivation: perceived susceptibility, perceived effectiveness, perceived cost and self-efficacy. Gender also moderated the association between avoidance motivation and avoidance behavior.Research limitations/implicationsThe predictive impact of gender extends beyond the main effects in technology threat avoidance. Data frequency distributions and inter-variable relationships should be routinely considered in threat avoidance studies, especially if sample variables exhibit non-normal frequency distributions and nonlinear associations.Practical implicationsGender was significantly associated with threat avoidance motivation and avoidance behavior and exhibited notable associations with antecedents of avoidance motivation. Related insights can inform the design and delivery of training content relating to technology threat avoidance as organizations strive to more effectively leverage information technology end-users as protective assets for the enterprise.Originality/valueThe uniqueness of this study derives from its focus and findings regarding the moderating effects of gender on technology threat avoidance factors and techniques used to measure and evaluate the associations between them.

Cyber Place Management and Crime Prevention: The Effectiveness of Cybersecurity Awareness Training Against Phishing Attacks

Criminologists and crime prevention practitioners recognize the importance of geographical places to crime activities and the role that place managers might play in effectively preventing crime. Indeed, over the past several decades, a large body of work has highlighted the tendency for crime to concentrate across an assortment of geographic areas, where place management tends to be absent or weak. Nevertheless, there has been a paucity of research evaluating place management strategies and cybercrime within the virtual domain. The purpose of this study was to investigate the effectiveness of place management techniques on reducing cybercrime incidents in an online setting. Using data derived from the information technology division of a large urban research university in the United States, this study evaluated the impact of an anti-phishing training program delivered to employees that sought to increase awareness and understanding of methods to better protect their “virtual places” from cybercrimes. Findings are discussed within the context of the broader crime and place literature.

Cybersecurity awareness training programs: a cost–benefit analysis framework

PurposeEmployees must receive proper cybersecurity training so that they can recognize the threats to their organizations and take the appropriate actions to reduce cyber risks. However, many cybersecurity awareness training (CSAT) programs fall short due to their misaligned training focuses.Design/methodology/approachTo help organizations develop effective CSAT programs, we have developed a theoretical framework for conducting a cost–benefit analysis of those CSAT programs. We differentiate them into three types of CSAT programs (constant, complementary and compensatory) by their costs and into four types of CSAT programs (negligible, consistent, increasing and diminishing) by their benefits. Also, we investigate the impact of CSAT programs with different costs and the benefits on a company's optimal degree of security.FindingsOur findings indicate that the benefit of a CSAT program with different types of cost plays a disparate role in keeping, upgrading or lowering a company's existing security level. Ideally, a CSAT program should spend more of its expenses on training employees to deal with the security threats at a lower security level and to reduce more losses at a higher security level.Originality/valueOur model serves as a benchmark that will help organizations allocate resources toward the development of successful CSAT programs.

How to prepare for the onslaught of phishing email attacks

Phishing email attacks are one of the biggest cyber security threats of our time, increasing exponentially year on year. Alarmingly we've seen attacks from phishing emails go up by nearly 700% compared to last year. 1 Cyber criminals are taking advantage of the huge potential for human error within any business, where one accidental click on a phishing email can allow access into entire corporate networks, a costly mistake to make. Cyber criminals are taking advantage of the potential for human error, where one click on a phishing email can allow access into corporate networks. Every business must have processes in place to cope with a potential phishing attack. Stephen Burke of Cyber Risk Aware looks at four key steps organisations can take to protect themselves. By ensuring that the correct infrastructure and technology is in place, combined with effective cyber security awareness training, businesses will be prepared to protect their networks.

Adaptive security awareness training using linked open data datasets

Cybersecurity is no longer an issue discussed only between the professionals or technologists, but it is also closely related to ordinary people whose daily life is exposed to kinds of cyberattacks. And Womabat Security Technologies conducted a survey revealed that ransomware is an unknown concept to nearly two-thirds of employees. In practical, almost 95% of cybersecurity attacks are due to human error. At fact, expensive and sophisticated systems cannot work effectively without considering the human factor, while human factor is the major vulnerability in cybersecurity. Thus, it has great significance to give people cybersecurity awareness training. In this paper, we present a system, named ASURA, providing adaptive training aimed at improving cybersecurity awareness of people. Three issues can’t be neglected in adaptive cybersecurity awareness training, as follows. Firstly, we need to decide the proper training contents from the huge training materials. Secondly, the training contents should be timely updated, as cyber attacks constantly changing. At last, we should conduct training through effective and acceptable approach. We solved above three issues in this paper, and the innovative idea of this paper is constructing hierarchical concept map from the LOD database DBpedia. Then, we employ a series of processing on hierarchical concept map, including PageRank algorithm used to calculate the importance of each concept node, and filtering used to filtered out undefined and unrelated concepts. In particular, we get training contents from DBpedia dynamically and timely updated, so that training contents is keeping up to date. ASURA delivered training contents completely online, thus significant trimmed budget and allowed learners accessing training outside of a traditional classroom. Moreover, ASURA provide adaptive training targeted to individual learner, as it generate training contents based on the keyword from the learner.

Improving employees’ intellectual capacity for cybersecurity through evidence-based malware training

Purpose An organization’s ability to successfully manage intellectual capital is determined by the actions of its employees to prevent or minimize information security incidents. To prevent more data breaches to intellectual capital, organizations must provide regular cybersecurity awareness training for all personnel. The purpose of this paper is to investigate the effect of different evidence-based cybersecurity training methods on employees’ cybersecurity risk perception and self-reported behavior. Design/methodology/approach The study participants were randomly assigned into four groups (i.e. malware report, malware videos, both malware report and malware videos and no interventions) to assess the effects of cybersecurity training on their perceptions of vulnerability, severity, self-efficacy, security intention as well as their self-reported cybersecurity behaviors. Findings The results show that evidence-based malware report is a relatively better training method in affecting employees’ intentions of engaging in recommended cybersecurity behaviors comparing with the other training methods used in this study. A closer analysis suggests whether the training method contains self-relevant information could make a difference to the training effects. Originality/value This paper reports an in-depth investigation on how different evidence-based cybersecurity training methods impact employees’ perceptions of susceptibility, severity, self-efficacy, security intention as well as on their self-reported cybersecurity behaviors.

Cyber security and human resource development implications for the enterprise

In contemporary society, cyber security problems are perceived as tightly aligned with the information technology (IT) field. Nevertheless, latent problems lurk within the problem domain. The bulk of cyber security problems consist of technological challenges and solutions; however, technological considerations are necessary but insufficient to fully address cyber security challenges. Most intrusion attempts are ultimately confronted by humans and many intrusion attempts succeed due to cognitive failure. This paper explores potential benefits of integrating activity to address cyber security behavioural exposures with enterprise human resource development (HRD). The human-oriented side of cyber security intersects HRD in three key underlying pillars of the non-technical discipline: economics, systems and psychology. The notion is further strengthened by the profusion of IT asset access throughout most enterprises for most worker roles. Risky cyber security behaviour is consequently a pervasive issue throughout the organisation, as virtually all employees may be confronted by intrusion activity. This paper provides a theoretical framework calling for interdisciplinary involvement throughout the enterprise to maximise cyber security awareness and tailor training for various role types. Findings are intended to more fully inform the HRD community of scholar-practitioners of the urgent need to design, deliver, implement and evaluate initiatives that could be utilised to diminish inappropriate and costly cyber security behaviour in various workplace environments.

An Effective Cybersecurity Training Model to Support an Organizational Awareness Program

Traditional cybersecurity, security or information security awareness programs have become ineffective to change people's behavior in recognizing, failing to block or reporting cyberthreats within their organizational environment. As a result, human errors and actions continue to demonstrate that we are the weakest links in cybersecurity. This article studies the most recent cybersecurity awareness programs and its attributes. Furthermore, the authors compiled recent awareness methodologies, frameworks and approaches. The authors introduce a suggested awareness training model to address existing deficiencies in awareness training. The Cybersecurity Awareness TRAining Model (CATRAM) has been designed to deliver training to different organizational audiences, each of these groups with specific content and separate objectives. The authors concluded their study by addressing the need of future research to target new approaches to keep cybersecurity awareness focused on the everchanging cyberthreat landscape.

Cybersecurity Awareness and Skills of Senior Citizens: A Motivation Perspective

ABSTRACT Senior citizens are one of the most vulnerable groups of Internet users who are prone to cyberattacks. Thus, assessing senior citizens’ motivation to acquire cybersecurity skills is critical to help them understand the risks of cyber-attacks. This study investigated a set of constructs that contribute to senior citizens’ motivation to acquire cybersecurity skills and assessed the actual cybersecurity skill level of these individuals. Utilizing a Web-based survey and a hands-on scenario-based app called MyCyberSkills™, this research study measured the constructs of interest before and after cybersecurity awareness training. Study participants were 254 senior citizens with a mean age of approximately 70 years. The results indicated that the cybersecurity awareness training was effective in increasing the cybersecurity skill level of the senior citizens and empowered them with small but significant improvements in the requisite skills to take mitigating actions against cyberattacks. Theoretical and practical implications are discussed.

Evaluation of Game-Based Learning in Cybersecurity Education for High School Students

Game based learning is a new game play mechanism that the players explore various aspects of game play in a learning context designed by the instructor or the game designer. Nevertheless, general acceptance of game based learning as a new learning paradigm was deferred by a lack of well-controlled, large sample efficacy studies. To address the increasing need of cybersecurity workforce, this paper introduces a game based learning method for high school cybersecurity education. Purdue University Northwest launched GenCyber high school summer camps to about 200 high school students in Chicago metropolitan area. The survey conducted after the summer camp indicated that the game based learning for cybersecurity education was very effective in cybersecurity awareness training. Further analysis of survey data revealed that there is a gender difference in raising students’ interests in cybersecurity and computer science education using game based learning method.

Cyber Security and National Security Awareness Initiatives in Albania: A Synergy Approach

Technological advances have changed the manner in which ordinary citizens conduct their daily activities. Many of these activities are carried out over the Internet. These include filling tax returns, online banking, job searching and general socializing. Increased bandwidth and proliferation of mobile phones with access to Internet in Albania imply increased access to Internet by the Albanian population. Such massive increased in access to Internet increases vulnerabilities to cyber crime and attacks and threatens the national security. As a result, Albania remains one of the countries that are targeted by phishing attacks. As a response, various entities engage in cyber security awareness initiatives and trainings with the aim to create cyber security awareness (CSA) among the citizens and the state institutions that operate in Albania. In the absence of a worthy national cyber security policy, however, these awareness initiatives and programmes are delivered through a variety of independent mechanisms. Various entities engage in cyber security awareness training each with its specific objectives and focus areas. It is argued in this paper that cyber security is complex and multi-faceted. No single solution can effectively address it and none of the participant actors can fight it by it's own. While the current means to create cyber security awareness does make impact, the fragmented and uncoordinated nature thereof have a potential to create its own dynamics. The focus of organizations and different institutional actors is, to deliver on their own objectives translates to some extent into the optimization of the behavior of individual entities as opposed to the optimization of the national cyber security awareness as a whole. This paper evaluates the extent to which the current cyber security awareness initiatives address the cyber security threats and risks. The assessment is based on the initiatives objectives, alignment of the program to the cyber threats, and the target audience. DOI: 10.5901/mjss.2013.v4n10p614

A video game for cyber security training and awareness

Although many of the concepts included in cyber security awareness training are universal, such training often must be tailored to address the policies and requirements of a particular organization. In addition, many forms of training fail because they are rote and do not require users to think about and apply security concepts. A flexible, highly interactive video game, CyberCIEGE, is described as a security awareness tool that can support organizational security training objectives while engaging typical users in an engaging security adventure. The game is now being successfully utilized for information assurance education and training by a variety of organizations. Preliminary results indicate the game can also be an effective addition to basic information awareness training programs for general computer users (e.g., annual awareness training.)