Cybersecurity Behavior Research Articles

Cybersecurity behaviours of the employees and students at the Estonian Academy of Security Sciences

PurposeThe purpose of this study is to identify the most common characteristics that make Internet users at the Estonian Academy of Security Sciences (SKA) vulnerable to various threats. This includes password management habits, online banking, shopping and payment behaviours, time spent online, use of public Wi-Fi, gaming and watching movies online. Additionally, the study seeks to review the dangers users encounter and how cautious they are, such as which online activities they consider the most dangerous and which they perceive as safe.Design/methodology/approachThe data used in this paper is based on an overview of relevant literature, highlighting previous studies and methodologies and explaining why the human factor is considered the weakest link in cybersecurity. This research aims to help characterise the patrons of the SKA and make suggestions for future training and research. For this purpose, the students, administrative employees and academic staff of the SKA were investigated. A five-point scale questionnaire with 54 questions was used as the methodology of the study, considering the following four scales: risky behaviour, conservative behaviour, risk exposure behaviour and risk perception behaviour. The results are interpreted based on the literature, and data obtained from the completed questionnaires were analysed using Excel’s Data Analysis ToolPak. The results are presented mostly as tables and bar charts.FindingsThe research results show that the cybersecurity behaviour of employees and students is generally at a good level. However, some aspects of conservative behaviour need increased attention, such as the use of USB and other external media, opening links in emails too readily, monitoring the authenticity of visited websites and deleting browsing history before logging out. Cyber training has a noticeable effect on behaviour, particularly in the context of password management.Originality/valueNo previous research on cyber behaviour has been conducted in the context of Estonian higher education, despite the increasing number of cyber-attacks in this sector.

Cybersecurity behavior in the metaverse: opportunities, challenges and future trends for libraries

Purpose This study explores cybersecurity behavior in the metaverse, focusing on the opportunities, challenges and future trends for libraries. This study aims to assess the evolving threats in virtual environments and the role libraries play in addressing cybersecurity in these immersive digital spaces. Design/methodology/approach This research uses a narrative review approach, synthesizing existing literature on cybersecurity threats in the metaverse, vulnerabilities of metaverse platforms and user behavior risks. It also examines how libraries can mitigate these risks while leveraging metaverse technologies. Findings This study identifies significant cybersecurity risks in the metaverse, including data breaches, identity theft and virtual property theft. It also highlights the vulnerabilities of metaverse platforms, such as weak user authentication and system integration challenges. Moreover, user behavior – like weak passwords and susceptibility to social engineering – amplifies these risks. Libraries have an opportunity to enhance digital literacy and cybersecurity education but face technological and skill-based barriers. Originality/value This study provides a novel exploration of how libraries can address cybersecurity concerns in the metaverse. It highlights the importance of proactive measures and evolving technologies in ensuring a safe virtual experience.

Organizational Environment, Protection Motives, Adoption of Machine Learning, and Cybersecurity Behavior

The research presented in this intensive study uncovers the complex interaction between organizational and individual drivers affecting cybersecurity behavior within organizations. Its major focus is analyzing the impact of organizational policies and culture, training, and awareness programs on the cybersecurity conduct of employees. This paper also examines self-protective behavior related to risk perception, perceived self-efficiency, and response efficacy, which explains how these variables may influence self-protective behaviors. According to the Protection Motivation Theory (PMT), the study unravels how individuals' different elements of threat appraisal, coping appraisal, and cost-benefit analysis contribute to their decisions to apply cybersecurity behaviors. It also underlines that machine learning is being used more and more in cybersecurity and demonstrates some important ML concepts in modern cybersecurity, such as picking up the right data to train with, coping with adversarial attacks, and, last but not least, making the models interpretable. Ultimately, having a comprehensive understanding of these cybersecurity behaviors may shed new light on mechanisms that can be used to develop cybersecurity strategies and technologies to help protect against the rapidly changing landscape of cyber threats. All research papers have an abstract. It can be created by simply compiling the main points (summary) of each section of the research paper.

Cybersecurity behavior change: A conceptualization of ethical principles for behavioral interventions

The importance of changing behaviors is gradually being acknowledged in cybersecurity, and the reason is the realization that a notable portion of security incidents have a human-related component. Thus, enhancing behaviors at individual level, can bring a significant reduction in security breaches overall. Behavior change refers to any modification of human behavior through some type of intervention. Interventions from behavioral economics and psychology are being increasingly introduced in the field, however, the ethics surrounding such interventions are largely neglected. In this paper, we raise the ethical issues associated with behavioral intervention approaches. We draw on the traditionally more mature field of biomedical ethics and propose six clusters of ethical principles suitable for cybersecurity behavior change. We conducted a survey (N = 141) to identify individuals’ perceptions on the proposed ethical principles and validate their perceived usefulness. We analyze an existing intervention in the light of our six-principle conceptualization to showcase how it can be used as a practical apparatus. Our set of ethical principles are aimed for cybersecurity professionals, policy makers, and behavioral intervention designers, and can serve as a starting point for best-practice development in cybersecurity behavior change ethics.

Analysis of digital footprints associated with cybersecurity behavior patterns of users of University Information and Education Systems

Analysis of digital footprints associated with cybersecurity behavior patterns of users of University Information and Education Systems

On the factors of students' cybersecurity behavior

The article is an exploratory research on the security awareness of university students in the light of various sociodemographic factors. Information technology, and information security in particular, plays a critical role in this context. Awareness is a fundamental component of security preparedness because it empowers individuals to recognize and respond to security threats and fosters a security culture. By educating students and teachers about the importance of security and best practices, educational organizations can significantly enhance their overall security posture. The article points out that raising awareness of information security is not a simple task and requires a systematic approach. In this respect, education has both the potential and the responsibility to develop an information security mindset. The results of the article show that although the average response value of 3.735 suggests a security-aware attitude, the significant difference between the minimum and maximum values indicates a high variability. Looking in more detail at information security factors, the article reveals that law students are more cautious about protecting personal data, while IT and engineering students are more open to online banking and shopping.

HUBUNGAN LITERASI DIGITAL DENGAN PERILAKU KEAMANAN SIBER PADA MAHASISWA PERPUSTAKAAN DAN SAINS INFORMASI UNIVERSITAS PADJADJARAN

This research aims to find the relationship between digital literacy and cybersecurity behavior among Library and Information Science students in Universitas Padjadjaran. The concept of digital literacy used in this research is based on three dimensions, including technical, cognitive and social-emotional dimensions. This study used a quantitative method with correlational approach, that attempts to analyze the relationship between two or more variables and the strength of the relationship. 75 students from classes of 2020, 2021 and 2022 in the department have been selected as the target of this study with simple random sampling technique. The results of the research show that the three dimensions, namely technical, cognitive and socio-emotional dimensions, all are having a significant relationship with cybersecurity behavior. The three are also having a low level of relationship when it comes to cybersecurity behavior. Based on the results, it can be concluded that digital literacy has a significant relationship with cybersecurity behavior, despite the level of the relationship between the two are low. Which also means that a high level of digital literacy doesn’t guarantee good cybersecurity behavior either.

Unraveling influential factors shaping employee cybersecurity behaviors: an empirical investigation of public servants in Vietnam

PurposeGovernment employees must comply with policies on information security regulations, online security practices, social networking usage, internet addiction, online cyberthreats and other related habits. These activities are considered cybersecurity behaviors. Government social media (GSM) accounts are increasingly used to educate employees about cybersecurity risks. To support the effectiveness of cybersecurity practices in government organizations, the purpose of this study is to investigate the impacts of GSM and organizational policy compliance on employees’ cybersecurity awareness, motivation and behaviors.Design/methodology/approachData were obtained by administering a questionnaire survey to public personnel in Vietnam. A total of 330 valid responses were obtained, and the research hypotheses were tested using partial least squares–structural equation modeling.FindingsFirst, cybersecurity awareness enhances information protection motivation and employee protective behavior. Second, GSM has positive impacts on cybersecurity knowledge and information protection motivation. Third, there is a strong positive association between information protection motivation and employee protective behavior. Finally, while organizational compliance significantly increases cybersecurity awareness, its impact on employee protective behavior is ind irect.Originality/valueThis research enhances the literature on the behavioral dimension of cybersecurity. The primary objective of this study is to assess the influence of cybersecurity awareness on protective behaviors rather than intents and attitudes alone. Furthermore, this research integrates protection motivation theory and cultivation theory to provide a more thorough assessment of cybersecurity awareness and protective behavior. By investigating the impact of GSM on the level of cybersecurity awareness among employees within government organizations, this study provides valuable insights into the efficacy of recent governmental initiatives aimed at fostering cybersecurity.

Evaluating the barriers affecting cybersecurity behavior in the Metaverse using PLS-SEM and fuzzy sets (fsQCA)

While offering novel user experiences, the Metaverse introduces complex cybersecurity challenges due to the sophisticated interaction of augmented reality (AR), virtual reality (VR), and web technologies. Addressing the barriers to cybersecurity behavior is essential to protect users against risks such as identity theft and loss of digital assets. Therefore, this research aims to investigate these barriers by developing a theoretical model that draws factors from the Technology Threat Avoidance Theory (TTAT) and considers variables such as privacy concerns, perceived risks, and response costs. The data were collected from 395 Metaverse users and were analyzed using the Partial Least Squares-Structural Equation Modeling (PLS-SEM) and fuzzy-set Qualitative Comparative Analysis (fsQCA). The PLS-SEM findings showed that perceived threats, privacy concerns, and response costs have a significant negative impact on cybersecurity behavior, while perceived risks have an insignificant negative influence. The fsQCA results revealed that there is not a single pathway leading to robust cybersecurity behavior. Instead, eight configurations that include the presence and absence of certain conditions can lead to this desirable outcome. The findings not only advance the academic conversation on Metaverse security but also offer actionable strategies for stakeholders to reinforce user protection in this dynamic virtual environment.

Cybersecurity Awareness, and Cybersecurity Behavior of High School Students in Davao City: A Mediation Role of Perceived Behavioral Control

This study aims to determine the mediating effect of perceived behavioral control in the relationship between cybersecurity awareness and cybersecurity behavior of high school students in Davao City, Philippines drawing on the Theory of Planned Behavior (TPB). Using a quantitative approach, data were collected through a survey questionnaire distributed to 100 high school students in a private school in Davao City. Established measures were used to assess cybersecurity awareness, perceived behavioral control, and cybersecurity behavior, with strict adherence to ethical considerations and data confidentiality. The study discovered a significant positive correlation among students' cybersecurity awareness, perceived behavioral control, and cybersecurity behavior. Both awareness and perceived control were found to be strong predictors of cybersecurity behavior, indicating that students with higher awareness and confidence in their abilities are more likely to engage in positive cybersecurity practices. These findings underscore the importance of educational efforts in promoting cybersecurity behavior among high school students. By enhancing cybersecurity awareness and promoting a sense of control among students, educators, and policymakers can better prepare them to navigate the digital landscape safely. Future research should explore the effectiveness of different educational interventions and assess their long-term impacts on students' cybersecurity behavior.

Driving behaviour change with cybersecurity awareness

Organisations implementing cybersecurity awareness (CSA) should strive to positively change employees’ attitudes and behaviours. In practice, though, most of such initiatives only manage to increase employees’ knowledge. In cybersecurity, knowledge on its own will have no significanst value unless it is used to guide decisions and inspire actions.This study, therefore, has investigated the attributes that could influence and contribute to positive changes in employees’ cybersecurity behaviours. The study used a literature review for questionnaire design and then employed the Delphi method with 22 experts, which consequently identified seven such attributes. These attributes are as follows: i) obtain senior management support and participation in CSA activities; ii) consider CSA as a continuous process that needs to be updated and improved on a regular basis; iii) cultivate and spread ‘cybersecurity’ as a norm in the organisation; iv) encourage cybersecurity activities and behaviours through incentives; v) craft and use persuasive CSA messages; vi) employ innovative and effective approaches to disseminate CSA messages; and vii) recommend security activities that are achievable and pertinent for the audience.

Human-centric cyber security: Applying protection motivation theory to analyse micro business owners’ security behaviours

Purpose The current advancements in technologies and the internet industry provide users with many innovative digital devices for entertainment, communication and trade. However, simultaneous development and the rising sophistication of cybercrimes bring new challenges. Micro businesses use technology like how people use it at home, but face higher cyber risks during riskier transactions, with human error playing a significant role. Moreover, information security researchers have often studied individuals’ adherence to compliance behaviour in response to cyber threats. The study aims to examine the protection motivation theory (PMT)-based model to understand individuals’ tendency to adopt secure behaviours. Design/methodology/approach The study focuses on Australian micro businesses since they are more susceptible to cyberattacks due to the least security measures in place. Out of 877 questionnaires distributed online to Australian micro business owners through survey panel provider “Dynata,” 502 (N = 502) complete responses were included. Structural equational modelling was used to analyse the relationships among the variables. Findings The results indicate that all constructs of the protection motivation, except threat susceptibility, successfully predict the user protective behaviours. Also, increased cybersecurity costs negatively impact users’ safe cyber practices. Originality/value The study has critical implications for understanding micro business owners’ cyber security behaviours. The study contributes to the current knowledge of cyber security in micro businesses through the lens of PMT.

The influence of work overload on cybersecurity behavior: A moderated mediation model of psychological contract breach, burnout, and self-efficacy in AI learning such as ChatGPT

In today's rapidly evolving digital landscape, organizations face the critical challenge of safeguarding their sensitive information and systems from an ever-increasing array of cybersecurity threats. As employees play a crucial role in maintaining organizational cybersecurity, it is essential to understand the factors that influence their cybersecurity behavior. This study investigates the impact of work overload on employee cybersecurity behavior, exploring the sequential mediating effects of psychological contract breach and burnout, as well as the moderating role of self-efficacy in AI learning. Drawing upon the Job Demands-Resources (JD-R) model, Conservation of Resources (COR) theory, and Social Cognitive Theory, we propose a moderated mediation model to elucidate the complex relationships among these variables. To test our hypotheses, we conducted a three-wave survey study involving 363 employees from various sectors in South Korea. Data was collected using an internet-based survey platform, and the study employed stratified random sampling to reduce sampling bias. Results from structural equation modeling (SEM) analyses revealed that work overload indirectly impacts cybersecurity behavior through the sequential mediation of psychological contract breach and burnout. Furthermore, self-efficacy in AI learning such as ChatGPT was found to moderate the relationship between work overload and psychological contract breach, acting as a buffer to mitigate the negative effects of work overload. This study contributes to the existing literature by addressing several research gaps. First, it provides a comprehensive examination of the impact of work overload on employee cybersecurity behavior. Second, it investigates the underlying psychological processes (i.e., psychological contract breach and burnout) that explain the relationship between work overload and cybersecurity behavior. Third, it explores the moderating role of self-efficacy in AI learning such as ChatGPT, an understudied factor in the context of work overload and cybersecurity behavior.

Optimism amid risk: How non-IT employees’ beliefs affect cybersecurity behavior

PurposeThis study delves into the interplay between personal dispositions and cybersecurity behaviors within organizational settings. It investigates how optimism bias influences attitudes toward cybersecurity and subsequently affects cybersecurity behavior. Additionally, it examines the moderating role of information security awareness in shaping the relationship between attitude and risky cybersecurity behavior. Design/methodology/approachDrawing upon extensive research on coping mechanisms and attitude-behavior consistency, we develop a research model that hypothesizes the dynamics of optimism bias, attitude toward cybersecurity, risky cybersecurity behavior, and information security awareness. Survey data are collected from non-IT employees across the United States, and the model is empirically validated using structural equation modeling (SEM). FindingsThis study finds that optimism bias directly contributes to risky cybersecurity behavior and fosters a negative attitude toward cybersecurity. It also reveals that a poor attitude toward cybersecurity further reinforces risky cybersecurity behavior. Additionally, information security awareness is found to negatively moderate the relationship between the attitude toward cybersecurity and risky cybersecurity behavior. Originality/ValueThis study investigates optimism bias in the context of cybersecurity. It enhances the theoretical and empirical understanding of optimism bias in cybersecurity by revealing its influence on cybersecurity attitude and behavior in organizational settings. It also offers managerial insights into the importance of shaping non-IT employees’ cybersecurity attitudes and behavior through risk communication, cybersecurity education, and training.

Drivers of Banking Consumers’ Cybersecurity Behavior: Applying the Extended Protection Motivation Theory

Objective - This study aims to analyze the relationships between perceived knowledge and protection habits on cybersecurity behavior among active mobile banking users in Indonesia. The research direction involves empirical testing, employing the protection motivation theory (PMT) to develop a mediating model encompassing threat appraisal and coping appraisal components. Methodology/Technique - A quantitative research approach was employed to examine the twelve hypotheses developed based on the extended PMT. An online survey could obtain 380 valid responses where the respondents were selected using a purposive sampling technique. Since this study extended the PMT, data was analyzed using PLS-SEM to maximize the predictive model. Findings – This study validated the protection motivation theory (PMT) by confirming the effect of all threat and coping appraisal components on protection behavior, except for perceived vulnerability. The results also reported a substantial impact of perceived knowledge and protection habits on cybersecurity behavior among active mobile banking users in Indonesia. Novelty - This research is one of a few studies that extend PMT by integrating perceived knowledge and protection habits to understand consumer behavior toward cybersecurity risk. Type of Paper: Empirical JEL Classification: M31, M15 Keywords: Cybersecurity behavior, Mobile banking, Perceived knowledge, Protection habit, protection Motivation theory (PMT). Reference to this paper should be made as follows: Tambariki, C; Sondakh, O.B; Dondokambey, V.A; Hendriana, E. (2024). Drivers of banking consumers’ cybersecurity behavior: Applying the extended protection motivation theory, J. Mgt. Mkt. Review, 9(1), 01 – 12. https://doi.org/10.35609/jmmr.2024.9.1(1)

Unlocking the potential of cybersecurity behavior in the metaverse: Overview, opportunities, challenges, and future research agendas

The metaverse, often referred to as the next stage of the Internet, is a virtual space that utilizes advanced technologies, such as augmented reality, virtual reality, and mixed reality, to enable real-time engagement and experiences beyond what can be achieved in reality. Cybersecurity behavior in the metaverse refers to the actions taken by individuals and organizations to protect themselves and their information from various cyber threats in virtual reality environments by implementing various cybersecurity measures. Research on cybersecurity behavior in the metaverse is still limited. This study offers an overview of cybersecurity behavior in the metaverse and identifies a range of potential opportunities. It also discusses the current and prospective challenges and suggests large-scale research agendas that can be examined in future research. The research agendas encompass extensive subject areas, such as security of the metaverse, influential factors, human behavior in the metaverse, virtual identity and access management, privacy, legal, and ethical issues, and cybersecurity education and awareness. This study offers a crucial and timely insight into cybersecurity practices in the metaverse, considering the advancement of metaverse technology.

Examining the impact of work overload on cybersecurity behavior: highlighting self-efficacy in the realm of artificial intelligence

Examining the impact of work overload on cybersecurity behavior: highlighting self-efficacy in the realm of artificial intelligence

A typology of cybersecurity behavior among knowledge workers

While the cybersecurity literature on behavioral factors has expanded, current countermeasures often overlook employee-specific behavioral differences, leading to generic solutions. This study addresses this gap by introducing a typology of knowledge worker cybersecurity behaviors through cluster analysis. Based on online survey data (n = 264), we identify six main dimensions of cybersecurity attitude and behavior and, based on these, four behavioral cybersecurity types with distinct characteristics and demographic profiles: Naïve Greenhorns, Traditional Examiners, Flexible Mavericks, and Reliable Troupers. Contrary to common beliefs, the study found that older employees demonstrate high cybersecurity resilience, while younger ones pose a higher risk. These findings underscore the importance of tailored, human-centered cybersecurity approaches.

Validation of cyber security behaviour among adolescents at Malaysia university: Revisiting gender as a role

Cyber-attacks and crimes are still a problem in Malaysia. COVID-19 has pushed Malaysians into the digital world more quickly. These cyberattacks may rise and affect more people. Thus, the aim of this study is to find out if there is a significant difference in the level of cyber security behaviour between males and females in the aspects of malware, password usage, phishing, social engineering and online scamming in Malaysia. An online questionnaire survey was used to gather data from Malaysia and received 207 total responses. Cronbach's alpha is used to measure questionnaire items' reliability. A t-test is used to determine the differences between male and female cyber security behaviour. The results show that there is no significant difference between males and females in four aspects out of five, which are malware, password usage, phishing and social engineering. There is a significant difference between males and females in the aspect of online scams. This research helps those who formulate education policies by determining that there is no noticeable gender difference. Men should get the same level of education and training as women. The findings also demonstrate that women's awareness of technology is increasing.

The Determinants of Risky Cybersecurity Behaviour: A Case Study Among Employees in Water Sector in Malaysia

Objective: Cybersecurity threats are a growing concern around the world. Research found that the weakest element in the cybersecurity chain is that of the human. The use of security technologies failed to address the problem in instances where employees engage in activities that place themselves and the company at risk. Hence, the role human factors play in cybersecurity is crucial. The present study aims to examine the effects of information security issues awareness, top management support, leadership, information security policy and cybersecurity awareness training on risky cybersecurity behaviour among employees in water sector.
 
 Method: The quantitative method was applied in this study. The data were collected from 425 employees from four water companies located in northern states of Malaysia. The respondents are selected using disproportionate stratified random sampling technique. The survey was conducted using questionnaire. PLS-SEM was used to test the proposed hypotheses.
 
 Results: The results show that security issues awareness and top management support are negatively related to risky cybersecurity behaviour. This suggest that the greater security issues awareness and top management support, lower the tendency to engage in risky cybersecurity behaviour among employees. Contrary to the prediction, cybersecurity awareness training was found to be positively related with risky cybersecurity behaviour.
 
 Conclusions: The findings of the study have several theoretical and practical implications. Security issues awareness and top management support are important factors to avoid threat of cyber-attacks. By ensuring cybersecurity, water security is stored hence the well-being of people is taken care since water is a fundamental need of human lives. The stability and security of the country also can be maintained with secure and sustainable water resiliency. Finally, the economic losses due to cyber-attacks can be reduced.