Information Security Awareness Programs Research Articles

A Framework for an Effective Information Security Awareness Program in Healthcare

Electronic Health Record (EHR) is a valuable asset of every healthcare and it needs to be protected. Human errors are recognized as the major information security threats to EHR systems. Employees who interact with EHR systems should be trained about the risks and hazards related to information security. However, there are limited studies regarding the effectiveness of training programs. The aim of this paper is to propose a framework that provides guidelines for healthcare organizations to select an effective information security training delivery method. In addition, this paper proposes a guideline to develop information security content for awareness training programs. Lastly, this study attempts to implement the proposed framework in a selected healthcare for evaluation. Hence, a serious game is developed as a training method to deliver information security content for the selected healthcare. An effective training program raises employees’ awareness toward information security with a long-term impact. It helps to gradually change employees’ behavior over time by reducing their negligence towards secure utilization of healthcare EHR systems.

Can perceptual differences account for enigmatic information security behaviour in an organisation?

Information security in organisations is often threatened by risky behaviour of users. Despite information security awareness and training programmes, the human aspect of information security remains a critical and challenging component of a safe and secure information environment, and users reveal personal and confidential information regularly when asked for it. In an effort to explain and understand this so-called privacy paradox, this paper investigates aspects of trust and perceptual differences, based on empirical research. Two preceding social engineering exercises form the basis of the research project and are also presented as background information. Following the empirical work, a safe and secure information model is proposed. It is then argued that perceptual alignment of different organisational groups is a critical and prerequisite requirement to reach information security congruence between groups of people. In the context of the proposed model, the perceptual differences also offer some explanation as to why users with high levels of security awareness as well as high levels of trust in own and organisational capabilities so often fall victim to social engineering scams. The empirical work was performed at a large utility company and results are presented together with appropriate discussions.

Security Awarness Program for Customers Using Online Banking

AbstractDue to the increasing demand on electronic payments, fraud methods are also increasing which has resulted in the loss of millions of dollars worldwide each year in the banking sector. Several studies have been conducted to counter against fraud in the banking domain and to come up with ways to secure online payments. None of these studies, however, have resulted in a comprehensive awareness program which targets customer banking. The purpose of this research is to propose an awareness program, Information Security Awareness Program, dubbed ISAP. We believe that such a program is needed for the following reasons: a) in order to enhance the level of trust in online banking, b) to protect each customer’s personal information and c) to comply with the online bank requirements. We have identified several online frauds, and then we recommended some best practices for online protection in the following areas: online shopping, online protection, password protection, operating system protection, identity theft protection, and debit/credit card protection.

Building an Information Security Awareness Program

Building an Information Security Awareness Program

Analyzing the role of cognitive and cultural biases in the internalization of information security policies: Recommendations for information security awareness programs

Standards and best practices for information security awareness programs focus on the content and processes of the programs, without taking into consideration how individuals internalize security-related information and how individuals make security related decisions. Relevant literature, however has identified that individual perceptions, beliefs, and biases significantly influence security policy compliance behavior. Security awareness programs need, therefore, to be aligned with the factors affecting the internalization of the communicated security objectives. This paper explores the role of cognitive and cultural biases in shaping information security perceptions and behaviors. We draw upon related literature from contiguous disciplines (namely behavioral economics and health and safety research) to develop a conceptual framework and analyze the role of cognitive and cultural biases in information security behavior. We discuss the implications of biases for security awareness programs and provide a set of recommendations for planning and implementing awareness programs, and for designing the related material. This paper opens new avenues for information security awareness research with regard to security decision making and proposes practical recommendations for planning and delivering security awareness programs, so as to exploit and alleviate the effect of cognitive and cultural biases on shaping risk perceptions and security behavior.

Managing the introduction of information security awareness programmes in organisations

Several studies explore information security awareness focusing on individual and/or organisational aspects. This paper argues that security awareness processes are associated with interrelated changes that occur at the organisational, the technological and the individual level. We introduce an integrated analytical framework that has been developed through action research in a public sector organisation, comprising actor-network theory (ANT), structuration theory and contextualism. We develop and use this framework to analyse and manage changes introduced by the implementation of a security awareness programme in the research setting. The paper illustrates the limitations of each theory (ANT, structuration theory and contextualism) to study multi-level changes when used individually, demonstrates the synergies of the three theories, and proposes how they can be used to study and manage awareness-related changes at the individual, organisational and technological level.

Measuring Information Security Awareness of Indonesian Smartphone Users

One of information security management elements is information security awareness program. Usually, this programs only involve the employees within the organization. Some organizations also consider security awareness for some parties outside the organization like providers, vendors, and contractors. This paper add consumers as variable to be considered in information security awareness program as there are also some threats for organization through them. Information security awareness will be measured from user’s knowledge, behavior, and attitude of five information security focus areas in telecommunication, especially related with smartphone users as one segment of telecommunication provider. For smartphone users, information security threats not only from Internet, but also by phone call or texting. Therefore, focus area in this research consist of adhere to security policy, protect personal data, fraud/spam SMS, mobile application, and report for security incident. This research use analytic hierarcy process (AHP) method to measure the information security awareness level from smartphone users. In total, the result indicated that awareness level is good (80%). Although knowledge and attitude dimension are in good criteria of awareness level, but behaviour dimension is average. It can be a reason why there are still many information security breach against smartphone user despite good awareness level.

Smartphone information security awareness: A victim of operational pressures

Smartphone information security awareness describes the knowledge, attitude and behaviour that employees apply to the security of the organisational information that they access, process and store on their smartphone devices. The surge in the number of smartphone devices connecting to organisational systems and used to process organisational data has enabled a new level of operational efficiency. While employees are aware of the benefits they enjoy by bringing their personal devices into the workplace, managers too are aware of the benefits of having a constantly connected workforce. Unfortunately, those aware of the risks to information security do not share an equal level of enthusiasm. These devices are owned by employees who are not adequately skilled to configure the security settings for acceptable security of that information. Moreover, routine information security awareness programmes, even if applied, gradually fade into the daily rush of operations from the day they are completed.This paper explores the factors which influence these oscillating levels of information security awareness. By applying an adapted version of an awareness model from the domain of accident prevention, the factors which cause diminishing awareness levels are exposed. Subsequently, information security awareness emerges as a symptom of such factors. Through geometrical modelling of the boundaries and pressures that govern our daily operations, an awareness model emerges. This model ensures that organisations are better equipped to monitor their information security awareness position, their boundaries and the daily pressures affecting the organisation, thus allowing them to design better integrated policies and procedures to encourage safe operating limits. The model is evaluated using a theory evaluation framework through an expert review process.

Information Security Awareness at Saudi Arabians’ Organizations

Information security awareness is human and organizational attitudes which can be described as a behavior or an attitude of an organization and/or its members towards protecting the organization’s information assets. The goal of this paper is to understand the state of the information security awareness at some of the Saudi Arabians’ organizations, i.e., governments and privates by investigating the perception of their information technology’s employees. The author believes that understanding the state of information security awareness of IT employees can give a better understanding of the level of awareness at the entire organization. The results of this study show that most of the IT employees at the surveyed organizations have some misconceptions about information security practices. In addition, many responses indicated that many IT employees are not aware of the internal information security threats. Such results required very urgent actions from the top management of these organizations to consider the information security awareness programs within their public relations and training programs.

A Comprehensive Study of Social Engineering Based Attacks in India to Develop a Conceptual Model

The objective of this research is to present and demonstrate an analytical approach towards Social Engineering. A questionnaire was created and a survey was conducted accordingly to determine the understanding of IT practitioners and social networking users based in India. Based on the responses an advanced model of Social Engineering based attacks was developed. This model can be used in development of Organization-wide Information Security policy and Information Security Awareness Program

A case for information security awareness (ISA) programmes to protect global information, innovation and knowledge resources

The global diffusion of new technology, the increasing use of Web 2.0 networking and cloud computing have enable organisations to exchange significant amounts of information and knowledge. The successful transfer of knowledge and innovation has become critical to organisational competitiveness and survival. However, increased connectivity and unrestricted information sharing has rendered global organisations vulnerable to cyber-threats capable of breaching databases and restricted information. As cyber-attacks have become increasingly successful, organisations have invested more into cyber-safeguards to protect intellectual property and strategic data. Often absent in this strategic equation is the dissemination of knowledge to employees regarding the impact of cyber-attacks and how to protect informational resources. Research demonstrates that cyber-attacks are deterred and mitigated by the use of information security awareness (ISA) programmes. This paper discusses key components recommended for a viable ISA programme for global organisations seeking to educate their employees on the due care to protect knowledge resources and intellectual property.

MEASURING THE EFFECTIVENESS OF INFORMATION SECURITY TRAINING: A COMPARATIVE ANALYSIS OF COMPUTER-BASED TRAINING AND INSTRUCTOR-BASED TRAINING

Financial institutions are increasingly finding difficulty defending against information security risks and threats, as they are often the number one target for information thieves. An effective information security training and awareness program can be a critical component of protecting an organization's information assets. Many financial institutions have invested numerous resources in implementing information security training and awareness programs, but few have explored deeper to examine the effectiveness of these training programs. The purpose of this study was to examine the effectiveness of an information security awareness program within a financial services institution in Western Pennsylvania. Effectiveness of information security training program was determined by transfer of learning, knowledge retention, and the level of trainee satisfaction. Additionally, the study was designed to determine whether the implementation of two different modes of training delivery, Instructor-based Training (IBT) and Computer-based Training (CBT) led to different results of effectiveness. The study used a quasi-experimental, quantitative approach to measure and analyze the results, which included administering pre- and post-tests within both IBT and CBT groups. The study found that instructor-based trainees had higher levels of transfer of learning and overall trainee satisfaction when compared to their computer-based counterparts. The results of the study showed that computer-based trainees had a higher level of knowledge retention than the instructor-based trainees within the 60-day post-test period. However, there was no statistically significant difference in knowledge retention between either groups within the 90-day post-test period.

Effectiveness of information security awareness methods based on psychological theories

Effective user security awareness campaign can greatly enhance the information assurance posture of an organization. Information security includes organizational aspects, legal aspects, institutionalization and applications of best practices in addition to security technologies. User awareness represents a significant challenge in the security domain, with the human factor ultimately being the element that is exploited in a variety of attack scenarios. Information security awareness program is a critical component in any organizations strategy. In contrast to other information security awareness work which mostly explains methods and techniques for raising information security awareness; this paper discusses and evaluates the effectiveness of different information security awareness tools and techniques on the basis of psychological theories and models. Finally, it describes how to measure information security awareness in an organization. Key words: Information security, awareness, effectiveness, psychological, management.

The Need for Effective Information Security Awareness

Security awareness is an often-overlooked factor in an information security program. While organizations expand their use of advanced security technology and continuously train their security professionals, very little is used to increase the security awareness among the normal users, making them the weakest link in any organization. As a result, today, organized cyber criminals are putting significant efforts to research and develop advanced hacking methods that can be used to steal money and information from the general public. Furthermore, the high internet penetration growth rate in the Middle East and the limited security awareness among users is making it an attractive target for cyber criminals. In this paper, we will show the need for security awareness programs in schools, universities, governments, and private organizations in the Middle East by presenting results of several security awareness studies conducted among students and professionals in UAE in 2010. This includes a comprehensive wireless security survey in which thousands of access points were detected in Dubai and Sharjah most of which are either unprotected or employ weak types of protection. Another study focuses on evaluating the chances of general users to fall victims to phishing attacks which can be used to steal bank and personal information. Furthermore, a study of the user’s awareness of privacy issues when using RFID technology is presented. Finally, we discuss several key factors that are necessary to develop a successful information security awareness program.

A vocabulary test to assess information security awareness

PurposeThe dependence on human involvement and human behavior to protect information assets necessitates an information security awareness program to make people aware of their roles and responsibilities towards information security. The purpose of this paper is to examine the feasibility of an information security vocabulary test as an aid to assess awareness levels and to assist with the identification of suitable areas or topics to be included in an information security awareness program.Design/methodology/approachA questionnaire has been designed to test and illustrate the feasibility of a vocabulary test. The questionnaire consists of two sections – a first section to perform a vocabulary test and a second one to evaluate respondents' behavior. Two different class groups of students at a university were used as a sample.FindingsThe research findings confirmed that the use of a vocabulary test to assess security awareness levels will be beneficial. A significant relationship between knowledge of concepts (vocabulary) and behavior was observed.Originality/valueThe paper introduces a new approach to evaluate people's information security awareness levels by employing an information security vocabulary test. This new approach can assist management to plan and evaluate interventions and to facilitate best practice in information security. Aspects of cognitive psychology and language were taken into account in this research project, indicating the interaction and influence between apparently different disciplines.

Understanding and transforming organizational security culture

PurposeThe purpose of this paper is to examine the practical issues, techniques and learning points associated with information security awareness and organizational change programmes.Design/methodology/approachThe paper is based on the findings and conclusions of research, observations and projects carried out in large organizations over the last two decades. It highlights failings and critical success factors in contemporary approaches to transform organizational culture. It draws on theory and research from the industrial safety field, and discusses its relevance in the information security field.FindingsThe paper identifies the primary reasons why many contemporary enterprise security awareness programmes are ineffective. It discusses the nature of the problem and solution space, identifying the practical issues and opportunities, and gives recommendations on how future programmes can be improved.Research limitations/implicationsThe paper identifies gaps in current research, including the need to confirm whether or not certain findings about incidents in safety field might be applicable to security incidents. It calls for a new approach to information security management that incorporates theory and techniques drawn from psychology and marketing.Practical implicationsThe paper is intended to educate students and researchers working in the information security field on issues and techniques associated with information security awareness and organizational change programmes. It also provides practical advice for business organizations on how to design and implement such programmes.Originality/valueThe paper takes a fresh approach to the subject, examining the relevance of theory and techniques adapted from other fields and drawing new conclusions about the requirements and approach for effective information security awareness and organizational change programmes.

A cross‐cultural investigation of situational information security awareness programs

PurposeThe aim of this research is to make users aware of the importance surrounding the issue of security and security awareness while at the same time making educators as well as other individuals aware of the differing effects of cultural dimensions into the learning process.Design/methodology/approachAn inter‐cultural study was conducted to investigate if users from the USA and Taiwan exposed to the same situational awareness learning would have different performance in those security awareness outcomes.FindingsThe findings confirm that American users who received the situational learning outperformed those users who received the traditional face‐to‐face instruction. Taiwanese users did not perform significantly differently between these two treatments.Research limitations/implicationsThe study was only focused on two countries and therefore may limit its implications worldwide. But the study does show that global citizens also react differently to security awareness as would be expected due to differing cultures. Certainly, awareness of the risks and safeguards is the first line of defense that can be employed by any individual, but how individuals address these risks can be very dissimilar in different cultures. Therefore, the implications are apparent that the issue of security awareness should be studied from different cultural perspectives.Originality/valueThis paper offers original findings and value into the investigation of whether or not situational security awareness training is culturally‐bounded.

On the Anatomy of Human Hacking

ABSTRACT Human hacking is a nontechnical kind of intrusion that relies heavily on human manipulation. Its impact is continuously giving serious concern in the Information technology arena which has often been undermined due to the ease with which this technique is widely used to infiltrate networks through unsuspecting individuals that are undeniably considered the “weakest link” in the security circle. Security awareness that brings about behavioral change, reduces employees' vulnerability, and protects against threats exploiting employees' vulnerability having a positive impact overall on risks related to information assets. Strategies for developing and implementing a successful information security awareness program are presented in this article, which also provides an introduction to the subject of human hacking while discussing the various counter-measures available to minimize the likelihood of such occurrences and their financial, reputation, psychological, and legal ramifications.

A prototype for assessing information security awareness

Due to the intensified need for improved information security, many organisations have established information security awareness programs to ensure that their employees are informed and aware of security risks, thereby protecting themselves and their profitability. In order for a security awareness program to add value to an organisation and at the same time make a contribution to the field of information security, it is necessary to have a set of methods to study and measure its effect. The objective of this paper is to report on the development of a prototype model for measuring information security awareness in an international mining company. Following a description of the model, a brief discussion of the application results is presented.

Information security awareness: educating your users effectively

This article investigates the evolution of computing, with specific reference to the security issues involved. These issues are then taken further to determine the need for education in the workplace through an information security awareness program. Techniques borrowed from the field of social psychology, which have been largely ignored in current awareness programs, are highlighted in order to show how they could be utilized to improve the effectiveness of the awareness program.