Information Security Education Research Articles

Az információbiztonság időszerű kérdései a magyarországi kkv-k körében

Összefoglalás. A tanulmány célja az információbiztonság vizsgálata a magyarországi kis- és középvállalkozások (kkv-k) körében. Tanulmányunk aktualitását az adja, hogy az Európai Unió Bizottsága által évente kiadott Digitális Gazdaság és Társadalom Indexe szerint a magyarországi kkv-kat alacsony adat- és információbiztonsági szint jellemzi. Kutatásunk során egyaránt alkalmaztunk kvalitatív és kvantitatív módszereket. Az előbbinél dokumentumelemzéssel megvizsgáltuk, hogy a hazai szakirodalom milyen fontosabb információbiztonsági kihívásokat azonosít, illetve interjúk segítségével feltérképeztük a kkv-k információbiztonsági gyakorlatait és kihívásait, az utóbbinál pedig egy online, nagymintás kérdőív révén vizsgáltuk a szektor vezetőinek információbiztonsággal kapcsolatos véleményét, fejlettségét. Summary. The aim of the study is to examine information security among small and medium-sized enterprises (SMEs) in Hungary. The relevance of our study is that, according to the Digital Economy and Society Index published annually by the Commission of the European Union, Hungarian SMEs are characterised by a low level of data and information security. In our research, we used both qualitative and quantitative methods. In the former, we conducted a document analysis to identify the main information security challenges identified in the domestic literature and mapped the information security practices and challenges of SMEs through interviews, while in the latter, we used an online, large-scale questionnaire to investigate the views and development of the sector’s managers on information security. The findings of our study are based on the responses of 150 SME managers and 31 IT professionals working in the sector. We divided our questionnaire into six sections: demographics, business profile, device usage, digital habits, information security awareness survey based on the international HAIS-Q, information security awareness in daily practice. In the present research we deviated somewhat from the international model, firstly because we had to adapt the model to the domestic requirements and our research objectives, and secondly because this model was only a part of our questionnaire. During the research we have clearly identified the need to develop and implement practice-oriented training programmes that can help managers and IT professionals in the domestic SME sector to develop their information security awareness and even to make the transition to Industry 4.0. Based on the responses to the interview questions, it can be concluded that, overall, SME managers and their organisations are increasingly starting to build cybersecurity solutions and information security measures around their organisation. There is still a need to develop and share information security good practices that can reach SMEs, as there is a need for training and exchange of experiences, but not all companies are fully committed to the issue, so the actual need for action and organisation is ultimately lagging behind. A small proportion of the organisations surveyed have been victims of a cybersecurity incident and a good proportion of SME managers believe that until an incident has happened to an employee or the organisation, they will not learn from it. Basically, there is a growing demand for increased security and the use of security tools and education in information security, but this is evolving as a slow process and not as fast as the world around us is changing, so it is questionable when an information security explosion will occur that may radically change the tools and attitudes of organisations.

АНАЛІЗ СВІТОВОГО ДОСВІДУ ФОРМУВАННЯ СИСТЕМИ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ В КОНТЕКСТІ ПУБЛІЧНОГО УПРАВЛІННЯ

The article is devoted to the issues of ensuring the functions of public information security management in the context of modern challenges. Informatization processes have covered all spheres of human life, which has led to the emergence of new threats. In today’s world, where electronic technologies are becoming a necessity to ensure the effectiveness of public administration functions, the issue of information security is a key and urgent one. The problems of information security are currently being actualized by a significant increase in the role of accumulation, processing and dissemination of information, in particular, in making strategic, military, political and economic decisions. In this regard, the question of how well the modern public administration system is able to respond to the challenges posed by global digitalization is becoming relevant. The purpose of the paper is to study the peculiarities of ensuring information security in public administration, to analyze current threats and the experience of other countries in overcoming them. In analyzing certain aspects of information security, the paper uses methods of description and classification, as well as methods of studying causal relationships, in particular, the combination of similarities and differences. The article examines the trends in the development of public information security management as a key mechanism for ensuring the security of the State. The author identifies the issue of information security as an element of the State defense policy, which is of particular relevance in the context of full-scale military aggression. The concept of public management of information security can be defined as the process of managing measures aimed at protecting confidential information from unauthorized access, use, disclosure and destruction at the level of the State, organizations or citizens. This process may include the creation of appropriate legislation, the establishment of appropriate control and supervisory bodies, the conduct of information security education and training, and the installation of appropriate security technologies and systems to protect confidential information. The place and role of the system of regulation of information support of management processes at the state level are clarified. Sufficient attention is paid to the peculiarities of ensuring information security in public administration through the analysis of modern information threats. Considering the world experience, the author identifies the key success factors and the problems faced by public administration in overcoming them. We consider it expedient to create national analysis and response centers that will monitor, analyze and respond promptly to cyber threats and improve cybersecurity measures for critical facilities.

A survey on college students’ cybersecurity awareness and education from the perspective of China

As people increasingly rely on information and communication technology (ICT), a variety of cyber security issues are emerging, making improving cyber security awareness (CSA) an important topic. This quantitative study focuses on a group of college students from eight local public universities in China (n=1710) and aims to investigate their CSA and education levels using a 32-question questionnaire. Descriptive statistics and cross analysis were used to analyze the current situation related to cybersecurity in college. The results showed that nearly 50% of students spend more than four hours online, with female students spending more online time than males. Smartphones are currently the most popular devices, and spam is the most common issue they encounter. Descriptive statistics, independent samples t-test, and One-way ANOVA test were used to analyze the levels of CSA and education. For CSA, all students are still weak in their password practices. Male students have higher CSA levels in usage habit related to device and HTTP use, but female students perform better in social media. Majors do not make a significant difference in CSA, and freshmen perform better than juniors in device and HTTP application. Regarding cybersecurity education, almost all students believe that colleges need to strengthen information security education. Male students are more familiar with cybersecurity laws, and there are differences in the education methods chosen by students in different majors. Students majoring in computer-related fields prefer more specialized knowledge. This study not only provides valuable insights into the prevailing state of CSA among college students but also offers effective recommendations for enhancing cybersecurity education practices in colleges. The findings underscore the importance of addressing weaknesses in password practices and emphasize the need for comprehensive educational approaches that encompass various facets of cybersecurity. Institutions should consider tailoring their instructional strategies to meet the unique needs of students from diverse academic disciplines. Moreover, fostering awareness of cybersecurity laws and regulations is crucial for all students, regardless of their major.

Demographic Comparison of Information Security Behavior Toward Health Information System Protection: Survey Study.

The health information system (HIS) functions are getting wider with more diverse users. Information security in the health industry is crucial because it involves comprehensive and strategic information that might harm human life. The human factor is one of the biggest security threats to HIS. This study aims to investigate the information security behavior (ISB) of HIS users using a comprehensive assessment scale suited to the information security concerns in health care. Patients are increasingly being asked to submit their own data into HIS systems. As a result, this study examines the security behavior of health workers and patients, as well as their demographic variables. We used a quantitative approach using surveys of health workers and patients. We created a research instrument from 4 existing measurement scales to measure prosecurity and antisecurity behavior. We analyzed statistical differences to test the hypotheses, that is, the Kruskal-Wallis test and the Mann-Whitney test. The descriptive analysis was used to determine whether the group exhibited exemplary behavior when processing the survey results. A correlational test using the Spearman correlation coefficient was performed to establish the significance of the relationship between ISB and age as well as level of education. We analyzed 421 responses from the survey. According to demographic factors, the hypotheses tested for full and partial security behavior reveal substantial differences. Education levels most significantly affect security behavior differences, followed by user type, gender, and age. The health workers' ISB is higher than that of the patients. Women are more likely than men to engage in prosecurity actions while avoiding antisecurity behaviors. The older the HIS user, the more likely it is that they will participate in prosecurity behavior and the less probable it is that they will engage in antisecurity behavior. According to this study, differences in prosecurity behavior are mostly impacted by education level. Higher education, on the other hand, does not guarantee improved ISB for HIS users. All demographic characteristics, particularly concerning user type, show discrepancies that are caused mainly by antisecurity behavior rather than prosecurity behavior. Since patients engage in antisecurity behavior more frequently than health workers and may pose security risks, health care facilities should start to consider information security education for patients. More comprehensive research on ISB in health care facilities is required to better understand the patient's perspective, which is currently understudied.

Nurse Information Security Policy Compliance, Information Competence, and Information Security Attitudes Predict Information Security Behavior.

Nurses' attitudes toward information security can influence the hospital's information resources management and development. This study investigated the relationships between nurses' information security policy compliance, information competence, and information security attitudes, which are factors that influence information security behavior. Data were collected during September 2020. The participants were 200 clinical nurses from a general hospital in Korea. The self-reported questionnaire included questions on nurses' general characteristics, information security policy compliance, information competence, and information security attitudes. Information security policy compliance (r = 0.554, P < .001) and information competence (r = 0.614, P < .001) were positively associated with information security attitudes. Predictors of nurses' information security attitudes were information competence (β = .439), information security policy compliance (β = .343), prior information security-related education (β = .113), and job position (nurse manager; β = .101). Implications for practice include the need for strategies to develop information security policy compliance and information competence to improve information security behavior, including different approaches tailored to nurses' job positions and previous information security education.

Exploring the role of gamified information security education systems on information security awareness and protection behavioral intention

Exploring the role of gamified information security education systems on information security awareness and protection behavioral intention

The effects of knowledge mechanisms on employees' information security threat construal

AbstractOrganisations implement a variety of knowledge mechanisms such as information security education, training and awareness (SETA) programs and information security policies, to influence employees' secure behaviour. Despite increased efforts to provide information systems (IS) security knowledge to employees, data breaches and other security incidents resulting from insider behaviour continue. Recent IS security research, primarily grounded on assumptions of employees' rational assessment of numerous factors, has yielded inconsistent results. Challenging this paradigm, we model secure behaviour on security knowledge mechanisms, which focuses on the multidimensional nature of security knowledge breadth, depth and finesse to represent the full array of managerial levers. We further draw on construal level theory to conceptualise users' perceptual judgements of security messages. Two studies support our model, with the second building on the first. Study 1, an experiment with 312 participants, focused on validating the treatments. Study 2, a survey with 219 participants, validated the entire model. Results showed that our model has significantly more explanatory and predictive power than the orthodox paradigm. Our results have practical implications for optimising the organisation of knowledge mechanisms by emphasising the personal relevance of threats and defining the factors that lead to secure behaviour. We also contribute to the discourse on information security research and provide a template for integrating theories, thus opening new avenues for future research.

How Information Security Management Systems Influence the Healthcare Professionals’ Security Behavior in a Public Hospital in Indonesia

Aim/Purpose: This study analyzes health professionals’ information security behavior (ISB) as health information system (HIS) users concerning associated information security controls and risks established in a public hospital. This work measures ISB using a complete measuring scale and explains the relevant influential factors from the perspectives of Protection Motivation Theory (PMT) and General Deterrence Theory (GDT) Background: Internal users are the primary source of security concerns in hospitals, with malware and social engineering becoming common attack vectors in the health industry. This study focuses on HIS user behavior in developing countries with limited information security policies and resources. Methodology: The research was carried out in three stages. First, a semi-structured interview was conducted with three hospital administrators in charge of HIS implementation to investigate information security controls and threats. Second, a survey of 144 HIS users to determine ISB based on hospital security risk. Third, a semi-structured interview was conducted with 11 HIS users to discuss the elements influencing behavior and current information security implementation. Contribution: This study contributes to ISB practices in hospitals. It discusses how HIS managers could build information security programs to enhance health professionals’ behavior by considering PMT and GDT elements. Findings: According to the findings of this study, the hospital has implemented particular information security management system (ISMS) controls based on international standards, but there is still room for improvement. Insiders are the most prevalent information security dangers discovered, with certain working practices requiring HIS users to disclose passwords with others. The top three most common ISBs HIS users practice include appropriately disposing of printouts, validating link sources, and using a password to unlock the device. Meanwhile, the top three least commonly seen ISBs include transferring sensitive information online, leaving a password in an unsupervised area, and revealing sensitive information via social media. Recommendations for Practitioners: Hospital managers should create work practices that align with information security requirements. HIS managers should provide incentives to improve workers’ perceptions of the benefit of robust information security measures. Recommendation for Researchers: This study suggests more research into the components that influence ISB utilizing diverse theoretical foundations such as Regulatory Focus Theory to compare preventive and promotion motivation to enhance ISB. Impact on Society: This study can potentially improve information security in the healthcare industry, which has substantial risks to human life but still lags behind other vital sector implementations. Future Research: Future research could look into the best content and format for an information security education and training program to promote the behaviors of healthcare professionals that need to be improved based on this ISB measurement and other influential factors.

Proposal of Rubric for Information Security Education Materials

Proposal of Rubric for Information Security Education Materials

Assessing the Effects of Gamification on Enhancing Information Security Awareness Knowledge

Information security awareness (ISA) has become a vital issue, as security breaches often attributed to humans lead to losses for individuals and organizations. Information security (IS) education may be an effective strategy to improve students’ ISA; however, studies associated with the relationships between teaching effects and information security learning are few. This study adopted gamification practice and examined its effect on students’ ISA knowledge enhancement, attitude and intention of security compliance, and willingness for continuous IS education. This study also examined the gender difference in a gamified learning system. One hundred ten undergraduates participated in a quasi-experimental study. The results indicated that students within a gamified class performed better than students within a lecture-based instructional group. We found significant gamification effects on the three security focus areas of password management, Internet use, and information handling. Gamification did not significantly impact the attitude and intention of participants’ security compliance and students’ willingness for continuous IS learning. Gender difference in the effect of gamification on ISA knowledge enhancement was not observed as well. The research provides theoretical and practical contributions by incorporating gamification into IS learning and suggests gamification as an effective means to enhance students’ knowledge acquisition in an engaging, timely, economical, and repeated manner.

Information security education based on job profiles and the e-CF

PurposeThe information security field requires standardised education. This could be based on generic job profiles and a standard competence framework. The question is whether this is possible and feasible. To find out, the author did a case study: developing an information security master curriculum based on a generic PVIB job profile and the underlying competence framework e-CF.Design/methodology/approachThe research is a case study, using Design Science. Starting point is the specification of the learning goals for a cybersecurity master curriculum, using a generic PvIB job profile and the underlying competence framework e-CF. The curriculum has subsequently been developed, using backward design. Thereafter, the curriculum has been submitted for accreditation to test the successfulness of the approach.FindingsA generic job profile and a competence framework such as the e-CF support the development of standardised education. The generic PVIB job profile used works well. The e-CF can be useful, but requires modifications and the introduction of sub-competences. However, the main complaint concerning the e-CF is the use of examples instead of mandatory content.Originality/valueCompetence frameworks are available to formulate job descriptions, and are also suited for developing standardised education. Little research has been done on this. This case study shows that a competence framework is a useful tool for developing standardised education, although the e-CF may not be the most appropriate.

Exploring potential gender differences in information security and privacy

Purpose Information technology users often fail to adopt necessary security and privacy measures, leading to increased risk of cybercrimes. There has been limited research on how demographic differences influence information security behaviour and understanding this could be important in identifying users who may be more likely to have poor information security behaviour. This study aims to investigate whether there are any gender differences in security and privacy behaviours and perceptions, to identify potential differences that may have implications for protecting users’ privacy and securing their devices, software and data. Design/methodology/approach This paper addresses this research gap by investigating security behaviours and perceptions in the following two studies: one focussing on information security and one on information privacy. Data was collected in both studies using anonymous online surveys. Findings This study finds significant differences between men and women in over 40% of the security and privacy behaviours considered, suggesting that overall levels of both are significantly lower for women than for men, with behaviours that require more technical skill being adopted less by female users. Furthermore, individual perceptions exhibited some gender differences. Originality/value This research suggests that potential gender differences in some security and privacy behaviours and perceptions should be taken into account when designing information security education, training and awareness initiatives for both organisations and the broader community. This study also provides a strong foundation to explore information security individual differences more deeply.

НАЦІОНАЛЬНІ СТРАТЕГІЇ КІБЕРБЕЗПЕКИ: ПОРІВНЯЛЬНИЙ АНАЛІЗ

In this paper were compared and analyzed 14 National cybersecurity strategies (NCSS). Comparing this NCSS, major differences in approaches stemming from the differences in starting points are found: economics, national security, or military defence. Many of the NCSS are unclear about the relationship of the NCSS with existing national and international policies such as about CIP, the European Digital Agenda, and a national security policy. Only six countries have defined the notion cyber security. The other eight countries either use descriptive text in their NCSS or a kind of common public understanding. As there is lack a harmonized cyber terminology, they might be hampered in collaboratively addressing the global threats to cyber space. Moreover, countries have a different understanding of the scope of what cyber security is supposed to cover: internet connected systems only or the whole of ICT. All countries pointed in their NCSS the international threats and the risk of cyberspace. Nevertheless, the NCSS are relatively weak when describing detailed action plans under the topic “international collaboration”. International topics such as harmonization activities across international borders, collaborative acceleration of international response to cyber crime and other disturbances do not seem to be on the priority lists of the governments. Most NCSS lack a dynamic approach to cyberspace (technological) threats and challenges; only the UK mentioned electromagnetic spectrum threats to cyberspace. Emerging cyber security threats are only explicitly addressed by Germany and Japan in their NCSS, where the innovation cycle of ICT is high causing a fast appearance of new security risk. When it comes to tactical and operational plans, only two countries use some of the SMARTness criteria. Interestingly, Uganda uses a system of metrics for the current state, the midway milestone, and the end result. Whether a strategy is a success or not, and whether the action plan is on the right track, cannot be measured when SMART criteria lack. Nations could implement a dashboard, including metrics related to dependence/relevance and to changing threats. Most NCSS recognize the need for a society-wide approach: citizens, businesses, the public sector, and the government. However, the set of actions aimed at citizens is most often limited to awareness campaigns and information security education at schools. Only Australia has an outreach programme which supports the citizens with national cyber security tools. This also shows that most countries underrate the risk of loss of public confidence in ICT which may seriously hamper economic prosperity and e-government plans.

CyExec*: A High-Performance Container-Based Cyber Range With Scenario Randomization

With increasing threats to information security, information security education through practical exercises specifically cyber range has attracted attention. However, the use of a cyber range is not widespread because of the high initial and maintenance cost and difficulty of developing new scenarios. Because many virtual instances are executed in the cyber range, the advantage of container type virtualization, which can provide a lightweight execution environment, is expected to increase efficient hardware utilization and decrease the total cost. On the other hand, containers pose challenges in scalability and scenario development when it comes to their use in cyber ranges because their performance advantages and vulnerability reproducibility have not been reported. In this paper, we conducted an exhaustive experiment to compare the performance and reproducibility of container-type virtualization with other virtualization types. The results show that containers can provide a more efficient execution environment than the other types, with almost perfect vulnerability reproducibility of more than 99% while reducing memory consumption by half and storage consumption to 1/60. The container's high performance and reproducibility enabled us to develop CyExec*, a cyber range system with DAG-based scenario randomization technology. CyExec* can increase educational effectiveness by automatically generating multiple scenarios with the same learning objective. Compared with a random scenario generator for CTF using another virtualization type, CyExec* shows more than three times higher performance. CyExec* can solve existing cyber range issues.

Comparing the Effects of Two Methods of Education (Online versus Offline) and Gender on Information Security Behaviors

The importance of information security is increasing, and various efforts are being made to improve users’ information security behaviors. Among these various efforts, information security education is mainly aimed at providing users with information security knowledge and improving information security awareness. This study classified the types of information security education into offline and online to examine the effects of each education method on attitudes toward information security (perceived severity, vulnerability, self-efficacy and response-efficacy) and information security behaviors. A survey was conducted for users with information security education experiences. The results obtained by comparing the differences in the path coefficients of personal information security behaviors according to information security education experiences showed that security behaviors were more significant in the online experience group than the offline group. In addition, gender differences were analyzed, and it was found that females had a greater impact on information security attitudes than males. This study also found that among Internet users with online information security education experience, females tend to have more information security behavior than males, but there were contrasting results among users with offline information security education experiences. The results of this study finally address the necessity of reflecting users’ personalities in the systematic design of information security education in the future. Furthermore, the results of this study support the need for an appropriate education system that sufficiently understands education types to maximize the effects of information security education.

라이프 케어 증진을 위한 의료정보보안 교육 효과 메타 분석

본 연구는 국내 의료기관에서 시행된 의료정보보안 교육 효과를 확인하고 향후 이에 관한 교육프로그램 개발에 기초 자료를 제공하고자 시도되었다. 2010년 1월부터 2019년 7월까지 국내에서 발표된 논문을 체계적으로 고찰하여 총 4편을 최종 연구대상으로 선정 하였다. 선정된 4편의 논문을 메타 분석하여 효과크기를 확인한 결과, 의료정보보안 교육과 실천 간 상관관계에는 큰 효과크기가 있었다.BR 2010년 발행된 논문부터 대상으로 하여 의료정보보안 교육 효과 결과를 의료정보보안 실천만으로 제한했다는 한계점이 있지만 국내 의료정보보안 교육효과를 확인한 점에서 의의가 있다. 본 연구 결과를 바탕으로 의료정보 유출을 예방할 수 있는 의료정보보안 교육 프로그램 개발에 기초자료로 사용될 수 있을 것이다.

Scenario-based cyber attack·defense education system on virtual machines integrated by web technologies for protection of multimedia contents in a network

Security issues have been raised with the tremendous growth of social multimedia content evolving content distribution and social interaction. To protect the social multimedia contents in a network, information security education has been actively studied, and various educational systems are being provided. Even when trainees have completed the training that they can practice, such as DDoS(Distributed Denial of Services) response and database outbreak attack, most of the education methods are based on the theory or advance notification method designed as part of the scenario beforehand and it is difficult to apply these to actual situations. In addition, building new systems and learning to use them for each scenario lowers the training effectiveness. In this paper, we investigate various cases of cyber incident in the content distribution networks. Based on research, we develop Meltdown, Mirai malware, Carbanak APT(Advanced Persistent Threats), and Ransomware scenarios that assume a real multimedia contents distribution situation. We also build and store individual virtual environments for each scenario, integrating them into VMWare ESXI, so that attack and defense practices can be conducted similar to real world networks. The deployed environment is integrated with the Web through the VM API(Virtual Machine Application Programming Interfaces). When the trainee finishes the training, one utilizes the snapshot function of the virtual machine to return the virtual environment to the pre-training state. Trainees do not need to build a virtual environment for each scenario, but they are able to conduct training in an environment similar to a real network by calling a virtual environment with a simple operation from a web browser. Therefore, it is expected that the convenience of trainees and the efficiency of the education will be increased.

Problems and challenges faced by network information security education

Problems and challenges faced by network information security education

An Implication for Information Security Education and Current Problems in University

An Implication for Information Security Education and Current Problems in University

Key Success Factors of Information Systems Security

The issue of information systems security, and thus information as key resource in today's information society, is something that all organizations in all sectors face in one way or another. To ensure that information remain secure, many organizations have implemented a continuous, structured and systematic security approach to manage and protect an organization's information from undermining individuals by establishing security policies, processes, procedures, and information security organizational structures. However, despite this, security threats, incidents, vulnerabilities and risks are still raging in many organizations. One of the main causes of this problem is poor understanding of information systems security key success factors. Identifying and understanding of information security key success factors can help organizations to manage how to focus limited resources on those elements that really impact on success, therefore saving time and money and creating added value and further enabling operational business. This research, based on comprehensive literature review, summarizes most cited key success factors of information systems security identified in scientific articles indexed in relevant databases, of which the top three success factors were management support, information security policy and information security education, training and awareness. At the end, article states identified research gaps and provides readers with possible directions for further researches