Information Security Knowledge Research Articles

Investigation on information security awareness based on KAB model: the moderating role of age and education level

Purpose This study aims to investigate the moderating role of sociodemographic factors, specifically age and education level, in the knowledge-attitude-behavior (KAB) model concerning information security awareness (ISA) amid growing technological threats. Design/methodology/approach This study uses a survey methodology, collecting data from 400 working individuals in Vietnam, to test the applicability of the KAB model and evaluate the moderating effects of age and education on the model’s established relationships. In addition, the theoretical model and hypotheses were evaluated using the partial least squares structural equation model (PLS-SEM) approach. Findings This research confirms the relationships posited in the KAB model. Notably, it shows that younger employees showcase a more positive attitude and behavior toward information security compared with their older counterparts. In addition, higher education levels strengthen the positive association between information security knowledge and attitude. The findings underscore the imperative for organizations to consider sociodemographic variables when formulating strategies to enhance ISA. Originality/value This study extends the KAB model by exploring the impact of sociodemographic factors, focusing on age and education in ISA. Overcoming the oversight in current literature, particularly in the context of technological threats, the research uses PLS-SEM and targets a specific demographic in Vietnam.

Enhancing Security through Advanced Image Steganography Techniques

The project aims to explore various types of steganography techniques, with a focus on image steganography, where information is concealed within images. This involves decrypting the hidden data to retrieve the message image, a process that can be achieved through different methods. The study delves into image steganography, which involves hiding information such as text, images, or audio files within other image or video files. Specifically, the project concentrates on utilizing steganography to embed an image within another image using spatial domain techniques. By examining this particular method, the project seeks to deepen understanding of how image steganography operates and its potential applications. This research contributes to the field by providing insights into the implementation and effectiveness of steganography techniques, offering valuable knowledge for information security and data protection purposes. Through practical demonstrations and analysis, the project aims to showcase the capabilities and limitations of image steganography, facilitating further research and development in this domain. Ultimately, the project endeavors to enhance comprehension of steganography methods and their significance in safeguarding digital information

Factors Toward Risk Influencing Millennials Willingness to Invest in Peer-to-Peer Lending

The objective of this study is to analyze the factors influencing the risk perception that affects millennials' willingness to invest in P2P lending. To achieve this goal, a conceptual model was developed involving variables such as financial literacy, company reputation, information security awareness, risk perception, and intention to invest. The sample consisted of 220 respondents, and data were collected through a questionnaire. Structural Equation Modeling and SmartPLS Statistical Software were used to examine the data. The study’s results suggest that, while financial literacy does not significantly affect risk perception, firm reputation and information security knowledge do. The findings also demonstrate that risk perception has a major impact on the intention to invest. The implications of this research highlight the importance of reputation and information security in shaping risk perception in the fintech sector. Fintech companies should prioritize building a strong reputation through good service, transparency, and authentic communication, as well as implementing robust cybersecurity measures to protect investor data. Financial practitioners also need to educate investors about risks and emphasize the importance of reputation and information security in decision-making, providing guidance in risk assessment and management aligned with investors' goals and risk tolerance.

Evaluating the Influence of Attitude versus Knowledge and Individual Factor versus Intervention Factor on Information Security Awareness in Local Government

Local government as a public organization that typically collects mass amounts of sensitive data is one of the vulnerable and targeted sectors for information security attacks. The human aspect is the most critical but weak link to information security incidents. Among government organizations, local governments usually have more limited human resources either in number and competencies including information security awareness. This study aims to validate the Information Security Awareness (ISA) model for local government, including confirming the influence of knowledge and attitude on information security behavior, evaluating the stronger predictor between knowledge and attitude toward information security behavior, and analyzing the influence of gender (as an individual factor) and training (as an intervention factor) on the information security behavior. Utilizing the HAIS-Q assessment tool, this study collected responses from 704 employees of 68 departments/units under the government of East Java Province, Indonesia. The results suggest that in the local government context, there is a significant direct relationship between Knowledge of information security and information security Behavior and its indirect relationship via Attitude toward information security behavior. However, Attitude toward information security behavior has a stronger effect on Behavior than Knowledge. This study also suggests significant differences in information security behavior between employees who have trained and those who have not, regardless of gender. The proposed model suggests that to improve Information Security Awareness among employees, local government should focus on improving employees’ Attitudes toward information security behavior, either by improving their Knowledge of Information Security via training or their affective attitude toward information security behavior.

Blockchain-based ontology driven reference framework for security risk management

Security risk management (SRM) is crucial for protecting valuable assets from malicious harm. While blockchain technology has been proposed to mitigate security threats in traditional applications, it is not a perfect solution, and its security threats must be managed. This paper addresses the research problem of having no unified and formal knowledge models to support the SRM of traditional applications using blockchain and the SRM of blockchain-based applications. In accordance with this, we present a blockchain-based reference model (BbRM) and an ontology driven reference framework (OntReF) for the SRM of traditional and blockchain-based applications. The BbRM consolidates security threats of traditional and blockchain-based applications, structured following the SRM domain model and offers guidance for creating the OntReF using the domain model. OntReF is grounded on unified foundational ontology (UFO) and provides semantic interoperability and supporting the dynamic knowledge representation and instantiation of information security knowledge for the SRM. Our evaluation approaches demonstrate that OntReF is practical to use.

Informational inequality: the role of resources and attributes in information security awareness

PurposeThe rapid expansion of internet usage and device connectivity has underscored the importance of understanding the public’s cyber behavior and knowledge. Despite this, there is little research that examines the public’s objective knowledge of secure information security practices. The purpose of this study is to examine how objective cyber awareness is distributed throughout society.Design/methodology/approachThis study draws on a large national survey of adults to examine the relationship between individual factors – such as demographic attributes and socioeconomic resources – and information security awareness. The study estimates several statistical models using weighted logistic regression to model objective information security awareness.FindingsThe results indicate that socioeconomic resources such as income and education have a significant effect on individuals’ information security awareness with richer and more highly educated individuals exhibiting greater awareness of important security practices and tools. Additionally, age and gender represent consistent and clear informational gaps in society as older individuals and females are significantly less knowledgeable about an array of information security practices than younger individuals and males, respectively.Social implicationsThe findings have important implications for our understanding of information security behavior and user vulnerability in an increasingly digital and connected society. Despite the growing importance of cybersecurity for all individuals in nearly all domains of daily life, there is substantial inequality in awareness about secure cyber practices and the tools and techniques used to protect one’s self from attacks. While digital technology will continue to permeate many aspects of daily life – from financial transactions to health services to social interactions – the findings here indicate that some users may be far more exposed and vulnerable to attack than others.Originality/valueThis study contributes to our understanding of general user information security awareness using a large survey and statistical models to generalize about the public’s information security awareness across multiple domains and stimulates future research on public knowledge of information security. The findings indicate that some users may be far more exposed and vulnerable to attack than others. Despite the growing importance of cybersecurity for all individuals in nearly all domains of daily life, there is substantial inequality in awareness about secure cyber practices and the tools and techniques used to protect one’s self from attacks.

Assessing Information Security Culture from an Individual's Viewpoint: A Quantitative Measurement Approach

In the increasingly advanced digital era, information security has become a highly important aspect for organizations across various sectors. Therefore, organizations need to adopt a comprehensive approach to managing information security, which encompasses technological aspects, policies and procedures, as well as information security culture. Information security culture refers to the values, norms, and attitudes related to information security within an organization. This research aims to fill the knowledge gap by developing a quantitative measurement approach that can assess individuals' perspectives on information security culture in Sukowono District. This study is a quantitative research using the dimensions of awareness, knowledge, compliance, and behavior as questionnaire variables. The questionnaire was developed after determining the variables and tested for validity and reliability. The research was conducted in one of the districts in Jember Regency. The results of this study show that the average total score for Awareness is 11.9117647 with an average dimension score of 3.9705882, Knowledge has an average total score of 12 with an average dimension score of 4, Compliance has an average total score of 11.76470588 with an average dimension score of 3.92156863, and Behavior has an average total score of 11.882353 with an average dimension score of 3.960784. The dimensions are ranked from lowest to highest as follows: compliance, behavior, awareness, and knowledge. Therefore, knowledge of information security holds the highest position among the four dimensions, while the compliance dimension holds the lowest position.

Awareness Level of Information Security Managers in Small Enterprises in Poland

The security of information assets largely depends on the real level of knowledge of those managing the information system. Particularly important is the knowledge acquired on an ongoing basis through reading and analysing: new reports published by specialised intelligence services worldwide, thematic portals, industry and scientific publications. Today's rapid pace of development of information, communication systems means that knowledge of digital information security acquired a year or more ago becomes partly outdated. Although there are specific, unchangeable canons of behaviour, proceedings in the processes of information protection - they are only a foundation for building an effective system of protecting intangible resources. Special attention should be paid to the fact that information protection is not an individual activity - it is a process running parallel to all processes operating in enterprises. The global pandemic situation has had an irreversible impact on the perception of information asset security. The situation in which most business entities were forced to work remotely necessitated a new approach to information security among its managers. The relatively stable environment of business entities until the pandemic suddenly forced the use of new techniques and technologies enabling work from private, home networks. Have such conditions changed the attitudes of security managers to the need for continuous education, to expand their knowledge in this area? Did those responsible for the security of intangible assets gain more experience with information security during the pandemic? The aim of this article is to present research on the knowledge and awareness of information security managers conducted before the pandemic in 2018 and 2019 among small businesses in Poland on the real perceptions of those responsible for information security and to compare them with the same research conducted in 2022 after the pandemic.

Evaluating Individual Involvement in Shaping Information Security Culture

In the increasingly advanced digital era, information security has become a crucial aspect for various organizations worldwide. In facing these challenges, organizations rely not only on sophisticated security technologies but also on active participation and involvement of individuals in shaping a strong information security culture. Information security culture encompasses the attitudes, values, and behaviors of individuals when it comes to addressing information security risks. This research aims to evaluate the individual involvement in shaping the information security culture within an organization. The study will involve measuring the level of individual awareness of information security, individual knowledge of information security, compliance with security policies and procedures, as well as individual behaviors in maintaining information security. Data collection will be done using a questionnaire that has been tested for validity and reliability. Awareness has an average total score of 13.20833333 and an average dimension score of 4.40277778. Meanwhile, knowledge has the same value as compliance and behavior, with an average total score of 13.27083333 and an average dimension score of 4.42361111. The results of this research reveal that the research subject has the lowest awareness value compared to other dimensions, while knowledge, compliance, and behavior have the same values. Overall, the research subject exhibits a relatively good information security culture, although it is not perfect.

Knowledge of Information Security Awareness and Practices for Home Users: Case Study in Libya

The abundance of information available through the internet, mobile applications, and cloud computing has made it convenient for users to access a wide range of information. However, this convenience comes at a cost, as this information is constantly at risk of being compromised by cybercriminals and hackers. While the recognition of the potential dangers of information security is increasing in developed countries, in regions like Libya in North Africa, the level of protection for this information is insufficient. The purpose of this study is to examine the various factors that may influence or affect users' practices and awareness at home. The investigated factors are policy, behavior, training, knowledge of IT, and education. To accomplish the goals of this study, a quantitative methodology was implemented. Specifically, a survey was created to assess the correlation between key factors and security awareness and practices in the home environment. The survey attracted 220 respondents and was analyzed using Bivariate/Pearson Correlation to determine the relationship between the independent variable and the dependent variable. The results of the study showed a moderate positive correlation between policy, knowledge of IT, and education with security awareness and practice, but the behavior factor had a low correlation. These results indicate that the security awareness and practice level of employees at home is mostly at a moderate level. It is hoped that the present study provides an initial step in focusing on security training sessions among higher education employees to emphasize the importance of security training and increase knowledge of information security. It is hoped that the findings of this study will serve as a starting point for further research and a focus on providing security information for the public, which will help disseminate new knowledge on the importance of security training and increase awareness of information security.

Updating the Professional Training of Future Mediators – Translators in the Digital Educational Environment with Focus on Information and Lingua Sociocultural Security

This article discusses the actual issues of training mediators–translators in the light of the changes of the political situation in the country and overseas. The mediator–translator should use the digital environment, could possess knowledge of lingua-sociocultural and information security, and smooth out intercultural conflicts in the translation process. The goal of this research is to clarify the types of professional activity of the mediator-translator who functions in the digital environment with the focus on the information and lingua sociocultural security, and to define special skills of future mediators-translators for their development in the process of the university professional training. Methodology and research methods include the analysis and the synthesis of scientific literature on translation’s studies, cultural studies, psychology, linguistics, computer science, mediation and the analysis of Russian Federation government documents on the information security. Results. The main types of professional activity and requirements to the mediator-translator in the digital educational environment with focus on the information and lingua sociocultural security are clarified. The mediator-translator as “homo informaticus”- (human of information) within current changes is a specialist who values his or her sense of identity, permanently improves his or her mother tongue, protecting the Russian language from foreign influence, and critically tracks the information on translation machines within the digital environment. In conclusion the article presents the learning prospects of mediators-translators in Russia. The paper will be useful for teaching and learning foreign languages, intercultural communication, theory and practice on translation, pedagogy.

The importance of theory at the Information Systems Journal

The importance of theory at the <i>Information Systems Journal</i>

Social engineering and the disclosure of personal identifiable information: Examining the relationship and moderating factors using a population-based survey experiment

People tend to disclose personal identifiable information (PII) that could be used by cybercriminals against them. Often, persuasion techniques are used by cybercriminals to trick people to disclose PII. This research investigates whether people can be made less susceptible to persuasion by reciprocation (i.e., making people feel obligated to return a favour) and authority, particularly in regard to whether information security knowledge and positive affect moderate the relation between susceptibility to persuasion and disclosing PII. Data are used from a population-based survey experiment that measured the actual disclosure of PII in an experimental setting ( N = 2426). The results demonstrate a persuasion–disclosure link, indicating that people disclose more PII when persuaded by reciprocation, but not by authority. Knowledge of information security was also found to relate to disclosure. People disclosed less PII when they possessed more knowledge of information security. Positive affect was not related to the disclosure of PII. And contrary to expectations, no moderating effects were found of information security knowledge nor positive affect on the persuasion–disclosure link. Possible explanations are discussed, as well as limitations and future research directions.

Knowledge of Information Security Awareness and Practices for Home Users: Case Study in Libya

The abundance of information available through the Internet, mobile applications, and cloud computing has made it convenient for users to access a wide range of information. However, this convenience comes with a cost as this information is constantly at risk of being compromised by cybercriminals and hackers. While the recognition of the potential dangers of information security is increasing in developed countries, in regions like Libya in North Africa, the level of protection for this information is insufficient. The purpose of this study is to examine the various factors that may influence or affect the users’ practice and awareness at home. The investigated factors are policy, behavior, training, knowledge of IT and education. In order to accomplish the goals of this study, a quantitative methodology was implemented. Specifically, a survey was created to assess the correlation between key factors and security awareness and practices in the home environment. The survey attracted 220 respondents and analyzed using Bivariate/Pearson Correlation to determine the relationship between the independent variable and the dependent variable. The result of the study showed that there was a moderate positive correlation between policy, knowledge of IT and education with security awareness and practice, but behavior factor has a low correlation. These results indicated that security awareness and practice level of employees at home are mostly at the middle level. It is hoped that the present study provides an initial step to focus on security training sessions among higher education employees to reflect new knowledge on the importance of security training to increase the knowledge of information security. It is hoped that the findings of this study will serve as a starting point for further research and focus on providing security information for public, which will help to reflect new knowledge on the importance of security training and increase awareness of information security.

Knowledge of Information Security Awareness and Practices for Home Users: Case Study in Libya

The abundance of information available through the Internet, mobile applications, and cloud computing has made it convenient for users to access a wide range of information. However, this convenience comes with a cost as this information is constantly at risk of being compromised by cybercriminals and hackers. While the recognition of the potential dangers of information security is increasing in developed countries, in regions like Libya in North Africa, the level of protection for this information is insufficient. The purpose of this study is to examine the various factors that may influence or affect the users’ practice and awareness at home. The investigated factors are policy, behavior, training, knowledge of IT and education. In order to accomplish the goals of this study, a quantitative methodology was implemented. Specifically, a survey was created to assess the correlation between key factors and security awareness and practices in the home environment. The survey attracted 220 respondents and analyzed using Bivariate/Pearson Correlation to determine the relationship between the independent variable and the dependent variable. The result of the study showed that there was a moderate positive correlation between policy, knowledge of IT and education with security awareness and practice, but behavior factor has a low correlation. These results indicated that security awareness and practice level of employees at home are mostly at the middle level. It is hoped that the present study provides an initial step to focus on security training sessions among higher education employees to reflect new knowledge on the importance of security training to increase the knowledge of information security. It is hoped that the findings of this study will serve as a starting point for further research and focus on providing security information for public, which will help to reflect new knowledge on the importance of security training and increase awareness of information security.

What are the trend and core knowledge of information security? A citation and co-citation analysis

Information technology brings business success opportunities, but also causes potential safety hazards to organizations. In response to the increasing academia and industry concerns regarding information security (ISec), this study systematically explored extant ISec research and identified eight core knowledge groups, including (1) intrusion detection, (2) privacy protection, (3) secure machine learning, (4) cryptosystem, (5) data service security, (6) malware analysis, (7) security decision-making, and (8) security management. The detection of research hotspots shows that data service security and risk management garner the most current research attention. Furthermore, we establish a comprehensive ISec framework to help systematically understand and achieve ISec.

A Comprehensive Assessment of Human Factors in Cyber Security Compliance toward Enhancing the Security Practice of Healthcare Staff in Paperless Hospitals

Recent reports indicate that over 85% of data breaches are still caused by a human element, of which healthcare is one of the organizations that cyber criminals target. As healthcare IT infrastructure is characterized by a human element, this study comprehensively examined the effect of psycho-socio-cultural and work factors on security behavior in a typical hospital. A quantitative approach was adopted where we collected responses from 212 healthcare staff through an online questionnaire survey. A broad range of constructs was selected from psychological, social, cultural perception, and work factors based on earlier review work. These were related with some security practices to assess the information security (IS) knowledge, attitude and behavior gaps among healthcare staff in a comprehensive way. The study revealed that work emergency (WE) has a positive correlation with IS conscious care behavior (ISCCB) risk. Conscientiousness also had a positive correlation with ISCCB risk, but agreeableness was negatively correlated with information security knowledge (ISK) risk and information security attitude (ISA) risk. Based on these findings, intrinsic and extrinsic motivation methods combined with cutting-edge technologies can be explored to discourage IS risks behaviors while enhancing conscious care security practice.

Formalizing and Integrating User Knowledge into Security Analytics

The Internet-of-Things and ubiquitous cyber-physical systems increase the attack surface for cyber-physical attacks. They exploit technical vulnerabilities and human weaknesses to wreak havoc on organizations’ information systems, physical machines, or even humans. Taking a stand against these multi-dimensional attacks requires automated measures to be combined with people as their knowledge has proven critical for security analytics. However, there is no uniform understanding of information security knowledge and its integration into security analytics activities. With this work, we structure and formalize the crucial notions of knowledge that we deem essential for holistic security analytics. A corresponding knowledge model is established based on the Incident Detection Lifecycle, which summarizes the security analytics activities. This idea of knowledge-based security analytics highlights a dichotomy in security analytics. Security experts can operate security mechanisms and thus contribute their knowledge. However, security novices often cannot operate security mechanisms and, therefore, cannot make their highly-specialized domain knowledge available for security analytics. This results in several severe knowledge gaps. We present a research prototype that shows how several of these knowledge gaps can be overcome by simplifying the interaction with automated security analytics techniques.

Information Security Culture Concept towards Information Security Compliance: A Comparison between IT and Non-IT Professionals

This paper examines the factors determining a positive Information Security Culture (ISC) concept and the influence of ISC towards ISP compliance intention (INT) between IT and non-IT professionals in Malaysian public universities. Partial least square structural equation modelling, using PLS MGA, is used to assess the measurement and structural models, and to compare the results between the two groups. Results indicate all factors have significant contribution towards ISC in both groups, with two out of seven ISC factors have significant differences. This study has revealed that although both groups have the same ISC factors, IT and non-IT professionals have significant difference in terms of believe that Top Management Commitment and Information Security Knowledge are required for implementing apositive ISC. In addition, there is a significant difference between these two groups in terms of the influence of ISC towards ISP compliance intention. ISC has less influence towards INT for Non-IT professionals compared to IT professionals within the same ISC. These empirical findings would benefit in formulating better security strategies by providing appropriate efforts for different groups of employees in the organizations. This study also provides a total cyber security solution for improving information security culture and employees’ compliance towards Information Security Policy.

Assessment of the Impact of Information Security Awareness Training Methods on Knowledge, Attitude, and Behavior

Technology is changing the way we work more than ever before. Therefore, it is critical to understand the security threats associated with these advanced tools to protect systems and data. Security is a combination of people, processes, and technology. Thus, to counter cyber-threats effectively, information security awareness (ISA) programs are an essential cornerstone of enterprise security. There are many ways in which information security knowledge can be delivered. In this paper, we have conducted an experiment to test the impact of multiple intervention strategies on knowledge, attitude, and behavior. The HAIS-Q was used to evaluate the effectiveness of training methods on the employees. Our study suggests that all the methods raised knowledge equivalently. However, having more than one delivery method to convey the same message had more impact on users’ attitudes. When it comes to behavioral change, however, text-based and game-based training formats performed better than their counterparts. Additionally, employees’ tendency in engaging in self-education activities and participating in future awareness programs were influenced by the intervention strategy. These findings have important implications, as ISA programs should be designed in a way that positively influences the mindset of employees and motivates them to embrace security practices in their daily activities.