Information Security Practices Research Articles

Az információbiztonság időszerű kérdései a magyarországi kkv-k körében

Összefoglalás. A tanulmány célja az információbiztonság vizsgálata a magyarországi kis- és középvállalkozások (kkv-k) körében. Tanulmányunk aktualitását az adja, hogy az Európai Unió Bizottsága által évente kiadott Digitális Gazdaság és Társadalom Indexe szerint a magyarországi kkv-kat alacsony adat- és információbiztonsági szint jellemzi. Kutatásunk során egyaránt alkalmaztunk kvalitatív és kvantitatív módszereket. Az előbbinél dokumentumelemzéssel megvizsgáltuk, hogy a hazai szakirodalom milyen fontosabb információbiztonsági kihívásokat azonosít, illetve interjúk segítségével feltérképeztük a kkv-k információbiztonsági gyakorlatait és kihívásait, az utóbbinál pedig egy online, nagymintás kérdőív révén vizsgáltuk a szektor vezetőinek információbiztonsággal kapcsolatos véleményét, fejlettségét. Summary. The aim of the study is to examine information security among small and medium-sized enterprises (SMEs) in Hungary. The relevance of our study is that, according to the Digital Economy and Society Index published annually by the Commission of the European Union, Hungarian SMEs are characterised by a low level of data and information security. In our research, we used both qualitative and quantitative methods. In the former, we conducted a document analysis to identify the main information security challenges identified in the domestic literature and mapped the information security practices and challenges of SMEs through interviews, while in the latter, we used an online, large-scale questionnaire to investigate the views and development of the sector’s managers on information security. The findings of our study are based on the responses of 150 SME managers and 31 IT professionals working in the sector. We divided our questionnaire into six sections: demographics, business profile, device usage, digital habits, information security awareness survey based on the international HAIS-Q, information security awareness in daily practice. In the present research we deviated somewhat from the international model, firstly because we had to adapt the model to the domestic requirements and our research objectives, and secondly because this model was only a part of our questionnaire. During the research we have clearly identified the need to develop and implement practice-oriented training programmes that can help managers and IT professionals in the domestic SME sector to develop their information security awareness and even to make the transition to Industry 4.0. Based on the responses to the interview questions, it can be concluded that, overall, SME managers and their organisations are increasingly starting to build cybersecurity solutions and information security measures around their organisation. There is still a need to develop and share information security good practices that can reach SMEs, as there is a need for training and exchange of experiences, but not all companies are fully committed to the issue, so the actual need for action and organisation is ultimately lagging behind. A small proportion of the organisations surveyed have been victims of a cybersecurity incident and a good proportion of SME managers believe that until an incident has happened to an employee or the organisation, they will not learn from it. Basically, there is a growing demand for increased security and the use of security tools and education in information security, but this is evolving as a slow process and not as fast as the world around us is changing, so it is questionable when an information security explosion will occur that may radically change the tools and attitudes of organisations.

Human factors in remote work: examining cyber hygiene practices

Purpose The purpose of this paper is to investigate the cyber hygiene practices of remote workers. Design/methodology/approach This paper used two instruments: first, the Cyber Hygiene Inventory scale, which measures users’ information and computer security behaviors; second, the Recsem Inventory, developed within this paper’s context, to evaluate the cybersecurity measures adopted by organizations for remote workers. It was conducted on remote workers to examine their information security practices. The instrument was administered to a sample of 442 employees reached via the LinkedIn platform. Analyses were performed with SPSS v26, Python programming language and Seaborn library. Findings The findings indicate a significant correlation between the security measures implemented by companies and their employees’ cyber hygiene practices. A sector comparison revealed a significant difference in cyber hygiene levels between public and private sector workers. Research limitations/implications This paper aims to provide policymakers with suggestions for enhancing the cyber hygiene of remote workers to facilitate compliance with corporate security protocols. Originality/value This paper’s conclusions highlight the importance of companies increasing their cybersecurity investments as remote work becomes more prevalent. This should consider not only corporate-level factors but also employees' information and computer security behaviors.

Applied Machine Learning for Information Security

Information security has undoubtedly become a critical aspect of modern cybersecurity practices. Over the past half-decade, numerous academic and industry groups have sought to develop machine learning, deep learning, and other areas of artificial intelligence-enabled analytics into information security practices. The Conference on Applied Machine Learning (CAMLIS) is an emerging venue that seeks to gather researchers and practitioners to discuss applied and fundamental research on machine learning for information security applications. In 2021, CAMLIS partnered with ACM Digital Threats: Research and Practice (DTRAP) to provide opportunities for authors of accepted CAMLIS papers to submit their research for consideration into ACM DTRAP via a Special Issue on Applied Machine Learning for Information Security. This editorial summarizes the results of this Special Issue.

Business Process Outsourcing 14 Cybersecurity KPIs Towards a Strategic Information Security

In today’s rapidly evolving digital landscape, the Business Process Outsourcing (BPO) industry faces an ever-increasing threat of cyber-attacks and data breaches, underscoring the critical importance of robust information security practices. To address these challenges, organizations must develop effective strategic information security, supported by reliable performance measurement tools such as Key Performance Indicators (KPIs). This research aims to investigate the information security implemented by BPO companies and their utilization of the 14 cybersecurity KPIs to track and enhance their information security measures. A mixed-methods strategy is used in the study, integrating qualitative and quantitative techniques. The qualitative component involves thematic analysis of key informant interviews, while the quantitative component entails the analysis of Likert-scale questionnaires and numerical data. The findings of this research provide valuable insights into the significance of strategic information security in achieving effective information security management within the BPO industry. The study reveals the specific elements incorporated in these plans, such as risk assessment methodologies, security controls implementation, employee training, incident response strategies, and compliance measures. The implications of this study offer valuable insights for BPO organizations to develop robust strategic information security tailored to their specific context, ensuring effective alignment with organizational objectives and risk management strategies. Moreover, the research contributes to the existing literature on information security management frameworks, emphasizing the role of cybersecurity KPIs in evaluating security performance. Keywords: cybersecurity, information security, KPI, business process outsourcing industry, information security management

Analisis Tingkat Kematangan Keamanan Informasi Menggunakan Indeks KAMI pada Tiyuh Pulung Kencana

Everyone must adapt quickly if they don't want to be left behind due to very rapid and significant technological developments. All institutions in Indonesia must also apply information technology to expedite and make their activities more effective and fulfill their duties and functions in implementing work programs. For this reason, the role of information security is very important to maintain the confidentiality, integrity and availability of information for the public and service interests. Based on the conditions described above, it is important to carry out a SID (Village Information System) assessment to determine the maturity and completeness of data security. Tiyuh Pulung Kencana Village in Tulang Bawang Tengah District, West Tulang Bawang Regency is the object of this research. This village or Tiyuh is one of the villages that has implemented SID effectively in the implementation of the Lampung Province Smart Village Program. The Information Security Index (KAMI) is used in Tiyuh Pulung Kencana, Tulang Bawang Tengah District, West Tulang Bawang Regency, to assess the completeness and maturity of the information security system. Document analysis and interviews with related parties are the qualitative methods used. The results of the KAMI index research show that Tiyuh Pulung Kencana relies heavily on electronic systems, but steps to protect information are still just starting (only in the initial stages). Therefore, Tiyuh Pulung Kencana must improve its information security practices by creating policies and procedures that comply with IT/IS standards and resource readiness.

Information security for criminological ethnographers

Information security refers to ‘the practice of defending information from unauthorised access’. Information security practices include everyday activities such as protecting your bank details, or keeping your workplace logins secure. Despite increasingly restrictive approaches to research ethics, academia continues to lag behind journalism when it comes to best practice with regards to information security. This article discusses information security as it pertains to qualitative and especially ethnographic research into crime and deviance. In doing so, the article addresses a gap in the methodological literature by drawing on lessons and real-world examples from journalism, academia and activism, in order to offer guidance for researchers seeking to maintain information security in a digital, networked social world. The article proceeds in three parts. First, the article considers what information researchers might want to protect, who they might want to protect it from and what the consequences might be if they failed to do so (an exercise known as ‘threat modelling’). The different powers, resources and capacities of, and threats posed by, state actors such as the police and intelligence agencies, as well as an array of non-state actors, are considered. Second, the article outlines some general principles of information security and how they might apply to ethnographic research into crime and deviance. Third, the article discusses a range of practical considerations when it comes to using mobile phones (cell phones), social media, passwords and encryption in the course of researching crime and deviance.

Exploring the influence of government social media on cybersecurity compliance: employee attitudes, motivation and behaviors

PurposeThis study aims to investigate the impact of employees’ engagement in government social media (GSM) on their cybersecurity compliance attitude, protection motivation and protective behavior, thereby contributing to effective cybersecurity practices at organizations.Design/methodology/approachA quantitative cross-sectional field survey was conducted to collect primary data in big cities and large provinces in Vietnam. The final data set of 323 responses was analyzed using the partial least squares-structural equation modeling approach to interpret the results and test research hypotheses.FindingsEngagement in GSM positively influences employees’ cybersecurity compliance attitude (ATT). Perceived threat vulnerability and response efficacy also contribute to a positive compliance attitude, although self-efficacy has a negative impact. Moreover, the cybersecurity compliance ATT significantly explains the information protection motivation, which in turn influences employee protective behaviors. However, the relationship between compliance attitude and protective behaviors is weak, unlike previous studies that found a strong correlation.Originality/valueAlthough recent studies have explored specific information security practices in corporate and home contexts, the influence of GSM on individuals’ cybersecurity behaviors has received limited attention because of its novelty. This study contributes to the existing body of knowledge by investigating the impact of GSM on cybersecurity behaviors. This study provides significant contributions to understanding social media’s effects of social media on individuals’ cultivation processes, by expanding upon the protective motivation theory and cultivation theory. The results lead to practical suggestions for organizational managers and policymakers so that they can enhance their understanding of the importance of cybersecurity, encourage the implementation of self-defense strategies and highlight the significance of threat and coping evaluations in influencing attitudes and motivations.

Informational inequality: the role of resources and attributes in information security awareness

PurposeThe rapid expansion of internet usage and device connectivity has underscored the importance of understanding the public’s cyber behavior and knowledge. Despite this, there is little research that examines the public’s objective knowledge of secure information security practices. The purpose of this study is to examine how objective cyber awareness is distributed throughout society.Design/methodology/approachThis study draws on a large national survey of adults to examine the relationship between individual factors – such as demographic attributes and socioeconomic resources – and information security awareness. The study estimates several statistical models using weighted logistic regression to model objective information security awareness.FindingsThe results indicate that socioeconomic resources such as income and education have a significant effect on individuals’ information security awareness with richer and more highly educated individuals exhibiting greater awareness of important security practices and tools. Additionally, age and gender represent consistent and clear informational gaps in society as older individuals and females are significantly less knowledgeable about an array of information security practices than younger individuals and males, respectively.Social implicationsThe findings have important implications for our understanding of information security behavior and user vulnerability in an increasingly digital and connected society. Despite the growing importance of cybersecurity for all individuals in nearly all domains of daily life, there is substantial inequality in awareness about secure cyber practices and the tools and techniques used to protect one’s self from attacks. While digital technology will continue to permeate many aspects of daily life – from financial transactions to health services to social interactions – the findings here indicate that some users may be far more exposed and vulnerable to attack than others.Originality/valueThis study contributes to our understanding of general user information security awareness using a large survey and statistical models to generalize about the public’s information security awareness across multiple domains and stimulates future research on public knowledge of information security. The findings indicate that some users may be far more exposed and vulnerable to attack than others. Despite the growing importance of cybersecurity for all individuals in nearly all domains of daily life, there is substantial inequality in awareness about secure cyber practices and the tools and techniques used to protect one’s self from attacks.

The Impact of the Information Security Policies on Organizational Performance

This study aims to explore the importance of enforcing a solid information security policy on the different institutions, giving a conceptual overview on the relationship between information security practices and organizational performance, presenting global indicators in peer-reviewed journals and records of information security firms and platforms, comparing best practices to productivity and improved performance, Analysing various risks and proposing the best solutions and appropriate protection techniques by following the best various strategies and techniques, propose the mitigation strategic prevention and hybrid techniques to protect the information due to their less expensive and simplicity.

Information Security Practices and Intervention Among Teenagers

ABSTRACT In the digital age, information is drastically exchanged among users. This data exchange paved the way for unsolicited access by cybercriminals, which could lead to psychological and financial loss. In this study, through a pre- and posttest experimental design, 668 Indian teenagers aged between fifteen and nineteen were evaluated last year. The preliminary study revealed low performance by teenagers in e-mail practices, password management, software practices, social media usage, and privacy settings. Through a novel intervention, 36 teenagers were observed through a curated information security module. The pretest and posttest analyses significantly supported the effects of security training, and Cohen’s d effect size reiterated the importance of progressive outcomes in their security literacy and practices. The intervention focused on the importance of threat perception and coping appraisal for inculcating security parameters and behavioral change among the teenagers.

The impact of information security management guide utilization on technological and institutional information security measures in university libraries in Türkiye

The study examined whether the levels of technological and institutional information security measures implemented in university libraries in Türkiye differ based on the usage of a corporate information security management guide. The study was conducted through a literature review and survey method in a total of 199 university libraries in Turkey actively operating in 2023, comprising 124 state universities and 75 private universities. To ensure the contributions of all university libraries population was obtained in a homogeneous manner, a purposive sampling method was used, collecting data from one staff member from each university library.The findings reveal that there are significant differences (p < 0.05) in the levels of both technological and institutional information security measures, depending on the presence and utilization of a corporate information security management guide in university libraries. These findings demonstrated that an enterprise information security management tool is effective in influencing information security practices in university libraries. This result confirmed the hypothesis that there are significant differences in the implementation levels of technological and institutional information security measures based on the presence and usage of an enterprise information security management tool in university libraries in Turkey.Considering the lack of comprehensive studies on information security management in university libraries in Turkey, this research demonstrates its uniqueness by approaching the topic with a holistic approach.

Information Security and Cryptography-Encryption in Journalism

The purpose of this review paper is to garner knowledge about the information security and cryptography encryption practices implementation for journalistic work and its effectiveness in thwarting software security breaches in the wake of ‘Journalism After Snowden’. Systematic literature review for the ‘information security and cryptography encryption in journalism’ employed with an eye to synthesize existing practices in this field. For this, at first the existing approachable research article databases and search engines employed to download or get the abstract of relevant scientific articles which are then used for citation and summarization works in a systematic rigorous anatomization. Contingent upon them their analysis and synthesis employed to arrive at the findings. Research papers collated for the purpose of writing this review paper lighted up the vital issues related to investigative journalists’ safety practices promulgation inadequacies even after the UNESCO 2017 and 2022 guidelines for urgent instrumentalization needs of journalists on the part of its’ member States.

AIM Triad: A Prioritization Strategy for Public Institutions to Improve Information Security Maturity

In today’s world, private and government organizations are legally obligated to prioritize their information security. They need to provide proof that they are continually improving their cybersecurity compliance. One approach that can help organizations achieve this goal is implementing information security maturity models. These models provide a structured framework for measuring performance and implementing best practices. However, choosing a suitable model can be challenging, requiring cultural, process, and work practice changes. Implementing multiple models can be overwhelming, if possible. This article proposes a prioritization strategy for public institutions that want to improve their information security maturity. We thoroughly analyzed various sources through systematic mapping to identify critical similarities in information security maturity models. Our research led us to create the AIM (Awareness, Infrastructure, and Management) Triad. This triad is a practical guide for organizations to achieve maturity in information security practices.

Conducting Risk Analysis and Vulnerability Assessment in the Core Fund System Management at National Social Security Fund

The study sought to analyse security risks and assess security vulnerabilities in the NSSF Core Fund System. The study employed descriptive survey design while the study population was 314 staff working at head office of NSSF. In addition to that, purposive and sampling techniques were used to select 89 who were members of sample size. In addition to that questionnaire and interview were used to solicit data from the respondents while data were analysed using descriptive and content analysis. The study found that security risks and vulnerabilities associated with the core fund system included cyber-attacks, disclosure of sensitive data and hardware failure, others said viruses, internal security threats and internal accidental threats. In the similar case, some said system administration errors. The study also indicated that existence of information security risks had been in different period of time depending on the type of such information security risks. The study concluded that enhancing information security in the Core Fund System utilized by the National Social Security Fund (NSSF) is crucial for safeguarding the data of both the staff and customers. This can be achieved by regularly updating the records of customers and staff members to ensure their information remains reliable. The increasing reliance on computers, mobile devices, and digitalization of business operations necessitates a knowledgeable manager who understands the vulnerabilities and threats to data and information assets. Such a manager can then develop strategies to mitigate risks and protect the organization's data and assets. The study recommended that it is important for organizations to continue providing training to their staff regarding security policies and guidelines for information systems. This will help raise awareness about security risks and allow for the evaluation of vulnerabilities in the NSSF Core Fund System. As a result, it is necessary to establish standards and guidelines that promote the adoption of best practices in information security, ultimately achieving a satisfactory and sufficient level of security.

Ensuring information security: issues of theory and practice

The authors examine current issues in the theory and practice of information security.

Pickled eggs: GenerativeAIas research assistant or co‐author?

Pickled eggs: Generative<scp>AI</scp>as research assistant or co‐author?

Education, Online Presence and Cybersecurity Implications: A Study of Information Security Practices of Computing Students in Saudi Arabia

Information technology is considered as a key enabler to achieve “education for all” as a sustainable development goal; however, involvement in the education sector has introduced security risks along with benefits. Students’ exposure to the internet has increased the probability of cybersecurity attacks. To foster a more sustainable use of technology, it is crucial that students are made aware of information security risks and can keep themselves protected in the online sphere. In this paper, we present the results of a cross-sectional study that explores information-security awareness among students in Saudi Arabia. Empirical data were collected using an online questionnaire and a factor analysis was conducted using partial least-squares structured equation modelling. Based on the existing literature, we focused on four key constructs: password management, infrastructure management, email management, and the perception of security. The results of this study have highlighted that email management and infrastructure management were seen as relevant factors, whereas password management and the perception of security were not considered relevant factors by the respondents. We have also chalked out recommendations to improve cybersecurity awareness among students. The findings of this study will potentially help educational institutions and parents to prepare students in adopting security practices while they are online.

Knowledge of Information Security Awareness and Practices for Home Users: Case Study in Libya

The abundance of information available through the internet, mobile applications, and cloud computing has made it convenient for users to access a wide range of information. However, this convenience comes at a cost, as this information is constantly at risk of being compromised by cybercriminals and hackers. While the recognition of the potential dangers of information security is increasing in developed countries, in regions like Libya in North Africa, the level of protection for this information is insufficient. The purpose of this study is to examine the various factors that may influence or affect users' practices and awareness at home. The investigated factors are policy, behavior, training, knowledge of IT, and education. To accomplish the goals of this study, a quantitative methodology was implemented. Specifically, a survey was created to assess the correlation between key factors and security awareness and practices in the home environment. The survey attracted 220 respondents and was analyzed using Bivariate/Pearson Correlation to determine the relationship between the independent variable and the dependent variable. The results of the study showed a moderate positive correlation between policy, knowledge of IT, and education with security awareness and practice, but the behavior factor had a low correlation. These results indicate that the security awareness and practice level of employees at home is mostly at a moderate level. It is hoped that the present study provides an initial step in focusing on security training sessions among higher education employees to emphasize the importance of security training and increase knowledge of information security. It is hoped that the findings of this study will serve as a starting point for further research and a focus on providing security information for the public, which will help disseminate new knowledge on the importance of security training and increase awareness of information security.

A Review on Major Cyber Threats and Recommended Counter Measures

Abstract: It was predicted that the number of cyber attacks will rise by a factor of two every year. There have been several highprofile cyber attacks on government organizations in India in recent years. Ransomware attacks, Advanced Persistent Threats, Internet of Things, Cloud security risks, Insider threats, Social engineering attacks, Supply chain attacks, Zero-day exploits in cyber threats are some of the significant types of cyber attacks affecting Indian government entities. Security measures, such as regularly backing up important data, installing antivirus software, training employees on how to identify and avoid phishing emails, and maintaining up-to-date software and operating systems are common countermeasures against significant cyber attacks. Preventing cyber attacks requires a multi-layered approach that addresses vulnerabilities in people, processes, and technology. Empowering, the agencies like CERT-In for cyber resilience, strengthening the penalty framework for noncompliance, advisories on information and data security practices are some of the strategies adopted by the government to secure cyberspace. It is necessary to stay informed about the latest threats and continually reassess and update security measures as needed.

Knowledge of Information Security Awareness and Practices for Home Users: Case Study in Libya

The abundance of information available through the Internet, mobile applications, and cloud computing has made it convenient for users to access a wide range of information. However, this convenience comes with a cost as this information is constantly at risk of being compromised by cybercriminals and hackers. While the recognition of the potential dangers of information security is increasing in developed countries, in regions like Libya in North Africa, the level of protection for this information is insufficient. The purpose of this study is to examine the various factors that may influence or affect the users’ practice and awareness at home. The investigated factors are policy, behavior, training, knowledge of IT and education. In order to accomplish the goals of this study, a quantitative methodology was implemented. Specifically, a survey was created to assess the correlation between key factors and security awareness and practices in the home environment. The survey attracted 220 respondents and analyzed using Bivariate/Pearson Correlation to determine the relationship between the independent variable and the dependent variable. The result of the study showed that there was a moderate positive correlation between policy, knowledge of IT and education with security awareness and practice, but behavior factor has a low correlation. These results indicated that security awareness and practice level of employees at home are mostly at the middle level. It is hoped that the present study provides an initial step to focus on security training sessions among higher education employees to reflect new knowledge on the importance of security training to increase the knowledge of information security. It is hoped that the findings of this study will serve as a starting point for further research and focus on providing security information for public, which will help to reflect new knowledge on the importance of security training and increase awareness of information security.