Information Security Training Research Articles

An Investigation of the Factors That Influence Information Security Culture in Government Organizations in Bhutan

ABSTRACT Organizations make large investments to secure data and networks, but information security breaches as a result of insiders continue to rise. One possible contributor to this is poor information security culture. This study investigated the key factors that contribute to effective information security culture in government organizations in Bhutan and how information security culture influences employee security behavior. A research model was developed for the study based on an analysis of the information security literature. Data was collected using an online survey of 181 government employees. Senior management support, information security policy, training and awareness campaigns, interpersonal trust, and job- versus employee-oriented organizational culture were all found to influence information security culture, and information security culture contributed to information security behavior. The study extends understanding of the roles of trust and different dimensions of organizational culture in improving information security culture and behavior. The findings should help government policy makers and information security practitioners when developing information security strategies and programs.

АНАЛІЗ СВІТОВОГО ДОСВІДУ ФОРМУВАННЯ СИСТЕМИ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ В КОНТЕКСТІ ПУБЛІЧНОГО УПРАВЛІННЯ

The article is devoted to the issues of ensuring the functions of public information security management in the context of modern challenges. Informatization processes have covered all spheres of human life, which has led to the emergence of new threats. In today’s world, where electronic technologies are becoming a necessity to ensure the effectiveness of public administration functions, the issue of information security is a key and urgent one. The problems of information security are currently being actualized by a significant increase in the role of accumulation, processing and dissemination of information, in particular, in making strategic, military, political and economic decisions. In this regard, the question of how well the modern public administration system is able to respond to the challenges posed by global digitalization is becoming relevant. The purpose of the paper is to study the peculiarities of ensuring information security in public administration, to analyze current threats and the experience of other countries in overcoming them. In analyzing certain aspects of information security, the paper uses methods of description and classification, as well as methods of studying causal relationships, in particular, the combination of similarities and differences. The article examines the trends in the development of public information security management as a key mechanism for ensuring the security of the State. The author identifies the issue of information security as an element of the State defense policy, which is of particular relevance in the context of full-scale military aggression. The concept of public management of information security can be defined as the process of managing measures aimed at protecting confidential information from unauthorized access, use, disclosure and destruction at the level of the State, organizations or citizens. This process may include the creation of appropriate legislation, the establishment of appropriate control and supervisory bodies, the conduct of information security education and training, and the installation of appropriate security technologies and systems to protect confidential information. The place and role of the system of regulation of information support of management processes at the state level are clarified. Sufficient attention is paid to the peculiarities of ensuring information security in public administration through the analysis of modern information threats. Considering the world experience, the author identifies the key success factors and the problems faced by public administration in overcoming them. We consider it expedient to create national analysis and response centers that will monitor, analyze and respond promptly to cyber threats and improve cybersecurity measures for critical facilities.

Impacts of Blockchain on Accounting in the Business

There have been many studies on the blockchain, however blockchain research in the accounting field is scarce. The article outlines the characteristics and steps to apply blockchain in accounting. The article also identifies and measures the factors affecting the application of blockchain in accounting in enterprises, proving that the application of blockchain impacts the quality of the accounting information system of enterprises. The article shows that incorporating blockchain in accounting will help the accounting at businesses optimize the security, safety, and transparency of accounting information. We collected data on 195 manufacturing firms in six sectors. This study’s primary data analysis method is the SEM structural equation modeling method. The article used AMOS software to evaluate and measure the influence of each factor on the application of blockchain and the effect of blockchain on the accounting information system in enterprises. The article analyzed four aspects: the level of information technology of the accountant (IT), Information Security Infrastructure (SI), Training (TR), and Legality and Regulation (LR), affecting the application of blockchain in the business. The independent variables TR (training) and IT (information technology) have an impact on BL (Blockchain). We also find that the independent variable IT (information technology) has the most substantial impact on Blockchain adoption, followed by the independent variable TR (training), which has the second most influential impact on Blockchain adoption. For the accounting information system, the results show that applying blockchain will substantially impact accounting information, along with the safety factor of information infrastructure SI also has an evident influence. The results show that applying blockchain in accounting, information technology, and professional training are core issues with significant influence. The issue of guaranteed infrastructure also determines the effectiveness and efficiency of blockchain applications for accounting information systems. I declare that this is my scientific work; it is my original work. I commit that all data sources and ideas are my research and have never been published anywhere.

Balancing software and training requirements for information security

Information security is one of the key areas of consideration to assure reliable and dependable information systems (IS). Achieving an appropriate level of IS security requires concurrent consideration of the technical aspects of IS and the human aspects related to the end users of IS. These aspects can be described in the form of information security requirements. We propose an approach that helps select and balance information security software requirements (iSSR) and information security training requirements (iSTR) according to the information security performance of end users. The approach was tested in an experiment involving 128 IS professionals. The results showed that using the proposed approach helps IS professionals with limited experience in information security make significantly better decisions regarding iSSR and iSTR.

Factors Affecting the Security of Information Systems in Africa: A Literature Review

This study determined factors affecting the security of Information Systems in Africa. Also, it established the quality of publications in the area of Information Security. The study is based on peer-reviewed publications conducted in Africa. The study adopted the mixed research approach. The study used a systematic literature review, with part of the analysis using descriptive analysis. In total, 70 papers formed the population of publications extracted in the area of Information Security. In addition, 37 papers had the quality to be included in the analysis of factors affecting Information Security. The study found that information Security factors are in four key categories: human factors, policy-related issues, work environment, and demographic factors. Overall, the work environment is the most reported category affecting the security of Information Systems in Africa. In addition, gender is the highest reported individual factor associated with the insecurity of Information Systems; female is the highly affected gender. Other factors include the lack of Information Security training, the unchecked level of trust, carelessness and poor security policies. The study recommends training programs, policy improvement and promoting behaviours that minimise exposure to attacks.

The effects of knowledge mechanisms on employees' information security threat construal

AbstractOrganisations implement a variety of knowledge mechanisms such as information security education, training and awareness (SETA) programs and information security policies, to influence employees' secure behaviour. Despite increased efforts to provide information systems (IS) security knowledge to employees, data breaches and other security incidents resulting from insider behaviour continue. Recent IS security research, primarily grounded on assumptions of employees' rational assessment of numerous factors, has yielded inconsistent results. Challenging this paradigm, we model secure behaviour on security knowledge mechanisms, which focuses on the multidimensional nature of security knowledge breadth, depth and finesse to represent the full array of managerial levers. We further draw on construal level theory to conceptualise users' perceptual judgements of security messages. Two studies support our model, with the second building on the first. Study 1, an experiment with 312 participants, focused on validating the treatments. Study 2, a survey with 219 participants, validated the entire model. Results showed that our model has significantly more explanatory and predictive power than the orthodox paradigm. Our results have practical implications for optimising the organisation of knowledge mechanisms by emphasising the personal relevance of threats and defining the factors that lead to secure behaviour. We also contribute to the discourse on information security research and provide a template for integrating theories, thus opening new avenues for future research.

How Information Security Management Systems Influence the Healthcare Professionals’ Security Behavior in a Public Hospital in Indonesia

Aim/Purpose: This study analyzes health professionals’ information security behavior (ISB) as health information system (HIS) users concerning associated information security controls and risks established in a public hospital. This work measures ISB using a complete measuring scale and explains the relevant influential factors from the perspectives of Protection Motivation Theory (PMT) and General Deterrence Theory (GDT) Background: Internal users are the primary source of security concerns in hospitals, with malware and social engineering becoming common attack vectors in the health industry. This study focuses on HIS user behavior in developing countries with limited information security policies and resources. Methodology: The research was carried out in three stages. First, a semi-structured interview was conducted with three hospital administrators in charge of HIS implementation to investigate information security controls and threats. Second, a survey of 144 HIS users to determine ISB based on hospital security risk. Third, a semi-structured interview was conducted with 11 HIS users to discuss the elements influencing behavior and current information security implementation. Contribution: This study contributes to ISB practices in hospitals. It discusses how HIS managers could build information security programs to enhance health professionals’ behavior by considering PMT and GDT elements. Findings: According to the findings of this study, the hospital has implemented particular information security management system (ISMS) controls based on international standards, but there is still room for improvement. Insiders are the most prevalent information security dangers discovered, with certain working practices requiring HIS users to disclose passwords with others. The top three most common ISBs HIS users practice include appropriately disposing of printouts, validating link sources, and using a password to unlock the device. Meanwhile, the top three least commonly seen ISBs include transferring sensitive information online, leaving a password in an unsupervised area, and revealing sensitive information via social media. Recommendations for Practitioners: Hospital managers should create work practices that align with information security requirements. HIS managers should provide incentives to improve workers’ perceptions of the benefit of robust information security measures. Recommendation for Researchers: This study suggests more research into the components that influence ISB utilizing diverse theoretical foundations such as Regulatory Focus Theory to compare preventive and promotion motivation to enhance ISB. Impact on Society: This study can potentially improve information security in the healthcare industry, which has substantial risks to human life but still lags behind other vital sector implementations. Future Research: Future research could look into the best content and format for an information security education and training program to promote the behaviors of healthcare professionals that need to be improved based on this ISB measurement and other influential factors.

Ретроспектива обучения информационной безопасности в отечественных школах

The article substantiates the need for information security training in Russian schools. A review of informatics textbooks from 1985 to the present is given with a view to changing views on teaching safe work with information resources, highlighting the dominant areas that are reflected in educational materials. The place of information security in regulatory documents, in particular, in the federal state educational standards (FSES) of basic and secondary general education, is considered. It is shown what forms of information security training are in the classroom (situational tasks, role-playing and business games, watching educational animated videos) and in the extracurricular (information security olympiads, thematic classroom hours, discussion platforms, extracurricular activities, meetings with IT workers, visiting IT enterprises) activities should prevail. Specific examples of gaming tasks for teaching information security are given, which can be used in the classroom as learning tasks or in extracurricular activities as separate competitions.

Modelling the effects of personal factors on information security awareness

According to research, the number of attacks on the Internet has been increasing each year. Hence, information security awareness is a very significant skill. Accordingly, this study aimed to investigate the effects of students’ personal factors on their information security awareness. The researchers conducted a quantitative study that examines a theoretical model. The data were collected from 684 undergraduate students via three data tools. The effects of variables on information security awareness were explained via path analysis. The mediating role of technology attitude was examined in the relationship between information security awareness and the individual variables for the first time. The findings showed that gender and grade did not directly affect information security awareness levels, while attending information security training, department and technology attitude had a significant effect. On the other hand, some personal factors indirectly affected information security awareness. This analysis offered substantial contributions to the literature in uncovering the effects of variables on students’ information security awareness in a holistic way. The results can guide planning for information security training to increase information security awareness by considering personal factors.

Exploring Chinese College Students' Awareness of Information Security in the COVID-19 Era

Abstract The focus of this research was to look into the information security awareness of Chinese university students during the COVID-19 pandemic and make recommendations based on the survey's findings and research literature. The quantitative method is applied in this study. 111 Chinese college students were randomly sampled and requested to answer a Likert information security awareness questionnaire. The descriptive analysis of the data in this study is also done with SPSS. The findings revealed that the vast majority of college students know the significance of information security awareness and have basic information security awareness, based on the data collected. However, some students have not participated in relevant training courses, and many college students do not pay enough attention to personal information security, resulting in poor performance in areas such as files and passwords. As a result, effective solutions such as information security training projects are required to address the current deficiencies. The findings of this study have implications for university administrators and policymakers in terms of how to raise students' awareness of the security of their online learning information. The study should use mixed methods and large sample sizes in the future to provide more detailed and comprehensive survey data, and more credible evidence of college students' information security awareness.

Exploring Chinese College Students' Awareness of Information Security in the COVID-19 Era

Abstract The focus of this research was to look into the information security awareness of Chinese university students during the COVID-19 pandemic and make recommendations based on the survey's findings and research literature. The quantitative method is applied in this study. 111 Chinese college students were randomly sampled and requested to answer a Likert information security awareness questionnaire. The descriptive analysis of the data in this study is also done with SPSS. The findings revealed that the vast majority of college students know the significance of information security awareness and have basic information security awareness, based on the data collected. However, some students have not participated in relevant training courses, and many college students do not pay enough attention to personal information security, resulting in poor performance in areas such as files and passwords. As a result, effective solutions such as information security training projects are required to address the current deficiencies. The findings of this study have implications for university administrators and policymakers in terms of how to raise students' awareness of the security of their online learning information. The study should use mixed methods and large sample sizes in the future to provide more detailed and comprehensive survey data, and more credible evidence of college students' information security awareness.

Analysis of Behavioral and Information Security Awareness among Users of Zoom Application in COVID-19 Era

Behavior in using inappropriate technology and low level of individual awareness causes a high risk of cybercrime. This study aims to see the behavior and awareness of information security among users of the Zoom application, especially in the COVID-19 era in Indonesia. The measurement scales used in this study were RBS (Risky Behavior Scale), CBS (Conservative Behavior Scale), EOS (Exposure Offence Scale), and RPS (Risk Perception Scale). This research used an online questionnaire to collect data with 400 respondents. Data analysis techniques used the Independent Sample T-Test, Mann Whitney, One Way Anova, Krusskal Wallis, Tukey, Pairwise Comparison, and Spearman Rank, which were processed using the SPSS program. The results showed significant differences between demographics on behavior and information security awareness. Daily Internet usage time influenced behavior and awareness of information security. Security behavior and awareness of information security are essential to determine the risks due to behavior and lack of awareness of information security. The most important findings in this study can be used as a reference in designing information security training. Further studies are expected to add other variables such as psychography, geography, or other users of different video conferencing applications such as Google Meet, Microsoft Team, and Webex.

Target Groups in German SMEs for Information Security Training: The Use and Limits of Job Profiles in Designing Training Units

Target Groups in German SMEs for Information Security Training: The Use and Limits of Job Profiles in Designing Training Units

Determinants of Information Security Awareness and Behaviour Strategies in Public Sector Organizations among Employees

In this digital era, protecting an organisation's sensitive information system assets against cyberattacks is challenging. Globally, organisations spend heavily on information security (InfoSec) technological countermeasures. Public and private sectors often fail to secure their information assets because they depend primarily on technical solutions. Human components create the bulk of cybersecurity incidents directly or indirectly, causing many organisational information security breaches. Employees' information security awareness (ISA) is crucial to preventing poor information security behaviours. Until recently, there was little combined information on how to improve ISA and how investigated factors influencing employees' ISA levels were. This paper proposed a comprehensive theoretical model based on the Protection Motivation Theory, the Theory of Planned Behaviour, the General Deterrence Theory, and Facilitating Conditions for assessing public sector employees' ISA intentions for information security behaviour. Using a survey and the structural equation modelling (SEM) method, this research reveals that the utilised factors are positively associated with actual information security behaviour adoption, except for perceived sanction certainty. The findings suggest that the three theories and facilitating conditions provide the most influential theoretical framework for explaining public sector employees' information security adoption behaviour. These findings support previous empirical research on why employees' information on security behaviours vary. Consistent with earlier research, these psychological factors are just as critical as facilitating conditions in ensuring more significant behavioural intention to engage in ISA activities, ensuring information security behaviour. The study recommends that public-sector organisations invest in their employees' applied information security training.

Work ethic and information security behavior

PurposeInformation security is a growing issue that impacts organizations in virtually all industries, and data breaches impact millions of customers and cost organizations millions of dollars. Within the past several years alone, huge data breaches have been experienced by organizations such as Marriot, Equifax, eBay, JP Morgan Chase, Home Depot, Target and Yahoo, the latter of which impacted three billion users. This study aims to examine the utilization of pre-employment screening to identify potential hires that may require enhanced information security training to avoid such costs.Design/methodology/approachThe authors hypothesize that an individual’s work ethic predicts a person’s information security behavior. The authors test this hypothesis using structural equation modeling with bootstrapping techniques.FindingsData analysis suggests that certain dimensions of work ethic do indeed predict information security posture, and thus, simple pre-employment screening techniques (i.e. questionnaires) can aid in identifying potential security threats.Practical implicationsThe findings provide a tool for identifying problematic employee security posture prior to hiring, which may be useful in identifying training needs for new hires.Originality/valueThe findings provide a tool for identifying problematic employee security posture prior to hiring, which may be useful in identifying training needs for new hires.

Exploring potential gender differences in information security and privacy

Purpose Information technology users often fail to adopt necessary security and privacy measures, leading to increased risk of cybercrimes. There has been limited research on how demographic differences influence information security behaviour and understanding this could be important in identifying users who may be more likely to have poor information security behaviour. This study aims to investigate whether there are any gender differences in security and privacy behaviours and perceptions, to identify potential differences that may have implications for protecting users’ privacy and securing their devices, software and data. Design/methodology/approach This paper addresses this research gap by investigating security behaviours and perceptions in the following two studies: one focussing on information security and one on information privacy. Data was collected in both studies using anonymous online surveys. Findings This study finds significant differences between men and women in over 40% of the security and privacy behaviours considered, suggesting that overall levels of both are significantly lower for women than for men, with behaviours that require more technical skill being adopted less by female users. Furthermore, individual perceptions exhibited some gender differences. Originality/value This research suggests that potential gender differences in some security and privacy behaviours and perceptions should be taken into account when designing information security education, training and awareness initiatives for both organisations and the broader community. This study also provides a strong foundation to explore information security individual differences more deeply.

Information security cultural differences among health care facilities in Indonesia

BackgroundHealth information security (IS) breaches are increasing with the use of information technology for health care services, and a strong security culture is important for driving employees' information asset protection behavior. ObjectiveThis study aimed to analyze differences in information security cultures (ISCs) across health care providers based on factors drawn from the ISC model. MethodsWe used twelve factors to measure the ISCs of health care providers. This research applied a survey method with the Kruskal–Wallis H Test and the Mann–Whitney U Test as data analysis techniques. We collected the data through a questionnaire distributed to 470 employees of health care facilities (i.e. hospitals, community health centers, and primary care clinics) in Indonesia. ResultsThe results revealed the differences between health care provider types for 9 of the 12 security culture factors. Top management support, change management, and knowledge were the differentiating factors between all types of health care providers. Organizational culture and security compliance only differed in primary care clinics. Meanwhile, security behavior, soft issues and workplace independence, information security policies, training, and awareness only differed in hospitals. ConclusionThe results indicated that each type of health care provider required different approaches to develop an ISC considering the above factors. They provided insight for top management to design suitable programs for cultivating ISCs in their institutions.

The Role of Management and Teamwork in Helping the Internal Auditor to Cope with IT Environment

Purpose: This paper’s aim is to identify the role of forming teamwork and managing the spirit of one work among the internal audit auditor's team through the use of modern electronic communication tools. Design/Methodology/Approach: The study relied on primary sources represented by reference books, relationship to internal auditing and research and reports, relationship to teamwork and the role of management in assisting the internal auditor to keep pace with IT requirements. Findings: The need for employees from several disciplines has clear importance in information security and appropriate training and planning for employees in the field of information technology. The need for employees from several disciplines has clear importance in information security, and when there are appropriate training and planning for employees in the field of information technology. Practical Implications: The study was based on proposing a role for management and teamwork in helping the internal auditor to cope with information technology requirements and define their role in how to deal with new technology. Originality/Value: There are no previous studies - based on the researcher's knowledge - based on defining the role of management and determining the importance of teamwork in helping the internal auditor to keep pace with the information technology requirements related to the work of internal auditing.

Know Your Enemy: User Segmentation Based on Human Aspects of Information Security

Users of information systems are the weakest link in information security. Considering their current information security performance is essential for improving information security training. User segmentation can help to improve information security training by dividing users into smaller groups based on their information security performance. In this paper, we present a segmented approach for information security training of users. To test the approach, we used data collected from students at a Slovenian university (N=165) with the Human Aspects of Information Security Questionnaire (HAIS-Q). HAIS-Q data was used to divide users into groups according to their information security performance via clustering. The proposed approach inherently balances adaptation of training to the needs of users and the efforts needed to achieve it which maximizes the key benefits of existing information security training approaches. With improved personalization, it mitigates the challenges related to training boringness and lack of user motivation which are emblematic for traditional information security training approaches. The proposed approach also offers some flexibility regarding the degree of personalization and the efforts related to information security training by fine-tuning the number of user groups. Finally, the proposed approach can help to identify beneficial software security requirements during development of new information systems.

Factors Influencing Master Data Quality: A Systematic Review

Master data refers to the data that represents the core business of the organization, shared among different applications, departments, and organizations and most valued as the important asset to the organization. Despite the outward benefit of master data mainly in decision making and organization performance, the quality of master data is at risk. This is due to the critical challenges in managing master data quality the organization may expose. Hence the primary aim of this study is to identify factors influencing master data quality from the lens of total quality management while adopting the systematic literature review method. The study proposed 19 factors that inhibit the quality of master data namely data governance, information system, data quality policy and standard, data quality assessment, integration, continuous improvement, teamwork, data quality vision and strategy, understanding of the systems and data quality, data architecture management, personnel competency, top management support, business driver, legislation, information security management, training, change management, customer focus, and data supplier management that can be categorized to five components which are organizational, managerial, stakeholder, technological, and external. Another important finding is the identification of the differences for factors influencing master data compared to other data domain which are business driver, organizational structure, organizational culture, performance evaluation and rewards, evaluate cost/benefit tradeoffs, physical environment, risk management, storage management, usage of data, internal control, input control, staff participation, middle management's commitment, the role of data quality and data quality manager, audit, and personnel relation. It is expected that the findings of this study will contribute to a deeper understanding of the factors that will lead to an improved master data quality.