Information Security Knowledge Research Articles

Assessment of the Impact of Information Security Awareness Training Methods on Knowledge, Attitude, and Behavior

Technology is changing the way we work more than ever before. Therefore, it is critical to understand the security threats associated with these advanced tools to protect systems and data. Security is a combination of people, processes, and technology. Thus, to counter cyber-threats effectively, information security awareness (ISA) programs are an essential cornerstone of enterprise security. There are many ways in which information security knowledge can be delivered. In this paper, we have conducted an experiment to test the impact of multiple intervention strategies on knowledge, attitude, and behavior. The HAIS-Q was used to evaluate the effectiveness of training methods on the employees. Our study suggests that all the methods raised knowledge equivalently. However, having more than one delivery method to convey the same message had more impact on users’ attitudes. When it comes to behavioral change, however, text-based and game-based training formats performed better than their counterparts. Additionally, employees’ tendency in engaging in self-education activities and participating in future awareness programs were influenced by the intervention strategy. These findings have important implications, as ISA programs should be designed in a way that positively influences the mindset of employees and motivates them to embrace security practices in their daily activities.

A neo-institutional perspective on the establishment of information security knowledge sharing practices

Information security knowledge sharing (ISKS) among an organization's employees is vital to the organization's ability to protect itself from any number of prevalent threats, yet for many organizations, their ability to establish ISKS practices is hampered by a lack of understanding of where and how the key drivers of these practices will emerge. Based on neoinstitutional theory and a multi-study field survey of 834 professional managers in the USA, we develop and test a model that explains the establishment of ISKS practices in an organization as a product of the institutional forces abut to the organization providing normative, mimetic, and coercive influences on top management beliefs and participations in ISKS. Our findings also emphasize the importance of establishing ISKS practices for ensuring employee compliance with information security policies and an effective culture of security. Prior research has shown the importance of institutional forces on organizational processes as well as the importance of ISKS to organizational security efforts. However, this study is one of the early studies to provide insight into the manner, in which institutional forces hold sway over the people responsible for establishing the ISKS practices of a firm; insight that it is essential for firms that have yet to establish such practices or have struggled in their attempts to do so.

EFFECTIVE METHODS FOR SUCCESSFUL INFORMATION SECURITY AWARENESS

Information security awareness is becoming increasingly important these days. It is not enough to have a well-developed physical and logical protection of the system and stored data; the users of these systems have to keep up with technological development and have to be sufficiently aware or cautious when using these systems. Information Security Awareness Programs provide the most effective solution for the improvement of users’ information security knowledge and digital competencies. The aim of this study is to help organisations in finding and providing an effective way of knowledge transfer. The study identifies the key elements of the implementation of the awareness programs and highlights the importance of communication channels and methods. The essay summarises and shows the most effective techniques that experts can use in order to draw the user’s attention toward information security, like real-life simulation scenarios, interactive games, themed awareness videos and other gamification techniques.

KNOWLEDGE MANAGEMENT IN THE CONTEXT OF INFORMATION SECURITY

Knowledge of information security is one of important factors in information security management, since 70-80% of information security incidents occurred due to negligence or lack of awareness of employees. This article highlights the importance of sharing information security knowledge and identifies barriers to such sharing.

A Study on the Integration of Computer Network Information Security Prevention and Web Data Mining Technology

The rapid development of the information age is accompanied by the insecurity of information, and the convenience of data brings the problem of information security to us. In general, network security refers to information security and control security. ISO defines information security as “integrity, availability, confidentiality and reliability of information ”; control security refers to identity authentication, nonrepudiation, authorization and access control. In view of the current situation of computer network information security, we must take effective measures to prevent trouble [1]. From the source of thought, we should attach importance to the self-protection of information security. Computer network users should have a keen sense of protection, strengthen the study of network information security knowledge, and fully understand the importance and significance of computer network security. Among them Web mining technology is no lack of a good choice.

Application of a Blended Assessment Strategy to Enhance Student Interest and Effectiveness in Learning: Case Study With Information Security Literacy.

In the Internet era, information security literacy is a global imperative for nursing students. This study combined an audience response system and an online system to formulate an assessment strategy based on the concept of blended learning. The participants of this study comprised two college nursing classes of an introductory computer science course in Taiwan. With information security as the teaching content, we adopted a quasi-experimental approach to conduct a 5-week teaching experiment. A blended assessment model was adopted for the experiment group, while slide presentation and verbal assessment were used for the control group. Pretests and posttests were administered for information security literacy and learning environment stimulation. The study results indicate the following: (1) the experimental group performed significantly better than the control group in information security literacy, with statistically significant differences in scores regarding information security knowledge and information security skills; (2) the experimental group also presented higher learning motivation than the control group, with statistically significant differences in scores regarding self-efficacy, achievement goals, and learning environment stimulation.

An examination of susceptibility to spear phishing cyber attacks in non-English speaking communities

PurposeSpear phishing is a fraudulent practice that targets specific and well-researched users in an organization to collect their credentials. Previous studies have addressed the underlying drivers that significantly influence susceptibility to spear phishing. However, findings may not be generalized to other cultures and environments such as the developing Non-English-speaking countries. To fill this knowledge gap, this research investigated the drivers that affect susceptibility to spear phishing in the Middle Eastern culture. We proposed and tested a theoretical model that explains users' behavior toward phishing material in the context of Non-English-speaking countries. Design/Methodology/ApproachWe created the proposed model relying on the perceived risk theory, the theory of planned behavior, and the OSIR decision making model. The proposed model addressed the impact of information privacy risks, information security risks, and information security knowledge on the susceptibility to spear phishing attacks through the moderating trust construct. The study was conducted in Jordan, a developing and Non-English-speaking country in the Middle East. We designed a lab experiment to evaluate the robustness of the proposed model based on a multistage research, where 83 university students used a phishing website then answered a related survey. Collected data were empirically tested and evaluated using Partial Least Square Analysis and Structural Equation Modeling. FindingsThe results demonstrated the influence of the identified factors on the susceptibility to spear phishing. The study may provide an assistance in evaluating and selecting tools, methods and features for handling targeted types of phishing. Originality/ValueThere are several novel aspects in this study. 1) the experimental nature of study, where we used a real-life spear phishing scenario. 2) the nature of the targeted websites. We created spoofed pages of two webpages that provide academic activities, where students’ level of trust in those websites is likely higher than other websites. 3) the investigation of the mediation role of trust construct, particularly within a university environment, is a new direction in susceptibility to spear phishing. Unlike existing models that measure the direct effect of personality characteristics on phishing susceptibility, our model introduces trust attitude as an aggregation of positive and negative security-privacy interpretations. Finally, the study was conducted in a developing country environment where the Arabic Language is used in initiating and executing the attack.

Comparing the Effects of Two Methods of Education (Online versus Offline) and Gender on Information Security Behaviors

The importance of information security is increasing, and various efforts are being made to improve users’ information security behaviors. Among these various efforts, information security education is mainly aimed at providing users with information security knowledge and improving information security awareness. This study classified the types of information security education into offline and online to examine the effects of each education method on attitudes toward information security (perceived severity, vulnerability, self-efficacy and response-efficacy) and information security behaviors. A survey was conducted for users with information security education experiences. The results obtained by comparing the differences in the path coefficients of personal information security behaviors according to information security education experiences showed that security behaviors were more significant in the online experience group than the offline group. In addition, gender differences were analyzed, and it was found that females had a greater impact on information security attitudes than males. This study also found that among Internet users with online information security education experience, females tend to have more information security behavior than males, but there were contrasting results among users with offline information security education experiences. The results of this study finally address the necessity of reflecting users’ personalities in the systematic design of information security education in the future. Furthermore, the results of this study support the need for an appropriate education system that sufficiently understands education types to maximize the effects of information security education.

An Investigation of the Information Security Awareness and Practices among Third Level Education Staff, Case Study in Nalut Libya

The development of Information and Communication Technologies (ICTs) is becoming very common throughout society. Therefore, it is a must to protect information assets. In addition to the technological aspect, research continues to confirm the need to enhance security awareness among employees. The objective of this study is to investigate the factors that may impact users’ practice and awareness both in the workplace. Specifically, factors such as policy, behavior, training, knowledge of IT and education were tested. In addition, the second objective of this study is to investigate the information security awareness and practice level among the employees. To achieve the study objectives, a quantitative methodology was applied; specifically a survey instrument was developed to measure if each of the key factors has a significant association within the security awareness and practice in the workplace. 202 usable surveys were collected from higher education employees and analyzed using Bivariate/Pearson Correlation to determine the relationship between the independent variable and the dependent variable. The findings of the study revealed that there was a positive correlation between policy, behavior, training, knowledge of IT and education with security awareness and practice These results indicated that security awareness and practice level of employees' in the workplace at the middle level. It is hoped that the present study provides an initial step to focus on security training sessions among higher education employees to reflect new knowledge on the importance of security training to increase the knowledge of information security.

МОРАЛЬНО-ЕТИЧНІ АСПЕКТИ ІНФОРМАЦІЙНО-КОМУНІКАЦІЙНИХ ТЕХНОЛОГІЙ

В статті розглядаються питання морально-етичних аспектів інформаційно-комунікаційних технологій в діяльності вчителя інформатики; наголошується, що сучасний учитель повинен не лише давати знання, а й формувати цінності, світогляд молодого покоління. Знання інформаційної безпеки, уміння ефективно використовувати засоби інформаційно-комунікаційних технологій у житті і професійній діяльності мають стати для учнів, студентів – майбутнього нашої держави – засобом формування нового типу мислення й природним ефективним інструментом освітньо-пізнавальної, творчої, самостійної діяльності. Для формування технологічно обізнаної, культурно-розвиненої особистості запропоновано спецкурс «Морально-етичні аспекти інформаційно-комунікаційних технологій у професійній діяльності вчителя інформатики», представлений такими змістовими модулями, як «Соціальні та етичні питання інформаційно-комунікаційних технологій» та «Морально-етичні норми комп’ютерної етики» з відповідними темами, які розкривають особливості комп'ютерної етики, конфіденційність персональної інформації в базах даних; етичні проблеми і норми при формуванні інформаційного суспільства, зокрема віртуальна (інформаційна) етика, етика міжособистісного спілкування в інформаційному просторі. Все це забезпечує розуміння вчителями інформатики соціальних аспектів розробки інформаційних технологій, урахування можливих негативних наслідків і реальних цінностей, також знання етичних кодексів в сфері інформаційних технологій.

Training in shaping employee information security awareness

The purpose of this paper is to present the effectiveness of training in the development of employee awareness in the area of information security. Two kinds of primary research were carried out: surveys conducted among employees of various organizations, the essence of which involved a comparison of the awareness level in terms of security among people who had participated and those who had not participated in information security training; and a comparative analysis of results of an audit of information security awareness conducted among employees of a large organization before and after conveying information security training. Research results showed significant effectiveness of training as a method not only of information security knowledge extension but also, and most importantly, one that has a significant impact on actual behaviors of employees in the studied area. Due to the fact that the greatest gap in security measures involves the lack of employee awareness, and because training is an effective method of shaping the said awareness, organizations should develop and implement an adequate training program raising the level of employee awareness in terms of information security. It should be remembered that the program cannot be a one-off event but rather a cyclical one. While the importance of awareness in information security is well described in the subject literature, there is a shortage of publications, which show a direct influence of training on employees’ level of knowledge and behaviors in terms of information security. This paper, in an interesting, dual way, points to an actual impact of training both on expanding knowledge and on behaviors in terms of information security.

A Reverse Digital Divide: Comparing Information Security Behaviors of Generation Y and Generation Z Adults

How individuals conceptualize their accountability related to digital technology. There may also be age-based vulnerabilities resulting from personal perceptions about the importance of engaging in best-practices. However, age may not be as critical as experience when it comes to implementation of these behaviors. Using the Cybersecurity Behaviors subscale of the Online Security Behaviors and Beliefs Questionnaire (OSBBQ), this study compared the self-reported cybersecurity attitudes and behaviors across college-aged individuals from Generation Y and Generation Z. Data were derived from a convenience sample of predominantly African-American and Caucasian respondents (N=593) recruited from two public universities in Virginia, USA. Four of the eight OSBBQ subscale items demonstrated significant differences between Generation Y and Generation Z adults. Generation Y adults reported greater reviewing of privacy policies on social media, maintenance of antivirus updates, watching for unusual computer performance, and acting on malware alerts, but no significant differences on the other items. It is reasonable to assume that the observed elevated scores were accompanied by greater individual knowledge of information security simply because of being older as a cohort, suggesting that the group was also more experienced and less likely to perceive themselves as invulnerable to online victimization.

Protecting intellectual property from insider threats

PurposeThe purpose of this paper is to propose a theory of information security intelligence and examine the effects of managers’ information security intelligence (MISI) on employees’ procedural countermeasure awareness and information security policy (ISP) compliance intention.Design/methodology/approachA survey approach and structural equation modeling is utilized. Partial least squares (WarpPLS 6.0) and nonlinear algorithm are employed to analyze and examine the hypotheses. In total, 324 employees from companies in South Korea participated in the survey, which was conducted by a professional survey service company.FindingsMISI positively affects employees’ awareness of information security procedural countermeasures; information security knowledge and problem-solving skills have positive effects on procedural countermeasures awareness; MISI increases employees’ compliance intention through procedural countermeasure awareness; and information security procedural countermeasures positively affect employees’ ISP compliance intention.Research limitations/implicationsThis study proposes a theory of information security intelligence and examines its impacts on employees’ compliance intentions. The study highlights the mediating role of information security procedural countermeasures between information security intelligence and employees’ compliance intentions.Practical implicationsManagers should improve and explicitly demonstrate information security knowledge and problem-solving skills to increase employees’ ISP compliance intention. To protect the organization’s intellectual capital, managers should champion the development and promotion of PCM, rather than leave these functions to the information security group.Originality/valueThis is the first empirical study to propose and validate MISI.

A Case-Based Reasoning Approach for the Cybersecurity Incident Recording and Resolution

Intelligent computing techniques have a paramount importance to the treatment of cybersecurity incidents. In such Artificial Intelligence (AI) context, while most of the algorithms explored in the cybersecurity domain aim to present solutions to intrusion detection problems, these algorithms seldom approach the correction procedures that are explored in the resolution of cybersecurity incident problems that already took place. In practice, knowledge regarding cybersecurity resolution data and procedures is being under-used in the development of intelligent cybersecurity systems, sometimes even lost and not used at all. In this context, this work proposes the Case-based Cybersecurity Incident Resolution System (CCIRS), a system that implements an approach to integrate case-based reasoning (CBR) techniques and the IODEF standard in order to retain concrete problem-solving experiences of cybersecurity incident resolution to be reused in the resolution of new incidents. Different types of experimental results so far obtained with the CCIRS show that information security knowledge can be retained with our approach in a reusable memory improving the resolution of new cybersecurity problems.

Organizational practices as antecedents of the information security management performance

PurposeThe purpose of this paper is to expand current knowledge about the security organizational practices and analyze its effects on the information security management performance.Design/methodology/approachBased on the literature review, the authors propose a research model together with hypotheses. The survey questionnaires were developed to collect data, which then validated the measurement model. The authors collected 111 responses from CEOs at manufacturing small- and medium-sized enterprises (SMEs) that had already implemented security policies. The hypothesized relationships were tested using the structural equation model approach with EQS 6.1 software.FindingsResults validate that information security knowledge sharing, information security education and information security visibility, as well as security organizational practices, have a positive effect on the information security management performance.Research limitations/implicationsThe consideration of organizational aspects of information security should be taken into account by academics, practitioners and policymakers in SMEs. Besides, the work helps validate novel constructs used in recent research (information security knowledge sharing and information security visibility).Practical implicationsThe authors extend previous works by analyzing how security organizational practices affect the performance of information security. The results suggest that an improved performance of information security in the industrial SMEs requires innovative practices to foster knowledge sharing among employees.Originality/valueThe literature recognizes the need to develop empirical research on information security focused on SMEs. Besides the need to identify organizational practices that improve information security, this paper empirically investigates SMEs’ organizational practices in the security of information and analyzes its effects on the performance of information security.

Cybercrime risk awareness rate among students in Central Asia: A comparative study in Kyrgyzstan and Kazakhstan

ABSTRACTIt is a well-known fact that the system is as secure as its weakest point. Often, organizations and countries invest in the technologies, forgetting that it is impossible to assure information security without raising awareness among users. Therefore, in this study, the cybercrime awareness rate of users in two Central Asian Countries was investigated. As a target group, students of two public universities from each country were chosen. Results of quantitative research showed that in Kazakhstan, gender and age of respondents affect the cybercrime awareness rate, while in Kyrgyzstan, none of the factors had an impact on this rate. Although there was a statistically significant difference in cybercrime awareness of users in terms of the country of residence, students in two Central Asian countries showed a little difference in information security knowledge, which is, in its own term, mostly depends on the computer literacy rate of students.

A dimension-based information security culture model and its relationship with employees’ security behavior: A case study in Malaysian higher educational institutions

ABSTRACTDespite strong recommendations by scholars to establish Information Security Culture (ISC), the lack of ISC guidelines persists, particularly in aspects that could effectively improve employees’ security behavior in an organization. This study proposes an ISC model based on seven new formulated dimensions to examine its influence on employees’ Information Security Policy (ISP) compliance behavior. The dimensions represent specific aspects of ISC and were formulated based on widely accepted concepts of Organizational Culture and ISC. The model was tested at 19 out of 21 public universities in Malaysia and validated using Partial Least Square Structural Equation Modelling (PLS-SEM). Findings revealed all seven dimensions are significant in contributing to the underlying concept of ISC, with Information Security Knowledge being the most important dimension. This ISC concept was also found to be significant in influencing ISP compliance behavior. This study contributes to ISC literature in terms of conceptualization and operationalization of an ISC concept based on the new comprehensive dimensions in relation to ISP compliance behavior. The model could be employed by practitioners in assessing, improving and cultivating a positive ISC that would effectively influence employees’ security behavior in higher educational institutions.

Identifying and Ranking Knowledge Management Tools and Techniques Affecting Organizational Information Security Improvement

ABSTRACTInformation system security is one of the most important challenges of today’s organisations. Although most organisations use security technologies, they have come to the conclusion that technology alone is not enough. In this study, we analysed and ranked the opinions of IT experts, managers, and Ph.D. students concerning the role of knowledge management in creating, recording, sharing, and applying information security knowledge. First, we identified 62 knowledge management techniques and tools. Then, 20 techniques and tools were investigated in knowledge management cycle using fuzzy screening through interviews and questionnaires. Finally, the network analysis methods, DEMATEL, and VIKOR were employed for weighting, internal relationships, and ranking each of the tools in the evaluation cycle. According to the results, “ Knowledge Base” was the most important factor in creating and recording knowledge. In sharing and diffusing knowledge, “ Categorisation of Knowledge ”scored the top, while “Knowledge Maps” were the most important tool in knowledge application.

Determining the effects of information security knowledge on information security awareness via structural equation modelings

The aim of this study is by investigating the Information Security Awareness of University Students via statistical techniques, revealing the existing awareness and giving some suggestions to improve this awareness. By the internet, which entered our daily life snappily, information and technology era has been started and it gave new point of view by changing our lifestyle in many areas as electronic commerce, education and government. By developing and rapidly improving technology, Individuals' having enough capacity to use it, information culture has spread over all parts of the society. By increasing the information systems and internet every day, by using private and secret information, doing both public and individual processes via these systems has increased the importance of information and information systems and resolve the information awareness as an obligatory case. It can be observed nowadays that there are many information guilt is being perpetration. Its known that related ministry in our country is taking enough security precautions both hardware and software for the information and system security and researching on new actions. However, the most important factor to pan out for the information and system security is the development of corporate and individual awareness. With this purpose, to measure the computer usage praxis and Information Security Awareness levels of Students of Afyon Kocatepe University, by using "Information Security Awareness Scale", which has developed previously the related data is obtained via a questionnaire and analyzed by SPSS and LISREL software. In this study as statistical techniques, Explanatory Factor Analysis, Confirmatory Factor Analyzes and Structural Equation Modeling is used.

Injecting cybersecurity into a CS program

Covering CS2013 Information Assurance and Security (IAS) knowledge area within an undergraduate CS program will provide students with foundational cybersecurity knowledge and skills to mitigate cyb...