Level Of Security Awareness Research Articles

Security and Privacy Awareness: A Survey for Smartphone User

Smartphone becomes one of the most popular devices in last few years due to the integration of powerful technologies in it. Now-a-days a smartphone can provide different services as like as a computer provides. Smartphone holds our important personal information such as photos and videos, SMS, email, contact list, social media accounts etc. Therefore, the number of security and privacy related threats are also increasing relatively. Our research aims at evaluating how much the smartphone users are aware about their security and privacy. In this study, firstly we have taken a survey for smartphone users to access the level of smartphone security awareness displayed by the public. We also determine whether a general level of security complacency exists among smartphone users and measure the awareness of android users regarding their privacy. From survey result we have found that, most of the people are not aware about their smartphone security and privacy. Secondly, based on survey results, we have shown a method to measure the level of awareness (LOA) for the smartphone users. By using this method, a user can easily measure his/her smartphone security and privacy related level of awareness.

The information security awareness of the Slovakian kindergarten teacher students at starting and finishing the study in higher education

In this paper we have analysed the changing of the kindergarten teacher-education students' awareness of information security at J. Selye University in Slovakia. Because there are sensitive data about children stored in the kindergarten (e.g. home address, parents' details, medical records, etc.), it deeply matters how careful is the data stored. Thorough data protection is important in order to avoid the digitally stored information to be viewable by other persons, who can use them for malicious purposes (e.g. social engineering, kidnapping, murder). This requires appropriate care and protection of storage and handling. In our research we wanted to know what level of information security awareness characterizes the kindergarten teacher-education students, whether they are aware of the basic data protection aspects. We want to see the higher education without any information security course have gained the information security awareness of the kindergarten teacher-education students or not.

Determining the effects of information security knowledge on information security awareness via structural equation modelings

The aim of this study is by investigating the Information Security Awareness of University Students via statistical techniques, revealing the existing awareness and giving some suggestions to improve this awareness. By the internet, which entered our daily life snappily, information and technology era has been started and it gave new point of view by changing our lifestyle in many areas as electronic commerce, education and government. By developing and rapidly improving technology, Individuals' having enough capacity to use it, information culture has spread over all parts of the society. By increasing the information systems and internet every day, by using private and secret information, doing both public and individual processes via these systems has increased the importance of information and information systems and resolve the information awareness as an obligatory case. It can be observed nowadays that there are many information guilt is being perpetration. Its known that related ministry in our country is taking enough security precautions both hardware and software for the information and system security and researching on new actions. However, the most important factor to pan out for the information and system security is the development of corporate and individual awareness. With this purpose, to measure the computer usage praxis and Information Security Awareness levels of Students of Afyon Kocatepe University, by using "Information Security Awareness Scale", which has developed previously the related data is obtained via a questionnaire and analyzed by SPSS and LISREL software. In this study as statistical techniques, Explanatory Factor Analysis, Confirmatory Factor Analyzes and Structural Equation Modeling is used.

Information Security: Awareness and Training Program in the Middle East Universities

An effective Security Awareness and Training (SAT) program enables organizational members to understand the organization’s security strategies, know their responsibilities, and control risks that are caused by security incidents. Therefore, deploying a SAT program is one of the most important steps for any organization to assure that information assets are appropriately secured. The aim of this paper is into folds: first, to gain an insight and determine the information security awareness and training program levels in Middle Eastern higher education sector through a case study that examined 182 institute websites over eight countries. Second, to provide recommendations based on the findings that aid information security professionals to establish a new or improved existing awareness and training program. Literature showed that no study has been done on the SAT program at the level of the Middle Eastern region. However, there was a need to this investigation and therefore, it was a pioneering study at the region level in the field of information security.

Definition and Multidimensionality of Security Awareness

This study proposes and examines a multidimensional definition of information security awareness. We also investigate its antecedents and analyze its effects on compliance with organizational information security policies. The above research goals are tested through the theoretical lens of technology threat avoidance theory and protection motivation theory. Information security awareness is defined as a second-order construct composed of the elements of threat and coping appraisals supplemented by the responsibilities construct to account for organizational environment. The study was executed in two stages. First, the participants (employees of a municipality) were exposed to a series of phishing messages. Second, the same individuals were asked to participate in a survey designed to examine their security awareness. The research model was tested using PLS-SEM approach. The results indicate that security awareness is in fact a second-order formative construct composed of six components. There are significant differences in security awareness levels between the victims of the phishing experiment and the employees who maintain compliance with security policies. Our study extends the theory by proposing and validating a general, yet practical definition of security awareness. It also bridges the gap between theory and practice - our contextualization of security awareness draws heavily on both fields.

The impact of road transporter development trajectory onto cargo safety and security

This article attempts to reveal the general behavioural norms of cargo carriers, with a predominant emphasis on security issues. The security awareness level of road transporters has been found hugely dependent on management capabilities. Additionally, this poses a risk factor indicative of a shipment load's quantity and value. At a certain level of road transporter development trajectory, broad research delineates a sharp increase in security awareness, stemming from leadership recognition at larger companies. The results of the following research findings are significantly similar to various well respected scientific theories which verify the hypothesis that the principal barrier to developing a company is a combination of a lack of management capabilities and an unwillingness to adapt to change.

Taxonomy of mobile users' security awareness

The popularity of smartphones, coupled with the amount of valuable and private information they hold, make them attractive to attackers interested in exploiting the devices to harvest sensitive information. Exploiting human vulnerabilities (i.e., social engineering) is an approach widely used to achieve this goal. Improving the security awareness of users is an effective method for mitigating social engineering attacks. However, while in the domain of personal computers (PCs) the security awareness of users is relatively high, previous studies have shown that for the mobile platform, the security awareness level is significantly lower. The skills required from a mobile user to interact safely with his/her smartphone are different from those that are required for safe and responsible PC use. Therefore, the awareness of mobile users to security risks is an important aspect of information security. An essential and challenging requirement of assessing security awareness is the definition of measureable criteria for a security aware user. In this paper, we present a hierarchical taxonomy for security awareness, specifically designed for mobile device users. The taxonomy defines a set of measurable criteria that are categorized according to different technological focus areas (e.g., applications and browsing) and within the context of psychological dimensions (e.g., knowledge, attitude, and behavior). We demonstrate the applicability of the proposed taxonomy by introducing an expert-based procedure for deriving mobile security awareness models for different attack classes (each class is an aggregation of social engineering attacks that exploit a similar set of human vulnerabilities). Each model reflects the contribution (weight) of each criterion to the mitigation of the corresponding attack class. Application of the proposed procedure, based on the input of 17 security experts, to derive mobile security awareness models of four different attack classes, confirms that the skills required from a smartphone user to mitigate an attack are different for different attack classes.

Managing information security awareness at an Australian bank: a comparative study

PurposeThe aim of this study was first to confirm that a specific bank’s employees were generally more information security-aware than employees in other Australian industries and second to identify the major factors that contributed to this bank’s high levels of information security awareness (ISA).Design/methodology/approachA Web-based questionnaire (the Human Aspects of Information Security Questionnaire – HAIS-Q) was used in two separate studies to assess the ISA of individuals who used computers at their workplace. The first study assessed 198 employees at an Australian bank and the second study assessed 500 working Australians from various industries. Both studies used a Qualtrics-based questionnaire that was distributed via an email link.FindingsThe results showed that the average level of ISA among bank employees was consistently 20 per cent higher than that among general workforce participants in all focus areas and overall. There were no significant differences between the ISA scores for those who received more frequent training compared to those who received less frequent training. This result suggests that the frequency of training is not a contributing factor to an employee’s level of ISA.Research limitations/implicationsThis current research did not investigate the information security (InfoSec) culture that prevailed within the bank in question because the objective of the research was to compare a bank’s employees with general workforce employees rather than compare organisations. The Research did not include questions relating to the type of training participants had received at work.Originality/valueThis study provided the bank’s InfoSec management with evidence that their multi-channelled InfoSec training regime was responsible for a substantially higher-than-average ISA for their employees. Future research of this nature should examine the effectiveness of various ISA programmes in light of individual differences and learning styles. This would form the basis of an adaptive control framework that would complement many of the current international standards, such as ISO’s 27000 series, NIST’s SP800 series and ISACA’s COBIT5.

Security Awareness of the Digital Natives

Young generations make extensive use of mobile devices, such as smartphones, tablets and laptops, while a plethora of security risks associated with such devices are induced by vulnerabilities related to user behavior. Furthermore, the number of security breaches on or via portable devices increases exponentially. Thus, deploying suitable risk treatments requires the investigation of how the digital natives (young people, born and bred in the digital era) use their mobile devices and their level of security awareness, in order to identify common usage patterns with negative security impact. In this article, we present the results of a survey performed across a multinational sample of digital natives with distinct backgrounds and levels of competence in terms of security, to identify divergences in user behavior due to regional, educational and other factors. Our results highlight significant influences on the behavior of digital natives, arising from user confidence, educational background, and parameters related to usability and accessibility. The outcomes of this study justify the need for further analysis of the topic, in order to identify the influence of fine-grained semantics, but also the consolidation of wide and robust user-models.

Cybersecurity and the Internet of Things

PURPOSE/THESIS: The purpose of this paper is to use a recent cyber-attack to highlight the current state of readiness of Internet of Things (IoT) technologies with regard to security vulnerabilities as well as fundamental – in the author’s opinion – changes that will need to take place within these industries and technologies to mitigate the overall cybersecurity risk. APPROACH/METHODS: The analysis of the findings from numerous existing published security studies. RESULTS AND CONCLUSIONS: The following conclusions were reached: (1) in the world becoming more and more interconnected through the web enabled devices (IoT devices), new forms of security threats have been developed; (2) at present IoT devices introduce a high level of vulnerability; (3) many of these risks may be mitigated with already existing technologies; (4) however, due to the fragmented and heterogeneous nature of the IoT devices, the implementation of even basic levels of security is more challenging than in the case of traditional Internet connected devices (e.g. personal computers); (5) the industry needs to face and address three key issues that will in turn help to mitigate the unique security threats posed by IoT devices, namely: the drive towards open standards, the industry cooperation and consolidation, and the improvement of consumer awareness. ORIGINALITY/VALUE: The value of the research is to highlight the security issues related to the Internet of Things and propose solutions that must be implemented to increase the level of security awareness within the IoT environment.

A Data Exfiltration and Remote Exploitation Attack on Consumer 3D Printers

With the increased popularity of 3D printers in homes, and industry sectors, such as biomedical and manufacturing, the potential for cybersecurity risks must be carefully considered. Risks may arise from factors such as printer manufacturers not having the requisite levels of security awareness, and not fully understanding the need for security measures to protect intellectual property, and other sensitive data that are stored, accessed, and transmitted from such devices. This paper examines the security features of two different models of MakerBot Industries’ consumer-oriented 3D printers and proposes an attack technique that is able to, not only, exfiltrate sensitive data, but also allow for remote manipulation of these devices. The attack steps are discretely modeled using a threat model to enable formal representation of the attack. Specifically, we found that the printers stored the previously printed and currently printing objects on an unauthenticated web server. We also ascertain that the transport layer security implementation on these devices was flawed, which severely affected the security of these devices and allowed for remote exploitation. Countermeasures to the attack that are implementable by both the manufacturer and the user of the printer are presented.

A Markov adversary model to detect vulnerable iOS devices and vulnerabilities in iOS apps

With the increased convergence of technologies whereby a user can access, store and transmit data across different devices in real-time, risks will arise from factors such as lack of appropriate security measures in place and users not having requisite levels of security awareness and not fully understanding how security measures can be used to their advantage. In this paper, we adapt our previously published adversary model for digital rights management (DRM) apps and demonstrate how it can be used to detect vulnerable iOS devices and to analyse (non-DRM) apps for vulnerabilities that can potentially be exploited. Using our adversary model, we investigate several (jailbroken and non-jailbroken) iOS devices, Australian Government Medicare Expert Plus (MEP) app, Commonwealth Bank of Australia app, Western Union app, PayPal app, PocketCloud Remote Desktop app and Simple Transfer Pro app, and reveal previously unknown vulnerabilities. We then demonstrate how the identified vulnerabilities can be exploited to expose the user's sensitive data and personally identifiable information stored on or transmitted from the device. We conclude with several recommendations to enhance the security and privacy of user data stored on or transmitted from these devices.

기숙사생의 안전의식 조사를 통한 재해예방 대책 연구

대학 기숙사생들의 안전의식 수준을 평가하여 사고예방을 위한 문제점 도출 및 개선방안을 제시하기 위하여 본 연구를 수행하였다. 사생들 150명을 대상으로 안전교육 실시의 내용, 효과, 요구도 등을 조사하였으며, 개인별 안전의식 수준을 평가하기 위하여 위험요소의 파악, 위험한 행동, 재난 대응 요령 등을 설문하였다. 연구결과, 안전교육의 만족도와 효과는 높았던 것으로 조사되었으며, 사고요인에 대한 인지도는 높으나 구체적인 대응방법에 대한 이해도가 부족한 것으로 나타나 재난발생 시 대응방법에 대한 안전교육을 강화하여야 할 것으로 생각된다. This study was performed to evaluate the safety level of consciousness of college dorm life, and to suggest the problem derivation and to improve the prevention of accidents. The survey research was performed to investigate the contents of safety training for 150 people, and the effectiveness, the demands of safety were also examined. The risk factors were identified in order to assess the level of personal security awareness. The survey was performed for the knowledge of risky behaviors, such as disaster preparedness tips. The research showed that the satisfaction and effectiveness of safety training was high by investigation. Through the research, the recognition factor of the accident, which occurs by a lack of understanding for specific responses, must be enhanced using the safety training to respond adequately when disaster occurs.

Can perceptual differences account for enigmatic information security behaviour in an organisation?

Information security in organisations is often threatened by risky behaviour of users. Despite information security awareness and training programmes, the human aspect of information security remains a critical and challenging component of a safe and secure information environment, and users reveal personal and confidential information regularly when asked for it. In an effort to explain and understand this so-called privacy paradox, this paper investigates aspects of trust and perceptual differences, based on empirical research. Two preceding social engineering exercises form the basis of the research project and are also presented as background information. Following the empirical work, a safe and secure information model is proposed. It is then argued that perceptual alignment of different organisational groups is a critical and prerequisite requirement to reach information security congruence between groups of people. In the context of the proposed model, the perceptual differences also offer some explanation as to why users with high levels of security awareness as well as high levels of trust in own and organisational capabilities so often fall victim to social engineering scams. The empirical work was performed at a large utility company and results are presented together with appropriate discussions.

A framework to assist email users in the identification of phishing attacks

Purpose – The purpose of this paper is to propose a framework to address the problem that email users are not well-informed or assisted by their email clients in identifying possible phishing attacks, thereby putting their personal information at risk. This paper therefore addresses the human weakness (i.e. the user’s lack of knowledge of phishing attacks which causes them to fall victim to such attacks) as well as the software related issue of email clients not visually assisting and guiding the users through the user interface. Design/methodology/approach – A literature study was conducted in the main field of information security with a specific focus on understanding phishing attacks and a modelling technique was used to represent the proposed framework. This paper argues that the framework can be suitably implemented for email clients to raise awareness about phishing attacks. To validate the framework as a plausible mechanism, it was reviewed by a focus group within the School of Information and Communication Technology (ICT) at the Nelson Mandela Metropolitan University (NMMU). The focus group consisted of academics and research students in the field of information security. Findings – This paper argues that email clients should make use of feedback mechanisms to present security related aspects to their users, so as to make them aware of the characteristics pertaining to phishing attacks. To support this argument, it presents a framework to assist email users in the identification of phishing attacks. Research limitations/implications – Future research would yield interesting results if the proposed framework were implemented into an existing email client to determine the effect of the framework on the user’s level of awareness of phishing attacks. Furthermore, the list of characteristics could be expanded to include all phishing types (such as clone phishing, smishing, vishing and pharming). This would make the framework more dynamic in that it could then address all forms of phishing attacks. Practical implications – The proposed framework could enable email clients to provide assistance through the user interface. Visibly relaying the security level to the users of the email client, and providing short descriptions as to why a certain email is considered suspicious, could result in raising the awareness of the average email user with regard to phishing attacks. Originality/value – This research presents a framework that email clients can use to identify common forms of normal and spear phishing attacks. The proposed framework addresses the problem that the average Internet user lacks a baseline level of online security awareness. It argues that the email client is the ideal place to raise the awareness of users regarding phishing attacks.

Analysis of a Security Survey for Smartphones

This paper presents the findings of a study in which students at a four-year university were surveyed in an effort to analyze and verify the differences in perceived security awareness, security-related activities, and security damage experiences when using smartphones, based on demographic variables such as gender, academic year, and college major. Moreover, the perceived security awareness items and security-related activities were tested to verify whether they affect the students' security damage experience. Based on survey data obtained from 592 participants, the findings indicate that demographic differences exist for some of the survey question items. The majority of the male students replied "affirmative" to some of the questions related to perceived security awareness and "enthusiastic" to questions about security-related activities. Some academic year differences exist in the responses to perceived security awareness and security-related activities. On the whole, freshmen had the lowest level of security awareness. Security alert seems to be very high in sophomores, but it decreases as the students become older. While the difference in perceived security awareness based on college major was not significant, the difference in some security-related activities based on that variable was significant. No significant difference was found in some items such as storing private information in smartphones and frequency of implementation of security applications based on the college major variable. However, differences among the college majors were verified in clicking hyperlinks in unknown SMS messages and in the number of security applications in smartphones. No differences were found in security damage experiences based on gender, academic year, and college major. Security awareness items had no impact on the experience of security damage in smartphones. However, some security activities, such as storing resident registration numbers in a smartphone, clicking hyperlinks in unknown SMS messages, the number of security apps in a smartphone, and the frequency of implementation of security apps did have an impact on security damage.

Information Security Behaviour Profiling Framework (ISBPF) for student mobile phone users

The mobile phone has become a necessity for many students; however it also exposes them to security threats that may result in a loss of information. In developing countries, large numbers of students are at a disadvantage because they have limited access to information relating to information security threats, unlike their counterparts in more developed societies who can readily access this information from sources such as the Internet. In addition, the developmental environment is plagued with challenges like access to the Internet and limited access to computers.The poor security behaviour exhibited by student users of mobile phones, which was confirmed by the findings of this study, is of particular interest in the context of the university in this study as most undergraduate students are offered a computer-related course which covers certain information security-related principles. This study addressed the problem of low information security awareness levels among student mobile phone users with the objective of levering security awareness as a way of stimulating safer security behaviours among mobile phone users. The resulting changes in awareness were then juxtaposed against behavioural intent changes in the proposed Information Security Behaviour Profiling Framework. Action research was selected as the appropriate methodology for this study, which saw mobile phone users exposed to various awareness campaigns with their behaviour observed before and after these interventions. This paper proposes a framework which can be used to forecast the information security behaviour profiles of student mobile phone users.The findings of this study uncover a possible link between information security awareness and information security behavioural intention, which translates into the security behaviour profiles exhibited by mobile phone users. By using the proposed framework to examine the association between information security awareness and mobile phone user security behavioural intent, this paper proposes a new method for tracking and categorising student mobile phone user security behavioural profiles. While the level of student information security awareness and behavioural intent were measured, no comparison was made between the awareness interventions implemented as part of this action research study.

Old Monarchy in the New Cyberspace: Empirical Examination of Information Security Awareness among Austrian and Hungarian Enterprises

Information security awareness is part of organizational culture, a way of thinking and behavior which ensures that the employees of the organizations are committed to acknowledging the legitimacy of security measures, they abide by them and they also make them known to others and enforce their application. After collecting empirical data from 280 Austrian and 470 Hungarian employees of different companies we concluded that the level of information security awareness of managers and employees in the Austrian and Hungarian business sector depends on company size. The level of this type of awareness can be regarded as good in the case of corporations both in Austria and Hungary. A good level of information security awareness was observed among the Austrian medium-sized enterprises. However, in a fifth of their Hungarian counterparts, the employees need further trainings in this area. Security problems can be traced back to poor organization at a fifth of the Austrian small-sized enterprises, a third of the Austrian microenterprises, and three-quarters of the Hungarian microenterprises. In 20% of the Austrian and Hungarian enterprises, employees have distressing gaps in their knowledge in this area, furthermore, it can also be concluded that employees with higher digital literacy have a higher level of information security awareness in Austria compared to the Hungarian business sector.

Measuring Information Security Awareness of Indonesian Smartphone Users

One of information security management elements is information security awareness program. Usually, this programs only involve the employees within the organization. Some organizations also consider security awareness for some parties outside the organization like providers, vendors, and contractors. This paper add consumers as variable to be considered in information security awareness program as there are also some threats for organization through them. Information security awareness will be measured from user’s knowledge, behavior, and attitude of five information security focus areas in telecommunication, especially related with smartphone users as one segment of telecommunication provider. For smartphone users, information security threats not only from Internet, but also by phone call or texting. Therefore, focus area in this research consist of adhere to security policy, protect personal data, fraud/spam SMS, mobile application, and report for security incident. This research use analytic hierarcy process (AHP) method to measure the information security awareness level from smartphone users. In total, the result indicated that awareness level is good (80%). Although knowledge and attitude dimension are in good criteria of awareness level, but behaviour dimension is average. It can be a reason why there are still many information security breach against smartphone user despite good awareness level.

Smartphone information security awareness: A victim of operational pressures

Smartphone information security awareness describes the knowledge, attitude and behaviour that employees apply to the security of the organisational information that they access, process and store on their smartphone devices. The surge in the number of smartphone devices connecting to organisational systems and used to process organisational data has enabled a new level of operational efficiency. While employees are aware of the benefits they enjoy by bringing their personal devices into the workplace, managers too are aware of the benefits of having a constantly connected workforce. Unfortunately, those aware of the risks to information security do not share an equal level of enthusiasm. These devices are owned by employees who are not adequately skilled to configure the security settings for acceptable security of that information. Moreover, routine information security awareness programmes, even if applied, gradually fade into the daily rush of operations from the day they are completed.This paper explores the factors which influence these oscillating levels of information security awareness. By applying an adapted version of an awareness model from the domain of accident prevention, the factors which cause diminishing awareness levels are exposed. Subsequently, information security awareness emerges as a symptom of such factors. Through geometrical modelling of the boundaries and pressures that govern our daily operations, an awareness model emerges. This model ensures that organisations are better equipped to monitor their information security awareness position, their boundaries and the daily pressures affecting the organisation, thus allowing them to design better integrated policies and procedures to encourage safe operating limits. The model is evaluated using a theory evaluation framework through an expert review process.