Security Awareness Research Articles

Information security in remote work: Strategies and challenges in a post-pandemic world

The increasing prevalence of remote work, accelerated by the COVID-19 pandemic, has brought significant information security challenges to organizations. While remote work offers numerous benefits such as flexibility and increased productivity, it also introduces unique risks, particularly in safeguarding sensitive data. The absence of traditional office security measures and reliance on potentially insecure home and public networks heighten these risks. Organizations must implement robust strategies, including the use of Virtual Private Networks (VPNs) and multi-factor authentication (MFA), to ensure secure communications and access to corporate systems. Additionally, the protection of devices used in remote work is critical, necessitating clear security policies, regular updates, and employee training on recognizing threats like phishing and malware. Studies by Kolomoets (2022) and Alsayfi and Alsirhani (2023) highlight the importance of addressing the increased risks associated with remote work, particularly the potential for data breaches due to the lack of direct access to comprehensive security controls. These studies recommend best practices such as secure password management and regular employee training to mitigate these threats. Tanriverdi and Metin (2021) emphasize the need for renewed focus on security awareness and behavior as remote work becomes the norm. Furthermore, Rakha (2023) explores the legal implications and best practices for maintaining cybersecurity in remote settings, while Livshitz (2022) focuses on data privacy challenges, providing insights into regulatory compliance and security audits. In conclusion, safeguarding information security in remote work environments requires a holistic approach that integrates technology, continuous education, and stringent security policies. Organizations must prioritize these efforts to protect sensitive data and maintain privacy in an increasingly remote workforce.

Quantitative Assessment of the Cybersecurity and Cybercrime Awareness among Postgraduate Commerce Students in the Coimbatore District, India

Aim: Key motive is to research the prevailing level of awareness level of commerce post graduate students on cyber crime and cyber security in their day-to-day life. Design/ Methodology/Approach: In the current research paper, data has been collected based on census method using high ended questionnaire from 178 M. Com students from University in Coimbatore district of Tamil Nādu in India. The accumulated information is further analyzed in testing their level of awareness using descriptive statistics and Anova to check the difference with respect to their demographics. The Researchers want to know how college students feel about being aware of cybercrime and cyber security so they are looking into that. Findings: The study has identified the factors for the level of awareness on cybercrime with 5 variables and cybersecurity with 6 variables. These variables have different perspective with respect to the demographic factors of the commerce post graduate students. Especially the Course of study and the year of study creates difference in the awareness level. Research Limitations: The study is a valuable understanding for the students in commerce stream at their post graduate level in knowing their level of understanding and awareness of cybercrimes and cyber security. This study has only focused on the commerce post graduate students of university and it is restricted to the Coimbatore district of Tamil Nādu alone. The results cannot be generalized commonly for the students in post-graduation. Originality: The study is original contribution to understand the awareness of commerce post graduate students in Tamil Nadu. It can be definitely used for further references in terms of level of awareness of students from different range or the study can be further expanded by the researchers and policy makers in developing the safety and awareness measures towards cybercrime and cybersecurity.

Raising Digital Security Awareness in the FinTech Sector: Case Studies and Defense Mechanisms

Raising Digital Security Awareness in the FinTech Sector: Case Studies and Defense Mechanisms

Issues of Cyber security and its solutions in Nepalese Context

In today's digital age, the internet's expansion has brought great convenience but also raised cyber threats. So, identify the issue of cyber-security and its solution in Nepalese context is significant. Descriptive design and qualitative methods were employed, with data sourced from Google Scholar and analyzed through thematic analysis. The study shows a myriad of issues stemming from inadequate cyber security awareness in Nepal, including increased vulnerability to cyber-attacks, data breaches, and societal, economic, and regulatory consequences. Bridging the gap in cyber security awareness is imperative to mitigate risks effectively and foster a secure digital environment in Nepal. Strategies emphasizing education, training, and regulatory frameworks are vital for addressing these challenges and promoting technological advancement and societal trust. This study proposes AI-driven solutions to address the lack of cyber security awareness in the Nepalese context, offering a unique approach to mitigate cyber threats and foster a secure digital environment.

The tale of crying rice: Indonesian fairy tale to enhance food security awareness by early age.

The tale of crying rice: Indonesian fairy tale to enhance food security awareness by early age.

The Impact of Internet Security Awareness among Undergraduates in Learning Management System

The Impact of Internet Security Awareness among Undergraduates in Learning Management System

Characteristics, Causes and Countermeasures for Victims of Financial Fraud

With the rapid development of Internet technology and the increasing popularity of smart phone applications, the problem of financial fraud has become increasingly prominent, and people of different ages are at risk, which has caused serious impact on society. Victims of financial fraud are usually affected by herd mentality, loss aversion, confirmation bias, etc., while scammers use false publicity to induce investors to make their assets suffer losses. After in-depth analysis of the causes of fraud, this study believes that improving public financial literacy and strengthening financial education become the key to prevent fraud in the whole society. Specifically, college students should deepen their understanding of financial knowledge, and middle-aged and elderly people should improve their awareness of network security and basic knowledge of financial management. Through in-depth research and comprehensive policies, it is expected to build a safe and honest financial environment, ensure the property safety of people of all ages, and promote stable and healthy economic development.

Behind the digital veil: decoding the influence of HR training on information security awareness in Saudi Arabia

Behind the digital veil: decoding the influence of HR training on information security awareness in Saudi Arabia

Exploring Libyan Higher Education Institutions Employees’ Information Security Policy Awareness

Incidents of data breach in higher education could harm students since the exposure of sensitive student data (e.g., social security numbers) could twist students into victims of identity theft and endanger their identities. Regrettably, while most of the developed countries have standard information security laws apply to higher education institutions, such laws are still in its infant stage in developing countries like Libya. However, there are established policies documented by Libyan authorities to guide employees against information security breach, yet existing higher education institutions’ information security awareness models did not investigate these policies into the awareness programs. Consequently, employees will rely on policies that can subvert the security best practice. This study aimed to explore the level of understanding of Libyan information security policies among employees of higher education institutions. The quantitative technique is applied in this research, 196 employees of Libyan higher education institutions were randomly surveyed to respond to Linker information security policy awareness questionnaire. Using SPSS statistics tools, a descriptive analysis of the data is achieved. The findings of the study revealed that employees of Libyan higher education institutions are much aware of Internet Usage and Workstation security policies.

Individual Differences in Psychological Stress Associated with Data Breach Experiences

Data breach incidents are now a regular occurrence, with millions of people affected worldwide. Few studies have examined the psychological aspects of data breach experiences, however, or the individual differences that influence how people react to these events. In this study, we examined the psychological stress associated with a personal experience with a data breach and several individual differences hypothesized to modulate such stress (age, gender, digital security awareness and expertise, trait anxiety, negative emotionality, and propensity to worry). A student sample (N = 166) and a community sample (N = 359) completed an online survey that asked participants to describe their most serious data breach and then complete the Impact of Events Scale—Revised (IES-R) to answer specific questions about the nature of the stress they experienced after the breach. Standard measures of trait anxiety, negative emotionality, and propensity to worry were also completed. A Data Breach Severity Index (DBSI) was created to quantify the invasiveness and consequences of each participant’s data breach. Hierarchical multiple regression analyses were used to identify demographic variables and psychological characteristics predictive of IES-R scores while controlling for DBSI scores. As expected, more invasive and consequential data breaches were associated with higher IES-R scores (greater data-breach-induced stress). Women had higher IES-R scores than men, and this difference persisted after controlling for gender differences in anxiety, negative emotionality, and propensity to worry. Greater daily social media use was associated with higher IES-R scores, whereas higher digital security expertise was associated with lower IES-R scores. The results illuminate several relationships between demographic and psychological characteristics and data-breach-induced stress that should be investigated further.

Impact of information security awareness on information security compliance of academic library staff in Türkiye

Information security compliance means that library staff follows the rules, guidelines, and principles related to information security and implements the security measures provided in the library. This ensures the protection of sensitive information stored and processed in the library environment. This study examined the impact of information security awareness in academic libraries on information security compliance. In a descriptive survey design adopted in the study, the survey data of 136 personnel working in academic libraries in Türkiye were analysed. The findings revealed that information security awareness has a positive and significant impact on information security compliance (R2 = 0.983, β = 0.991, t(136) = 19.267, p < 0.05). The study concluded that information security awareness is necessary to ensure information security compliance in academic libraries. Consequently, there is a clear need for policy and training programs to enhance information security awareness and compliance among academic library staff. The findings of this study will not only contribute to the literature in the field of information security but also provide an important foundation for improving practices in this area. Therefore, it is important for academic libraries to develop effective policies and training programs to increase awareness of information security and promote staff compliance.

Implementing Privacy Preserving Techniques in Distributed Big Data Framework on Cloud Computing

Cloud-based deployment architectures have emerged as the preferred model for Big Data operations due to their scalability, flexibility, and cost-effectiveness. However, this shift raises new security concerns as data is no longer directly under the user's control. Securing Big Data in cloud environments is crucial for widespread adoption, but developing a comprehensive security plan is challenging without a thorough analysis of potential vulnerabilities.To address this, a novel security-by-design framework for Big Data deployment on cloud computing, termed Big Cloud, is proposed in this article. The framework leverages systematic security analysis methodologies and automated assessment tools to map domain-specific security knowledge to design best practices. Validation of the framework was conducted through an Apache Hadoop stack use case, demonstrating its effectiveness in enhancing security awareness and reducing design time.The study also evaluates the framework's strengths and limitations, identifying key challenges in the Big Cloud domain.

Understanding information security awareness: evidence from the public healthcare sector

Understanding information security awareness: evidence from the public healthcare sector

Influence of Organizational Security Learning Practices on Insider Security Threats in SoCs in Kenya

Insider threats have consistently been identified as key threats to State-owned Corporations and governments (SoCs). Research has shown that huge amounts of resources go towards safeguarding organizations’ assets and information systems from external threats in total disregard of potential threats from malicious and compromised insiders. Recent studies indicate that insider threats are on the rise and have cost the Kenyan economy $ 36Million USD. In addition, investigations show that these threats are increasing in scale, scope, and sophistication. The general objective of the study was to investigate on the organizational factors influencing insider security threats in State-owned Corporations in Kenya. Specifically, the study evaluated the influence of organizational security policies, organizational security learning practices and organizational communication practices on insider security threats in State-owned Corporations in Kenya. The study was anchored on the CISA Insider Threats Risk Score Model, deterrence theory, social learning theory and the communication privacy management theory. The study adopted descriptive correlational research design. The target population was 187 State-owned Corporations in Kenya. A census sampling design was used targeting the Security managers or their equivalent in SoCs. The researcher utilized a self-administered questionnaire as the data collection method. Data was analysed through quantitative techniques using the SPSS. The study established that organizational security policies have significant influence on insider security threats in SoCs in Kenya. The study also established that organizational security learning practices have significant influence on insider security threats in SoCs in Kenya. In addition, the study revealed that organizational communication practices have significant influence on insider security threats in SoCs in Kenya. The study also deduced that the combined influence of organizational security policies, learning practices and communication practices (organizational factors) significantly influence insider security threats in SoCs in Kenya. The study recommends that SoCs consider conducting a comprehensive review of their existing security policies, ensuring clarity on the severity of consequences for insider threats. Further, the study recommends that SoCs work on strengthening their learning policies to emphasize the importance of observational learning, role modeling, and positive reinforcement in the context of security awareness to address insider security threats. Additionally, the study recommends that SoCs provide training programs that emphasize effective communication practices surrounding privacy management.

Prevent or Promote? CEO Regulatory Focus, Data Breach, and Corporate Information Security Awareness

Prevent or Promote? CEO Regulatory Focus, Data Breach, and Corporate Information Security Awareness

Analysis of Measuring Information Security Awareness for Employees at Institution XYZ

As a government institution in the field of civil servant management, XYZ Institution has data on 4.4 million Employees spread throughout Indonesia which needs to be maintained. Based on the BSSN report, there has been a significant increase in potential threats in recent years and is expected to continue in 2024, one of which is the threat of Phishing. This research was conducted to measure the level of information security awareness (ISA) for employees at xyz institution. Phishing simulations and questionnaires are used to measure the level of ISA and how to provide ISA education so that it can increase the level of ISA employees. Simulation results will be compared before and after the provision of ISA education. The results of providing education have a positive impact for employees. Simulation before providing education there were 65% of employees clicking on phishing urls and after education there was a decrease to 17%. While employees who were exposed to phishing before education were 33% and after education there was a decrease to 16%. In addition, the questionnaire filled out by 150 employees showed results with a value of 86.54% for the level of ISA employee, which is in the good category

Measuring Information Security Awareness Level of High School Students

Information security awareness has become a crucial factor in the current advancement of information technology. Information security awareness is one of the key factors in avoiding crimes in the digital world today. Therefore, this research aims to measure the information security awareness level and provide recommendations to enhance the information security awareness of high school students. The research instrument utilized in this study is the Human Aspect Information Security Questionnaire (HAIS-Q) and focus area weighting was conducted using the Analytic Hierarchy Process (AHP) method. Data was collected through questionnaires distributed to 99 respondents, and the weighting was performed by two experts in the field of information security and one high school teacher. The results indicated a total awareness level of 86,38%, categorized as "Good", with the most vulnerable focus area being password management. Based on these findings, recommendations are provided in this research to enhance information security awareness.

Factors Influencing Information Security Policy Compliance Behavior in High Education Institutions: Systematic Literature Review

Information security policies and behaviors play a crucial role in organizations, particularly in higher education institutions. These policies outline guidelines and best practices to protect sensitive data, safeguard privacy, and prevent unauthorized access or misuse of information. In higher education institutions, they help secure research findings, intellectual property, and student records. By fostering a culture of security awareness and encouraging responsible behavior, organizations can safeguard their reputation, instill trust, and meet legal and regulatory requirements. This literature review has revealed challenges and highlighted the current trends of information security policy compliance, as well as the theories used for information security compliance from 2013 to 2023. Out of 50 research papers published on the topic of information security policy compliance, three influencing factors were identified through filtration: behavioral intention, awareness and culture, and human with organizational management. The findings show that there is a lack of information security policies in the higher education sector. This review contributes to the information security literature by providing a fully organized systematic review of conducted research in the last decade.

Educating University Students on Information Security Awareness: A Smartphone Perspective

Educating University Students on Information Security Awareness: A Smartphone Perspective

Human Firewall Simulator for Enhancing Security Awareness against Business Email Compromise

Chief executive officers (CEOs) can turn out to be the weakest link to an organization’s security and attackers know that if they successfully exploit or impersonate someone who has a high level of access like CEOs or chief finance officers (CFOs), they instantly gain great advantage. The problem comes when attacker manages to take control of email accounts of the CEOs and CFOs and sends an email to another staff in the organization, he/she is likely to take it seriously, act accordingly and quickly as possible, and may be wire cash to an account directed by the “CEO/CFO,” and/or get away with private or sensitive corporate information. Because of the nature of these attack methods, detection and protection are very difficult since the attackers take advantage of the human weakness which is the weakest link. The main aim of this study is to provide a solution to protect every surface of the organization. By developing a human firewall, working with the already existing technical solutions offers the solution to remaining problem of human weakness. This research developed a simulator to train the users with the latest trends the attackers are using making them do it right (flagging, reporting, not clicking suspicions links) and making email security part of their responsibility. This makes employee become human firewall. The results from the simulator are displayed in charts as number of employees who passed the test, number of employees who will click on the malicious links, number of employees who will download the dangerous attachments, number of employees who will reply to phishing emails, average awareness of the organization, and how individual employees performed. While organizations have made progress over the years, security is a never-ending process that requires improvement day by day. Since no one in the organization’s structure is immune including the top most in the cadre (i.e., CEO), complexity in understanding and awareness creation is more wanting than before. Integrating human firewall into existing security measures as the last line of defense in email communication against business email compromise frauds offers this solution because it has preventive as well as reactive measures both geared toward maximizing email security. A simulation of the attacks to analyze the user involvement to breaching the security followed by an evaluation simulation after integrating human firewall to the organization’s email security shows success level. The results from the test show the different success levels, that is, results from pre-assessment definitely show low success level since staff/employees have not been made aware/trained to profile or flag compared to when the employees/staff have gone through the training/awareness. Post-assessment indicates high success level because actions from employees turned into human firewall know how to take proper action, for example, flagging, not clicking malicious links. The organization should update its policies to accommodate and reinforce rules on the employees to ensure that the tool is used regularly and actions taken on user deemed a threat to the organizational email security.