Security Mindset Research Articles

On the factors of students' cybersecurity behavior

The article is an exploratory research on the security awareness of university students in the light of various sociodemographic factors. Information technology, and information security in particular, plays a critical role in this context. Awareness is a fundamental component of security preparedness because it empowers individuals to recognize and respond to security threats and fosters a security culture. By educating students and teachers about the importance of security and best practices, educational organizations can significantly enhance their overall security posture. The article points out that raising awareness of information security is not a simple task and requires a systematic approach. In this respect, education has both the potential and the responsibility to develop an information security mindset. The results of the article show that although the average response value of 3.735 suggests a security-aware attitude, the significant difference between the minimum and maximum values indicates a high variability. Looking in more detail at information security factors, the article reveals that law students are more cautious about protecting personal data, while IT and engineering students are more open to online banking and shopping.

SECURITY THINKING: THE UKRAINIAN CONTEXT

In an increasingly interconnected world, the security landscape has become exponentially more complex. Organizations and individuals face a myriad of threats, from sophisticated attacks to ever-evolving vulnerabilities. In order to successfully navigate this treacherous terrain, it is critical to develop a safety-focused mindset. Taking this proactive approach can pave the way for resilience to complexity, where strong defenses and adaptive strategies work in tandem to protect our security ecosystem. Security Thinking is a proactive approach to analyzing and addressing potential risks and vulnerabilities in order to enhance security measures. It involves a mindset that prioritizes prevention, preparedness, and adaptability to protect against various threats and challenges. Security Thinking encourages individuals and organizations to consider security implications at every level, from technology and processes to human behavior, promoting a resilient and secure environment. It is a continuous and dynamic process that seeks to stay ahead of emerging threats and evolve in response to changing security landscapes. At the same time, there is another definition. Security Mindset is an individual's or organization's way of thinking that places a strong emphasis on security and risk management. It involves being proactive in identifying potential threats, vulnerabilities, and weaknesses in systems, processes, and behaviors. Developing a security mindset is not an end point, but a continuous journey. Using intellectual rigor and an innovative spirit, you can significantly influence the formation of a security ecosystem. The principles of resilience to complexity and a holistic approach to security, guided by a security-centric mindset, are becoming a dynamic force in protecting the security ecosystem. By integrating physical security, modernized legislation, social engineering, data privacy protection and psychological security, we can build a fortress against a wide range of threats. However, the unprecedented challenges associated with Russia's full-scale war against Ukraine have significantly complicated the architecture of modern security, creating a need for the development of a new paradigm of security thinking and practical tools for its application.

Cultural Influences on Information Security

Humans are by far the weakest link in the information security chain. Many in the information security industry advocate for a technical solution to this problem. Unfortunately, technology does not hold the answer to solving the human problem. Instead, it is important to better understand the problem and find new ways of training individuals, so they have a better security mindset and make better security minded decisions. The security challenges associated with human factors have been widely studied in previous literature and different research groups. Prior research has shown that both human behavioural factors and social media usage factors can be used to better assess a person’s susceptibility to cybercrime. We know that humans are multi-faceted beings who are swayed by many factors. In addition to behavioural factors and social media factors, humans are predisposed by cultural influences. This paper begins the process of understanding how culture influences a person's ability to make positive cybersecurity decisions in a world that is full of data being thrown at them. The end goal of this research is to use culture, along with behaviour and social media usage as new metrics in measuring a person’s susceptibility to cybercrime. This information can then be used by information security practitioners and researchers to better prepare individuals to defend themselves from cyber threats. This paper is the start of the research process into how culture impacts a person’s susceptibility to cybercrime. It shows the significance of identifying what specific aspects of culture impact how someone makes a decision. This can help mitigate social engineering attacks by better understanding the influencing factors which control an end user. The authors will continue their work on this project to develop new Information Awareness (IA) training programmes that work to modify an individual's behaviour, while taking into consideration their behaviours, social media usage and culture.

Security Mindset Fundamentals and Second Language Learning

Security mindsets can be said to engage elements of situational awareness and analytical, creative, and practical elements of adversarial thinking. Scholars have debated whether this is taught or fostered, but they have acknowledged that security mindsets are critical. Here, the argument is made that implicit features of language itself can be drawn on in everyday K12+ second language (L2) learning settings to introduce members of the general populace and, among them, potential future members of the cybersecurity workforce, to security thinking. Beyond the features of language itself, L2 lessons can also be adapted to familiarize students with explicit security-related topics and scenarios. By exploiting these novel connections between language learning and security thinking, L2 learning contexts can become a security mindset training ground for millions of U.S. students.

DeepFakes- The Digital Threat in the Real World

Objectives: Understanding and Tackling the alarming surge of Digital Imposters known as the world of DeepFakes. 
 Methods: Using Artificial Intelligence based Deep Machine Learning software; Cyber Forensics; Physical mind awareness and alertness! Deepfakes use Artificial Intelligence and Deep Machine Learning techniques to make fake images, of people and events, which are as attractive/ authentic as the original. Deepfakes is the next big Challenge 
 in Cyber Security, taking the Security mindset to the next high level. Findings: On date we have no Specialized High-Tech support at hand to handle such an extremity. We can’t even imagine that if it was a crisis. The impact might be ruinous; it can be anything. In one of the recent live impersonation cases, A Mayor of Berlin thought he was having an online meeting with former boxing champion and current mayor of Kyiv, Vital Klitschko, but later on turned out to be a conversation with a deepfake, an AI generated fake videotape, looking real and authentic. Previous DeepFake videos had some tell-tale signs that a commodity/ person/ event wasn’t real; edit or odd movements. Not presently. In recent Delhi Elections, the BJP Candidate Mr. Manoj Tiwari fabricated his old speech on “Citizenship Amendment Act” into a political campaign speech to reach different linguistic voter bases, especially Haryanvi voters. Tiwari did not have any knowledge about Haryanvi, but made his political campaign message reach Haryanvi voters through DeepFake Technology. 
 Novelty: Massive Online Videos on Internet!

The security mindset: characteristics, development, and consequences

Abstract The world is facing a cybersecurity skills gap as cybercrime and cyberwarfare grow in importance. One often-discussed quality that is potentially relevant to cybersecurity recruitment and education is the so-called “security mindset”: a way of thinking characteristic of some security professionals that they believe to be especially advantageous in their work. Although some employers express a desire to hire people with a security mindset, and initiatives to cultivate the security mindset are being implemented, it has no common definition and little is known about its characteristics, its development, and its consequences. We interviewed 21 cybersecurity professionals who strongly identified as having a security mindset based on a minimal description drawn from existing literature. Thematic analysis of the interview data suggests that the security mindset can be conceptualized as consisting of three interconnected aspects—“monitoring” for potential security anomalies, “investigating” anomalies more deeply to identify security flaws, and “evaluating” the relevance of those flaws in a larger context. These three aspects develop in different ways and have different personal and professional consequences. Participants mostly spoke positively of the security mindset, but they also mentioned several disadvantages not mentioned by existing security-mindset literature, such as mental health pressures, workplace tensions, and negative effects on personal relationships. We discuss the implications of these findings for future study of the security mindset and suggest practical implications for cybersecurity management, education, and recruitment.

Exploration of the Impact of Cybersecurity Awareness on Small and Medium Enterprises (SMEs) in Wales Using Intelligent Software to Combat Cybercrime

Intelligent software packages have become fast-growing in popularity for large businesses in both developed and developing countries, due to their higher availability in detecting and preventing cybercrime. However, small and medium enterprises (SMEs) are showing prominent gaps in this adoption due to their level of awareness and knowledge towards cyber security and the security mindset. This is due to their priority of running their businesses over requiring using the right technology in protecting their data. This study explored how SMEs in Wales are handling cybercrime and managing their daily online activities the best they can, in keeping their data safe in tackling cyber threats. The sample collected consisted of 122 Welsh SME respondents in a collection of data through a survey questionnaire. The results and findings showed that there were large gaps in the awareness and knowledge of using intelligent software, in particular the uses of machine learning integration within their technology to track and combat complex cybercrime that perhaps would have been missed by standard cyber security software packages. The study’s findings showed that only 30% of the sampled SMEs understood the terminology of cyber security. The awareness of machine learning and its algorithms was also questioned in the implementation of their cyber security software packages. The study further highlighted that Welsh SMEs were unaware of what this software could do to protect their data. The findings in this paper also showed that various elements such as education and the size of SME made an impact on their choices for the right software packages being implemented, compared to elements such as age, gender, role and being a decision maker, having no impact on these choices. The study finally shares the investigations of various SME strategies to help understand the risks, and to be able to plan for future contingencies and preparation in keeping data safe and secure for the future.

The security mindset: Corrections officer workplace culture in late mass incarceration

Prison officers’ behavior is one of the most consequential features of the modern prison. In this article, we introduce an organizational culture conceptual framework and build on previous prison scholarship to develop a model of prison officer workplace culture. We then apply the proposed model to original research in a US prison to investigate the relational aspects of prison officer culture during early 21st-century penal reforms. We find a set of collective norms and beliefs among officers consistent with the “traditional” prison officer culture historically documented by penologists, including high levels of distrust of prisoners, avoidance of relationships, and distancing from rehabilitation goals. We name this culture the “security mindset” because officers use multiple conceptions of “security” to rationalize their behavior. Our findings suggest that prison officer culture in late mass incarceration may work against the positive and supportive relationships necessary for rehabilitation.

Restricted Data: The History of Nuclear Secrecy in the United States

Restricted Data: The History of Nuclear Secrecy in the United States

Using Complexity Theory to Identify K-12+ Pedagogical Misalignment With a Security Mindset

The current state of growing connectivity in society calls for a security mindset for K-12 and post-secondary (K-12+) populations. A security mindset offers an important approach to support security and can usefully be understood through the lens of complexity theory. Complexity theory also provides a helpful lens for identifying limitations inherent within some common pedagogical frameworks and practices in K-12+ education systems that may pose challenges for the cultivation of a security mindset. Hence, this paper brings awareness to examples of some of the most prominent pedagogical frameworks and practices that stand in potential misalignment with a security mindset when they are implemented in an imposing, monolithic manner. These include: rigid, prescriptive curricula; binary thinking, compliance, and standardized assessments; and disciplinary constraints. By identifying ways that common pedagogical practices stand to potentially undermine the cultivation of a security mindset, this paper contributes to clearing the way forward for K-12+ educational systems to design for emergence in support of building a more secure society.

Современные немецкие философские и социологические науки об «обществе риска»

The article is devoted to the analysis of the ideas of a number of Austrian and German social philosophers on the problem of social risk, its correlation with danger taking into account the time component of decisions made under conditions of uncertainty. At the same time, it is important for the author to establish clear criteria for distinguishing between what depends on the actions of the person or community and what does not. On the one hand, we can talk about the risk, both justified and unjustified, and on the other hand, we mention the danger. It is the danger that is the opposite of stability, and the risk implies both, new chances and dangers that occur if actions have side effects that were not foreseen by the initiators of the actions. The differences in risk management on the part of those who make decisions and those whose interests are affected by these decisions are also analyzed. While the former may consider the situation as risky, the latter as dangerous due to the fact, that they do not have the ability to influence social processes. However, if decision-makers spread knowledge about the danger, delegate some of the resources and powers to overcome risks to society, then it will gradually learn flexible risk management, which implies a variety (and not rigidly fixed) ways of behavior. The society will also be able to take into account the mobile nature of the border separating risky behavior from dangerous: in what conditions and for whom the risk is justified, and for whom and when the danger occurs. Competent risk management leads to an increase in the reflexivity of society, which implies the creation of a favorable social environment for the spread of creativity. At the same time, each individual faces the task of constantly finding himself and self-development. It is reflexivity and creativity that allow society to get out of the state of stagnation, which is characterized by the primacy of the security mindset.

Understanding developers’ privacy and security mindsets via climate theory

Understanding developers’ privacy and security mindsets via climate theory

CySecEscape 2.0—A Virtual Escape Room To Raise Cybersecurity Awareness

An increasing number of small and medium-sized enterprises (SMEs) use the Internet to support and grow businesses. The application of new technologies comes with inherent risks of ever-changing cyberspace and increasing cybercrime. Previous research has shown that the human factor remains the core element in the cybersecurity chain. Therefore, it is paramount that employees receive effective training to acquire a security mindset. This study puts forward previous research that resulted in a portable escape room game to raise cybersecurity awareness. The purpose of the study is to elaborate the transformation of the physical game into a virtual learning experience to increase flexibility in times such as the Covid-19 lockdown. As main method, we applied the design science framework of Hevner et al. As main result, the research elaborates the design of the developed artifact—a virtual prototype of the escape room game addressing the cybersecurity challenges of SMEs. For the evaluation of the prototype, empirical data was collected in qualitative and quantitative form. As main conclusions, we have observed that a physical escape room can be transformed into a virtual setting with little means without sacrificing player immersion. A limitation was identified in teaching targeted social engineering attacks.

The realist approach for evaluation of computational intelligence in software engineering

Secured software development must employ a security mindset across software engineering practices. Software security must be considered during the requirements phase so that it is included throughout the development phase. Do the requirements gathering team get the proper input from the technical team? This paper unearths some of the data sources buried within software development phases and describes the potential approaches to understand them. Concepts such as machine learning and deep learning are explored to understand the data sources and explore how these learnings can be provided to the requirements gathering team. This knowledge system will help bring objectivity in the conversations between the requirements gathering team and the customer's business team. A literature review is also done to secure requirements management and identify the possible gaps in providing future research direction to enhance our understanding. Feature engineering in the landscape of software development is explored to understand the data sources. Experts offer their insight on the root cause of the lack of security focus in requirements gathering practices. The core theme is statistical modeling of all the software artifacts that hold information related to the software development life cycle. Strengthening of some traditional methods like threat modeling is also a key area explored. Subjectivity involved in these approaches can be made more objective.

Openness and Security Thinking Characteristics for IoT Ecosystems

While security is often recognized as a top priority for organizations and a push for competitive advantage, repeatedly, Internet of Things (IoT) products have become a target of diverse security attacks. Thus, orchestrating smart services and devices in a more open, standardized and secure way in IoT environments is yet a desire as much as it is a challenge. In this paper, we propose a model for IoT practitioners and researchers, who can adopt a sound security thinking in parallel with open IoT technological developments. We present the state-of-the-art and an empirical study with IoT practitioners. These efforts have resulted in identifying a set of openness and security thinking criteria that are important to consider from an IoT ecosystem point of view. Openness in terms of open standards, data, APIs, processes, open source and open architectures (flexibility, customizability and extensibility aspects), by presenting security thinking tackled from a three-dimensional point of view (awareness, assessment and challenges) that highlight the need to develop an IoT security mindset. A novel model is conceptualized with those characteristics followed by several key aspects important to design and secure future IoT systems.

NATO enlargement and the failure of the cooperative security mindset

In the 1990s and 2000s, as NATO enlargement became a reality, scholars commented on the socializing influence of NATO, predicting a transformation of security identities. Was NATO successful in institutionalizing self-restraint and cooperative security among its new members and partners? We contend that it was successful so long as threats to transatlantic security remained low. When states perceive that the threat is increasing, however, more traditional conceptions of national identity displace the cooperative security model. While a great deal of institutional learning happened through the process of NATO accession and partnership building in the past two decades, the socialization process stopped short of transforming new members’ security mindsets. Our main contribution, then, is to provide an accurate picture of NATO’s influence in terms of reshaping the transatlantic security community and to analyze the different versions of NATO that were proposed in the post-Cold War era.

Signs your cyber security is doomed to fail

Cybercrime represents big money for cyber criminals. Unfortunately, that will likely equate to significant operational and financial losses for unprepared businesses. While most enterprises have come to terms with the fact that a future security incident is inevitable, many still struggle to translate this into the right security architecture and mindset. One of the reasons is that too many organisations buy into some persistent misconceptions regarding cyber security. They also make some basic errors in their attitudes towards the threats and how their organisations should deal with them. Marcus Chung of BoldCloud Looks at seven of the most common problems that could indicate your business is at risk.

How journalists understand the threats and opportunities of new technologies: A study of security mind-sets and its implications for press freedom

This is a study on digital security and press freedom, specifically the freedom from surveillance and the freedom to private and secure communication. We study journalists’ understanding and awareness of digital security practices: their perception of risks and threats of surveillance, and also their awareness of tools and techniques to communicate securely. Based on an empirical study of journalists in Hong Kong, including those who regularly travel to China for work, we build out a theoretical framework for understanding digital security mind-sets of journalists. We found differences in journalists’ behavior depending on how novice or advanced their understanding of digital security are. Journalists with a novice security mind-set will take different actions that produce different outcomes and behavior than those with an advanced security mind-set. We argue that journalists with an advanced security mind-set are able to work on a larger and wider range of (sensitive) stories, suggesting they enjoy a higher degree of press freedom.

Public diplomacy in army boots: the chronic failure of Israel’s Hasbara

Israel’s image in the world and its attempts at public diplomacy have always provoked intense discussion and criticism at home and abroad. Through analysis of reports, official documents, and protocols, this article shows how weaknesses in public policymaking undermine the establishment of Israel’s public diplomacy. Israel’s weakness in public policymaking and crisis of governance preclude the possibility of encompassing official measures for an efficient decision-making process, or for long-term strategic planning. This ‘institutional void’ is filled by the IDF, creating a process that causes the ‘security mindset’ to triumph over all other foreign policy factors. The outcome is a less effective Hasbara, which also affects broader diplomatic considerations.

Tightroping between APT and BCI in small enterprises

PurposeThe contemporary internet provisions increasingly sophisticated security attacks. Besides underlining the advanced nature of these attacks, the concept of an advanced persistent threat (APT) catalyzes the important perspective of longitudinal persistence; attacks are not only carefully planned and targeted but the subsequent exploitation period covers long periods of time. If an APT successfully realizes into such exploitation, information assets may be continuously monitored for harvesting business-critical information (BCI). These threats are relevant for the security of small enterprises, and this study aims to examine the qualitative factors that shape the security mindsets among these.Design/methodology/approachThe data are collected with semi-structured interviews of six enterprises in a small regional market segment. The analysis is based on a fourfold taxonomy that delivers three mindset profiles, while particular emphasis is placed on the subjective security notions that shape the typical strategizing among enterprises.FindingsAPT is poorly understood among the observed segment, which tends to often also explicitly downplay the strategic relevance of the concept, but a more pressing challenge relates to the observation that business data is often perceived to have no value. The delivered results can be used to improve the situation.Originality/valueThis study is among the firsts to explore perceptions of small enterprises toward APT and BCI. The results reveal problematic mindsets and offers new avenues for practitioners as well as academics to study and improve the situation.