A study of information security awareness and practices in Saudi Arabia

One of information security management elements is information security awareness program. Usually, this programs only involve the employees within the organization. Some organizations also consider security awareness for some parties outside the organization like providers, vendors, and contractors. This paper add consumers as variable to be considered in information security awareness program as there are also some threats for organization through them. Information security awareness will be measured from user’s knowledge, behavior, and attitude of five information security focus areas in telecommunication, especially related with smartphone users as one segment of telecommunication provider. For smartphone users, information security threats not only from Internet, but also by phone call or texting. Therefore, focus area in this research consist of adhere to security policy, protect personal data, fraud/spam SMS, mobile application, and report for security incident. This research use analytic hierarcy process (AHP) method to measure the information security awareness level from smartphone users. In total, the result indicated that awareness level is good (80%). Although knowledge and attitude dimension are in good criteria of awareness level, but behaviour dimension is average. It can be a reason why there are still many information security breach against smartphone user despite good awareness level.

Student awareness of information security (IS) ensures the security of students in the current technological era, but compliance with IS has not been fully carried out by students. This measurement of Information Security Awareness (ISA) is important to improve student understanding and long-term compliance that secures all aspects of devices, students, organizations, and schools. Using the Knowledge, Attitude, and Behavior model, this study aims to measure students' information security awareness. An online survey was conducted to evaluate student's information security awareness in 4 focus areas (passwords, internet safety, email safety, and digital payment) through the use of Likert scales. The overall awareness level of students was measured to be 73.79%, which is considered an average level of ISA. The awareness level of the password, internet safety, and email safety areas were average (69.19%, 71.31%, and 77.83% respectively, while the awareness level for the digital payment area was good at 80.35%. The Pearson's correlation coefficient (R) for the knowledge and behavior dimensions was 0.9497, indicating a strong positive correlation, while the coefficient for the attitude and behavior dimensions was 0.5428, indicating a moderate positive correlation. Thus, it can be recommended that awareness programs dedicated to raising ISA for students can focus on strengthening knowledge about IS so that students can exhibit good ISA behavior.

Technology is developing rapidly; its benefits are manifold. The development of technology, especially smartphones, Has become a part of everyday life that cannot be distinguished anymore. The increasing number of smartphone users has also impacted the rising information security and privacy cases caused by a lack of awareness of spam, malware, and phishing. Many users upload personal information such as photos, phone numbers, and addresses without antivirus protection. This study aims to identify security and privacy challenges in smartphone use by measuring problems in the dimensions of attitude (knowledge), knowledge (attitude), and behavior (behavior). There are five focus areas: Backdoor, hardware, and AndroidOS, which is still low compared to applications and permissions. The method used the Analytical Hierarchy Process (AHP) with the Fuzzy concept to measure the level of information security awareness of Malikussaleh University students who use Android phones. The results showed that the overall level of understanding was good (80%). Although the attitude and behavior dimensions showed good awareness, the knowledge dimension was moderate. This may be why information security breaches still often occur among Android phone users. Faculty of Economics, Less Aware: 23 people Unaware: 1 person. Faculty of Social and Political Sciences, Less Aware: 24 people. Faculty of Teacher Training and Education, Less Aware: 21 people. Faculty of Law, Less Aware: 24 people. Faculty of Medicine, Less Aware: 27 people and Aware: 3 people. Faculty of Agriculture, Less Aware: 30 people. Faculty of Informatics Engineering, Less Aware: 70 people and Aware: 5 people. Total Awareness, Less Aware: 199 people, nine people, and Unaware: 1 person.

Aim of this research to analysing the level of the information security awareness of the undergraduate economic information technology students after the information security course. The young generation use smartphones, tablets to keep in contact with friends at home, on public transport, in the school etc. They use different communication forms on the internet like social networks, chat rooms and so on. These applications are protected by password authentication system to keep save the data of the users. We were interested for which systems find the Economic information technology students important in everyday life and what kind of password use for protecting the information. We see almost in every month in the news a service provider was attacked again by hackers and the have put the username and the passwords on the Internet. The success of the attack depends on user error mainly. On the one hand this research is important to see how complicated passwords use the students after the information security course and on the other hand how they will protect the important information at the work. The students filled out an information security awareness questionnaire after the information security course. The students had to say, which communication systems are more important, how long password they are using by the most important systems like e-mail, community sites, and so on, how complicated is the used password, how often change the students these passwords. Are they using same passwords by different systems or one same password? After the analysis could we see how effective was the information security course for the economic information technology students. How could we build the information security awareness by them to help them to keep save the sensitive data?

Purpose The purpose of this study is to examine factors, which influence information security culture among employees of telecommunications companies. The motivation for this study was the rise in the number of data breach incidents caused by the organizations’ own employees. Design/methodology/approach A total of 139 usable responses were collected via a Web-based questionnaire survey from employees of Malaysian telecommunications companies. Data were analysed by using SmartPLS 3. Findings Security education, training and awareness (SETA) programmes and information security awareness were found to have a positive and significant impact on Information Security Culture. Additionally, self-reported employees’ security behaviour was found to act as a partial mediator on the relationship between information security awareness and information security culture. Research limitations/implications The study was cross-sectional in nature. Therefore, it could not measure changes in population over time. Practical implications The empirical data provides a new perspective on significant elements that influence information security culture in an emerging market. Organizations in the telecommunications industry can now recognize that SETA programmes and information security awareness have a significant impact on information security culture. Employees’ security behaviour also mediates the relationship between information security awareness and information security culture. Originality/value This is the first study to analyse the mediating effect of employees’ security behaviour on the relationship between information security awareness and information security culture in the Malaysian telecommunications context.

Purpose – The purpose of this paper was to analyse existing theories from the social sciences to gain a better understanding of factors which contribute to student mobile phone users’ poor information security behaviour. Two key aspects associated with information security behaviour were considered, namely, awareness and behavioural intent. This paper proposes that the knowing-and-doing gap can possibly be reduced by addressing both awareness and behavioural intent. This research paper explores the relationship between student mobile phone user information security awareness and behavioural intent in a developmental university in South Africa. Design/methodology/approach – Information security awareness interventions were implemented in this action research study, and student information security behavioural intent was observed after each cycle. Findings – The poor security behaviour exhibited by student mobile phone users, which was confirmed by the findings of this study, is of particular interest in the university context, as most undergraduate students are offered a computer-related course which covers certain information security-related principles. Existing researchers in the field of information security still grapple with the “knowing-and-doing” gap, where user information security knowledge/awareness sometimes does not result in safer behavioural practises. Originality/value – Zhang et al. (2009) suggest that understanding human behaviour is important when dealing with the problems caused by human errors. Harnesk and Lindstrom (2011) expressed a concern that existing research does not address the interlinked relationship between anticipated security behaviour and the enactment of security procedures. This study acknowledges Choi et al. (2008) contribution in their discussions on the “knowing-and-doing gap” suggests a link between awareness and actual behaviour that is confirmed by the findings of this study.

The abundance of information available through the internet, mobile applications, and cloud computing has made it convenient for users to access a wide range of data. However, this convenience comes at a cost, as this information is constantly at risk of being compromised by cybercriminals and hackers. While the recognition of potential information security dangers is increasing in developed countries, regions like Libya in North Africa still exhibit insufficient protection levels. The purpose of this study is to compare various factors that may influence or affect users' practices and awareness in home and work environments. Specifically, the factors investigated are policy, behavior, IT knowledge, and education. To achieve the study's goals, a quantitative methodology was employed, and a survey was created to assess the correlation between these key factors and security awareness and practices in home and workplace settings. The survey attracted 220 respondents and was analyzed using statistical methods to determine the relationship between the independent variables and the dependent variables. The results of this study indicate a moderate positive correlation between policy, IT knowledge, and education with security awareness and practice in both home and workplace environments. Only the behavior factor had a low correlation for home users. These findings indicate that the level of security awareness and practices at home and in the workplace is generally moderate. This study aims to serve as an initial step in emphasizing the importance of security training sessions for employees and highlighting the need to increase knowledge of information security. The findings are intended to inspire further research and focus on providing security information to the public, thereby disseminating new knowledge on the importance of security training and enhancing awareness of information security.

The focus of this research was to look into the information security awareness of Chinese university students during the COVID-19 pandemic and make recommendations based on the survey's findings and research literature. The quantitative method is applied in this study. 111 Chinese college students were randomly sampled and requested to answer a Likert information security awareness questionnaire. The descriptive analysis of the data in this study is also done with SPSS. The findings revealed that the vast majority of college students know the significance of information security awareness and have basic information security awareness, based on the data collected. However, some students have not participated in relevant training courses, and many college students do not pay enough attention to personal information security, resulting in poor performance in areas such as files and passwords. As a result, effective solutions such as information security training projects are required to address the current deficiencies. The findings of this study have implications for university administrators and policymakers in terms of how to raise students' awareness of the security of their online learning information. The study should use mixed methods and large sample sizes in the future to provide more detailed and comprehensive survey data, and more credible evidence of college students' information security awareness.

One of information security management elements is information security awareness program. Usually, this programs only involve the employees within the organization. Some organizations also consider security awareness for some parties outside the organization like providers, vendors, and contractors. This paper add consumers as variable to be considered in information security awareness program as there are also some threats for organization through them. Information security awareness will be measured from user's knowledge and behavior of five information security focus areas in telecommunication, especially related with smartphone users as one segment of telecommunication provider. In other researches, information security measurement from outside an organization is focused in Internet use by end-user. In telecommunication industry, information security threats for consumers not only from Internet, but also by phone call or texting. This research used CFA for data analysis method. The result showed that the indicators of knowledge dimension is not good enough to measure dimensions of knowledge where most of them are not significant. Meanwhile, behavior dimension gave different result with high significant value for measuring security awareness level. Indicators of behaviour dimension is good for measuring dimension of behaviour because only one indicator that isn't significant.

The role of human factors in employee information security awareness (ISA) has garnered increased attention, with many researchers highlighting a potential link between problematic technology use and poorer online safety and security. This study aimed to present additional evidence for this by exploring the relationship between of Fear of Missing Out (FoMO) and ISA in employees. A total of 718 participants completed an online questionnaire that included a measure of FoMO, ISA, as well as the Big Five personality inventory. Participants who reported higher levels of FoMO had lower overall ISA, as well as having poorer knowledge, a more negative attitude, and engaged in riskier behaviors in relation to ISA. FoMO was also demonstrated to be the largest single negative predictor for ISA, above that of age, gender, and the key personality traits tested. The potential reasons for the influence of FoMO over ISA are discussed, as well as the implications for organizational information security.

Exploring role of moral disengagement and counterproductive work behaviours in information security awareness.

In recent years, information security has gained significant academic attention. The present research sought to examine shifts in undergraduates' Information Security Awareness (ISA) as they advanced in their academic pursuits. Comprising two distinct phases, the initial phase involved adapting the Human Aspects of Information Security Questionnaire (HAIS-Q) to fit the context of Chinese tertiary institutions, a process overseen by five eminent ISA specialists. The adapted instrument was then piloted with 647 students, utilising snowball and criterion sampling techniques. Construct validity was established through exploratory factor analysis, and the questionnaire's reliability was ascertained via Cronbach's alpha. The subsequent primary survey engaged 5148 undergraduates from three Chinese academic institutions to further validate the instrument and investigate its relevance to student cohorts. Distinctively, participants exhibited pronounced proficiency in the Attitude component, yet lagged in Behavioural aspects. Analytical outcomes highlighted discernible interactions between gender, academic progression, and the Knowledge, Attitude, and Behaviour (KAB) facets. Notably, female respondents consistently outperformed their male counterparts. However, a marked decline in ISA cognisance and comportment was observed as students ascended academically. The HAIS-Q stands as a reliable tool for evaluating ISA in tertiary education, offering fresh insights to the scholarly discourse on educational information security.

Individual differences and Information Security Awareness

Information security issue becomes increasingly concerns in the current environment with fast development of information technology, in which most of the concerns are rising from legal and ethical aspect. It is always questioned that are individuals and organizations aware of information security and the relevant regulations. How would they act when encountering information security misuse? How much power do regulations and ethics have on restricting information security misuse? This research study will mainly analyse legal and ethical issues in information security including the public awareness of information security and their impact. We formed three hypotheses based on the relevant court case review and the related literature, and have discussed whether the hypotheses are supported or not and several interviews to the victim of information security victim.

The proliferation of online social media use amongst employees has been reported to be incriminating organizational information security. Despite the benefits of social media to organizations, there were cases of information leakage, malware, identity theft, espionage and sabotage through such use. This paper explores employees' awareness of information security around social media and presents the initial findings of a study on a tertiary education institution in Malaysia. As an extension to a previous study, this study also found that employees were not only disclosing personal information but they are also disclosing organizational information on social media. This indicates there is a potential for information security threats to organizations through employees' use of social media. Nevertheless, the findings demonstrate that some participants were aware about the implications of employees' use of social media to information security.