Assessing Students’ Information Security Awareness through the Knowledge, Attitude, and Behavior Model

One of information security management elements is information security awareness program. Usually, this programs only involve the employees within the organization. Some organizations also consider security awareness for some parties outside the organization like providers, vendors, and contractors. This paper add consumers as variable to be considered in information security awareness program as there are also some threats for organization through them. Information security awareness will be measured from user’s knowledge, behavior, and attitude of five information security focus areas in telecommunication, especially related with smartphone users as one segment of telecommunication provider. For smartphone users, information security threats not only from Internet, but also by phone call or texting. Therefore, focus area in this research consist of adhere to security policy, protect personal data, fraud/spam SMS, mobile application, and report for security incident. This research use analytic hierarcy process (AHP) method to measure the information security awareness level from smartphone users. In total, the result indicated that awareness level is good (80%). Although knowledge and attitude dimension are in good criteria of awareness level, but behaviour dimension is average. It can be a reason why there are still many information security breach against smartphone user despite good awareness level.

One of information security management elements is information security awareness program. Usually, this programs only involve the employees within the organization. Some organizations also consider security awareness for some parties outside the organization like providers, vendors, and contractors. This paper add consumers as variable to be considered in information security awareness program as there are also some threats for organization through them. Information security awareness will be measured from user's knowledge and behavior of five information security focus areas in telecommunication, especially related with smartphone users as one segment of telecommunication provider. In other researches, information security measurement from outside an organization is focused in Internet use by end-user. In telecommunication industry, information security threats for consumers not only from Internet, but also by phone call or texting. This research used CFA for data analysis method. The result showed that the indicators of knowledge dimension is not good enough to measure dimensions of knowledge where most of them are not significant. Meanwhile, behavior dimension gave different result with high significant value for measuring security awareness level. Indicators of behaviour dimension is good for measuring dimension of behaviour because only one indicator that isn't significant.

Purpose The purpose of this study is to examine factors, which influence information security culture among employees of telecommunications companies. The motivation for this study was the rise in the number of data breach incidents caused by the organizations’ own employees. Design/methodology/approach A total of 139 usable responses were collected via a Web-based questionnaire survey from employees of Malaysian telecommunications companies. Data were analysed by using SmartPLS 3. Findings Security education, training and awareness (SETA) programmes and information security awareness were found to have a positive and significant impact on Information Security Culture. Additionally, self-reported employees’ security behaviour was found to act as a partial mediator on the relationship between information security awareness and information security culture. Research limitations/implications The study was cross-sectional in nature. Therefore, it could not measure changes in population over time. Practical implications The empirical data provides a new perspective on significant elements that influence information security culture in an emerging market. Organizations in the telecommunications industry can now recognize that SETA programmes and information security awareness have a significant impact on information security culture. Employees’ security behaviour also mediates the relationship between information security awareness and information security culture. Originality/value This is the first study to analyse the mediating effect of employees’ security behaviour on the relationship between information security awareness and information security culture in the Malaysian telecommunications context.

The focus of this research was to look into the information security awareness of Chinese university students during the COVID-19 pandemic and make recommendations based on the survey's findings and research literature. The quantitative method is applied in this study. 111 Chinese college students were randomly sampled and requested to answer a Likert information security awareness questionnaire. The descriptive analysis of the data in this study is also done with SPSS. The findings revealed that the vast majority of college students know the significance of information security awareness and have basic information security awareness, based on the data collected. However, some students have not participated in relevant training courses, and many college students do not pay enough attention to personal information security, resulting in poor performance in areas such as files and passwords. As a result, effective solutions such as information security training projects are required to address the current deficiencies. The findings of this study have implications for university administrators and policymakers in terms of how to raise students' awareness of the security of their online learning information. The study should use mixed methods and large sample sizes in the future to provide more detailed and comprehensive survey data, and more credible evidence of college students' information security awareness.

Information security issue becomes increasingly concerns in the current environment with fast development of information technology, in which most of the concerns are rising from legal and ethical aspect. It is always questioned that are individuals and organizations aware of information security and the relevant regulations. How would they act when encountering information security misuse? How much power do regulations and ethics have on restricting information security misuse? This research study will mainly analyse legal and ethical issues in information security including the public awareness of information security and their impact. We formed three hypotheses based on the relevant court case review and the related literature, and have discussed whether the hypotheses are supported or not and several interviews to the victim of information security victim.

Although the Web, cell phone `apps' and cloud computing put a world of information at our fingertips, that information is under constant threat from cyber vandals and hackers. While awareness of information threats is growing in the Western world, in places like Saudi Arabia, information security is very poor. Unlike Western pluralistic democracies, Saudi Arabia is a highly-censored country, with a patriarchical and tribal culture, which may influence its poor information security rating. This paper examines the level of information security awareness (ISA) among the general public in Saudi Arabia, using an anonymous online survey, based on instruments produced by the Malaysian Cyber Security Organization and KPMG. The survey attracted 633 respondents and the results confirmed that ISA in Saudi Arabia is quite low. Several of the areas of weakness in ISA appear to be related to the level of censorship or the patriarchical and tribal nature of Saudi culture.

Contextual security awareness: A context-based approach for assessing the security awareness of users

The proliferation of online social media use amongst employees has been reported to be incriminating organizational information security. Despite the benefits of social media to organizations, there were cases of information leakage, malware, identity theft, espionage and sabotage through such use. This paper explores employees' awareness of information security around social media and presents the initial findings of a study on a tertiary education institution in Malaysia. As an extension to a previous study, this study also found that employees were not only disclosing personal information but they are also disclosing organizational information on social media. This indicates there is a potential for information security threats to organizations through employees' use of social media. Nevertheless, the findings demonstrate that some participants were aware about the implications of employees' use of social media to information security.

The role of human factors in employee information security awareness (ISA) has garnered increased attention, with many researchers highlighting a potential link between problematic technology use and poorer online safety and security. This study aimed to present additional evidence for this by exploring the relationship between of Fear of Missing Out (FoMO) and ISA in employees. A total of 718 participants completed an online questionnaire that included a measure of FoMO, ISA, as well as the Big Five personality inventory. Participants who reported higher levels of FoMO had lower overall ISA, as well as having poorer knowledge, a more negative attitude, and engaged in riskier behaviors in relation to ISA. FoMO was also demonstrated to be the largest single negative predictor for ISA, above that of age, gender, and the key personality traits tested. The potential reasons for the influence of FoMO over ISA are discussed, as well as the implications for organizational information security.

Exploring role of moral disengagement and counterproductive work behaviours in information security awareness.

Aim of this research to analysing the level of the information security awareness of the undergraduate economic information technology students after the information security course. The young generation use smartphones, tablets to keep in contact with friends at home, on public transport, in the school etc. They use different communication forms on the internet like social networks, chat rooms and so on. These applications are protected by password authentication system to keep save the data of the users. We were interested for which systems find the Economic information technology students important in everyday life and what kind of password use for protecting the information. We see almost in every month in the news a service provider was attacked again by hackers and the have put the username and the passwords on the Internet. The success of the attack depends on user error mainly. On the one hand this research is important to see how complicated passwords use the students after the information security course and on the other hand how they will protect the important information at the work. The students filled out an information security awareness questionnaire after the information security course. The students had to say, which communication systems are more important, how long password they are using by the most important systems like e-mail, community sites, and so on, how complicated is the used password, how often change the students these passwords. Are they using same passwords by different systems or one same password? After the analysis could we see how effective was the information security course for the economic information technology students. How could we build the information security awareness by them to help them to keep save the sensitive data?

The purpose of this study is to contribute to creating awareness of information security requirements in customized health applications. The study refers to how developing mobile applications affect information security in accordance with the developments in health informatics and evaluates the aspects of network and information security in the health-related systems as well as attacks and types of attacks. Today, health information systems are modeled in integrated systems as application, control, tracking and warning systems. These systems have been turning into systems that collect private information as long as they have patients on one side. With this approach, the concept of mobility has become a must in systems because of the patient. Data communication can be performed from machine to machine (M2M) between the systems without the human factor. This ensures the communication of accurate and timely data. This study contributes to health administrators’ awareness of information security in health with a different point of view.

In recent years, information security has gained significant academic attention. The present research sought to examine shifts in undergraduates' Information Security Awareness (ISA) as they advanced in their academic pursuits. Comprising two distinct phases, the initial phase involved adapting the Human Aspects of Information Security Questionnaire (HAIS-Q) to fit the context of Chinese tertiary institutions, a process overseen by five eminent ISA specialists. The adapted instrument was then piloted with 647 students, utilising snowball and criterion sampling techniques. Construct validity was established through exploratory factor analysis, and the questionnaire's reliability was ascertained via Cronbach's alpha. The subsequent primary survey engaged 5148 undergraduates from three Chinese academic institutions to further validate the instrument and investigate its relevance to student cohorts. Distinctively, participants exhibited pronounced proficiency in the Attitude component, yet lagged in Behavioural aspects. Analytical outcomes highlighted discernible interactions between gender, academic progression, and the Knowledge, Attitude, and Behaviour (KAB) facets. Notably, female respondents consistently outperformed their male counterparts. However, a marked decline in ISA cognisance and comportment was observed as students ascended academically. The HAIS-Q stands as a reliable tool for evaluating ISA in tertiary education, offering fresh insights to the scholarly discourse on educational information security.

Individual differences and Information Security Awareness

The protection of assets of organizations became one of the major aspects that organizations have to deal with. The issue is too serious when it comes to financial organizations due to their sensitivity to data security attacks. Security breach incidents can happen in an organization no matter how well the technology is protected. The main reason for this is employees' improper conduct or lack of action that leads to the majority of information security incidents. Educating employees to improve information security awareness plays a significant part in securing organizational environments. Although, best practice, standards provide a set of minimum information security awareness controls that should implement. This study proposes an information security awareness training program to improve knowledge of information security and improves employee behavior for a private financial organization in Libya.