Information security awareness measurement with confirmatory factor analysis

One of information security management elements is information security awareness program. Usually, this programs only involve the employees within the organization. Some organizations also consider security awareness for some parties outside the organization like providers, vendors, and contractors. This paper add consumers as variable to be considered in information security awareness program as there are also some threats for organization through them. Information security awareness will be measured from user’s knowledge, behavior, and attitude of five information security focus areas in telecommunication, especially related with smartphone users as one segment of telecommunication provider. For smartphone users, information security threats not only from Internet, but also by phone call or texting. Therefore, focus area in this research consist of adhere to security policy, protect personal data, fraud/spam SMS, mobile application, and report for security incident. This research use analytic hierarcy process (AHP) method to measure the information security awareness level from smartphone users. In total, the result indicated that awareness level is good (80%). Although knowledge and attitude dimension are in good criteria of awareness level, but behaviour dimension is average. It can be a reason why there are still many information security breach against smartphone user despite good awareness level.

Technology is changing the way we work more than ever before. Therefore, it is critical to understand the security threats associated with these advanced tools to protect systems and data. Security is a combination of people, processes, and technology. Thus, to counter cyber-threats effectively, information security awareness (ISA) programs are an essential cornerstone of enterprise security. There are many ways in which information security knowledge can be delivered. In this paper, we have conducted an experiment to test the impact of multiple intervention strategies on knowledge, attitude, and behavior. The HAIS-Q was used to evaluate the effectiveness of training methods on the employees. Our study suggests that all the methods raised knowledge equivalently. However, having more than one delivery method to convey the same message had more impact on users’ attitudes. When it comes to behavioral change, however, text-based and game-based training formats performed better than their counterparts. Additionally, employees’ tendency in engaging in self-education activities and participating in future awareness programs were influenced by the intervention strategy. These findings have important implications, as ISA programs should be designed in a way that positively influences the mindset of employees and motivates them to embrace security practices in their daily activities.

Purpose The purpose of this study is to examine factors, which influence information security culture among employees of telecommunications companies. The motivation for this study was the rise in the number of data breach incidents caused by the organizations’ own employees. Design/methodology/approach A total of 139 usable responses were collected via a Web-based questionnaire survey from employees of Malaysian telecommunications companies. Data were analysed by using SmartPLS 3. Findings Security education, training and awareness (SETA) programmes and information security awareness were found to have a positive and significant impact on Information Security Culture. Additionally, self-reported employees’ security behaviour was found to act as a partial mediator on the relationship between information security awareness and information security culture. Research limitations/implications The study was cross-sectional in nature. Therefore, it could not measure changes in population over time. Practical implications The empirical data provides a new perspective on significant elements that influence information security culture in an emerging market. Organizations in the telecommunications industry can now recognize that SETA programmes and information security awareness have a significant impact on information security culture. Employees’ security behaviour also mediates the relationship between information security awareness and information security culture. Originality/value This is the first study to analyse the mediating effect of employees’ security behaviour on the relationship between information security awareness and information security culture in the Malaysian telecommunications context.

The Human Aspects of Information Security Questionnaire (HAIS-Q) is designed to measure Information Security Awareness. More specifically, the tool measures an individual’s knowledge, attitude, and self-reported behaviour relating to information security in the workplace. This paper reports on the reliability of the HAIS-Q, including test-retest reliability and internal consistency. The paper also assesses the reliability of three preliminary over-claiming items, designed specifically to complement the HAIS-Q, and identify those individuals who provide socially desirable responses. A total of 197 working Australians completed two iterations of the HAIS-Q and the over-claiming items, approximately 4 weeks apart. Results of the analysis showed that the HAIS-Q was externally reliable and internally consistent. Therefore, the HAIS-Q can be used to reliably measure information security awareness. Reliability testing on the preliminary over-claiming items was not as robust and further development is required and recommended. The implications of these findings mean that organisations can confidently use the HAIS-Q to not only measure the current state of employee information security awareness within their organisation, but they can also measure the effectiveness and impacts of training interventions, information security awareness programs and campaigns. The influence of cultural changes and the effect of security incidents can also be assessed.

Student awareness of information security (IS) ensures the security of students in the current technological era, but compliance with IS has not been fully carried out by students. This measurement of Information Security Awareness (ISA) is important to improve student understanding and long-term compliance that secures all aspects of devices, students, organizations, and schools. Using the Knowledge, Attitude, and Behavior model, this study aims to measure students' information security awareness. An online survey was conducted to evaluate student's information security awareness in 4 focus areas (passwords, internet safety, email safety, and digital payment) through the use of Likert scales. The overall awareness level of students was measured to be 73.79%, which is considered an average level of ISA. The awareness level of the password, internet safety, and email safety areas were average (69.19%, 71.31%, and 77.83% respectively, while the awareness level for the digital payment area was good at 80.35%. The Pearson's correlation coefficient (R) for the knowledge and behavior dimensions was 0.9497, indicating a strong positive correlation, while the coefficient for the attitude and behavior dimensions was 0.5428, indicating a moderate positive correlation. Thus, it can be recommended that awareness programs dedicated to raising ISA for students can focus on strengthening knowledge about IS so that students can exhibit good ISA behavior.

Information security attacks targeting human nature, such as phishing, are rising rapidly. Information security Awareness (ISA) programs have been proven to be valuable proactive measures that increase Return On Investment (ROI) regarding information security enhancement. These programs tend to focus on concepts and technical aspects. Although these customary instruction methodologies have their preferences, trainees can additionally take advantage of educational techniques that are more intuitive and situation driven. This study aims to increase the efficiency of learning in such programmes by using design science to create an artefact for learning and then testing the acquired knowledge. Design science will be used as a research method. The creative method, a brainstorming technique, and five steps in design science are performed: explicate the problem, define requirements, design and develop artefact, demonstrate artefact, and evaluate artefact to develop a process framework to respond to this problem. The problem is explicated with a literature review and the requirements to be met by Game-Based Learning (GBL) are set. The first artefact, which is an interactive book support quizzes, crossword puzzles, multimedia such as video, and “complete the word” simple games that enhance the learning process. The second artefact is a printed board game with hackers and cards with the goal to support the learning process and assess the ability of the participants to respond and take actions based on this new knowledge. At last, limitations that exist in security education such as lack of user-centered modules and limited guidelines from learning theories are elaborated and future work is also presented.

The focus of this research was to look into the information security awareness of Chinese university students during the COVID-19 pandemic and make recommendations based on the survey's findings and research literature. The quantitative method is applied in this study. 111 Chinese college students were randomly sampled and requested to answer a Likert information security awareness questionnaire. The descriptive analysis of the data in this study is also done with SPSS. The findings revealed that the vast majority of college students know the significance of information security awareness and have basic information security awareness, based on the data collected. However, some students have not participated in relevant training courses, and many college students do not pay enough attention to personal information security, resulting in poor performance in areas such as files and passwords. As a result, effective solutions such as information security training projects are required to address the current deficiencies. The findings of this study have implications for university administrators and policymakers in terms of how to raise students' awareness of the security of their online learning information. The study should use mixed methods and large sample sizes in the future to provide more detailed and comprehensive survey data, and more credible evidence of college students' information security awareness.

Information security issue becomes increasingly concerns in the current environment with fast development of information technology, in which most of the concerns are rising from legal and ethical aspect. It is always questioned that are individuals and organizations aware of information security and the relevant regulations. How would they act when encountering information security misuse? How much power do regulations and ethics have on restricting information security misuse? This research study will mainly analyse legal and ethical issues in information security including the public awareness of information security and their impact. We formed three hypotheses based on the relevant court case review and the related literature, and have discussed whether the hypotheses are supported or not and several interviews to the victim of information security victim.

The human aspect is one of the key success factors in information security (InfoSec). Its impact on InfoSec is so significant that multiple studies have shown that a balanced approach combining technology and security awareness is needed in order to maintain the integrity of an organisation’s security. At present, one of the methods most often used to address InfoSec awareness is to develop security awareness programmes that can be used to educate its users within an organisation. This method has several drawbacks; however, as such programmes might not be comprehensive enough, or quick enough to address newer threats. It can furthermore lead to the users developing InfoSec fatigue, which renders most attempts at improving security awareness pointless. These problems are compounded by non-traditional organisational structures, such as those found in educational institutions, where both students and staff should be made aware of information security risks on a regular basis. In order to address the potential information security awareness problem at educational institutions, this paper investigates the feasibility of using Social Network Analysis (SNA) to improve existing security awareness programmes. Following a brief introduction to SNA, two illustrative examples are offered to show that SNA presents a viable option to improve programmes for raising information security awareness in an academic environment, by allowing for the effective selection of ideal target locations.

Information security awareness is important among users because it can influence user's behavior towards complying with organization information security policies. Therefore, the current study was conducted to examine information security awareness factors affecting user's compliance behavior towards Health Information System (HIS) security policies based on extended Health Belief Model. The questionnaires were distributed to the respondents at selected public hospitals in Malaysia (N = 454). Statistical results confirm that perceived work experience, perceived severity, perceived benefit, cues to action, self-efficacy and perceived barrier were significant predictors of health information system's security policies compliance behaviour while perceived susceptibility was insignificant. Our findings will prove to be beneficial to fellow researchers and policy makers, especially related to the medical sectors in improving user's behavior toward practicing information security.

Contextual security awareness: A context-based approach for assessing the security awareness of users

This article examines the occurrences of four types of unethical employee information security behavior—misbehavior in networks/applications, dangerous Web use, omissive security behavior, and poor access control—and their relationships with employees’ information security management efforts to maintain sustainable information systems in the workplace. In terms of theoretical contributions, this article identifies and develops reliable and valid instruments to measure different types of unethical employee information security behavior. In addition, it investigates factors affecting different types of such behavior and how such behavior can be used to predict employees’ willingness to report information security incidents. In terms of managerial contributions, the article suggests that information security awareness programs and perceived punishment have differential effects on the four types of unethical behavior and that certain types of unethical information security behavior exert negative effects on employees’ willingness to report information security incidents. The findings will help managers to derive better security rules and policies, which are important for business continuity.

The proliferation of online social media use amongst employees has been reported to be incriminating organizational information security. Despite the benefits of social media to organizations, there were cases of information leakage, malware, identity theft, espionage and sabotage through such use. This paper explores employees' awareness of information security around social media and presents the initial findings of a study on a tertiary education institution in Malaysia. As an extension to a previous study, this study also found that employees were not only disclosing personal information but they are also disclosing organizational information on social media. This indicates there is a potential for information security threats to organizations through employees' use of social media. Nevertheless, the findings demonstrate that some participants were aware about the implications of employees' use of social media to information security.

The protection of assets of organizations became one of the major aspects that organizations have to deal with. The issue is too serious when it comes to financial organizations due to their sensitivity to data security attacks. Security breach incidents can happen in an organization no matter how well the technology is protected. The main reason for this is employees' improper conduct or lack of action that leads to the majority of information security incidents. Educating employees to improve information security awareness plays a significant part in securing organizational environments. Although, best practice, standards provide a set of minimum information security awareness controls that should implement. This study proposes an information security awareness training program to improve knowledge of information security and improves employee behavior for a private financial organization in Libya.

Abstract”Information is an essential element for organizations today. Confidentiality, integrity, and availability of information have a vital role in supporting organizational performance. Therefore, it is necessary to take information security measures so that the use of information can run effectively, efficiently, and integrated. The more valuable the information, the more security standards are needed to protect it. Among other things, the purpose of computer security is to protect information. The higher the security standards provided, the higher the protection of the privacy of that information. Protecting company employees' privacy is one factor that must be considered in the implementation of information systems. PT Telkomsel is one of the companies that experienced a data breach. This report will discuss nine hypotheses to determine the factors that affect Information System Security Behavior for employees of PT Telkomsel. Thus, validity, reliability, and hypothesis tests were carried out using the SmartPLS 3 software. The results showed a significant influence between the Security Education and Training variables on Information Security Awareness, Employee Accountability, and Employee Relationships. Index Terms”Information System Security Behavior, Security Education & Training, Information Security Awareness, Employee Relationships, Employee Accountability, Organizational Culture, National Culture