The long‐term effects of information security e‐learning on organizational learning

Purpose The purpose of this study is to examine factors, which influence information security culture among employees of telecommunications companies. The motivation for this study was the rise in the number of data breach incidents caused by the organizations’ own employees. Design/methodology/approach A total of 139 usable responses were collected via a Web-based questionnaire survey from employees of Malaysian telecommunications companies. Data were analysed by using SmartPLS 3. Findings Security education, training and awareness (SETA) programmes and information security awareness were found to have a positive and significant impact on Information Security Culture. Additionally, self-reported employees’ security behaviour was found to act as a partial mediator on the relationship between information security awareness and information security culture. Research limitations/implications The study was cross-sectional in nature. Therefore, it could not measure changes in population over time. Practical implications The empirical data provides a new perspective on significant elements that influence information security culture in an emerging market. Organizations in the telecommunications industry can now recognize that SETA programmes and information security awareness have a significant impact on information security culture. Employees’ security behaviour also mediates the relationship between information security awareness and information security culture. Originality/value This is the first study to analyse the mediating effect of employees’ security behaviour on the relationship between information security awareness and information security culture in the Malaysian telecommunications context.

The focus of this research was to look into the information security awareness of Chinese university students during the COVID-19 pandemic and make recommendations based on the survey's findings and research literature. The quantitative method is applied in this study. 111 Chinese college students were randomly sampled and requested to answer a Likert information security awareness questionnaire. The descriptive analysis of the data in this study is also done with SPSS. The findings revealed that the vast majority of college students know the significance of information security awareness and have basic information security awareness, based on the data collected. However, some students have not participated in relevant training courses, and many college students do not pay enough attention to personal information security, resulting in poor performance in areas such as files and passwords. As a result, effective solutions such as information security training projects are required to address the current deficiencies. The findings of this study have implications for university administrators and policymakers in terms of how to raise students' awareness of the security of their online learning information. The study should use mixed methods and large sample sizes in the future to provide more detailed and comprehensive survey data, and more credible evidence of college students' information security awareness.

Information security issue becomes increasingly concerns in the current environment with fast development of information technology, in which most of the concerns are rising from legal and ethical aspect. It is always questioned that are individuals and organizations aware of information security and the relevant regulations. How would they act when encountering information security misuse? How much power do regulations and ethics have on restricting information security misuse? This research study will mainly analyse legal and ethical issues in information security including the public awareness of information security and their impact. We formed three hypotheses based on the relevant court case review and the related literature, and have discussed whether the hypotheses are supported or not and several interviews to the victim of information security victim.

One of information security management elements is information security awareness program. Usually, this programs only involve the employees within the organization. Some organizations also consider security awareness for some parties outside the organization like providers, vendors, and contractors. This paper add consumers as variable to be considered in information security awareness program as there are also some threats for organization through them. Information security awareness will be measured from user's knowledge and behavior of five information security focus areas in telecommunication, especially related with smartphone users as one segment of telecommunication provider. In other researches, information security measurement from outside an organization is focused in Internet use by end-user. In telecommunication industry, information security threats for consumers not only from Internet, but also by phone call or texting. This research used CFA for data analysis method. The result showed that the indicators of knowledge dimension is not good enough to measure dimensions of knowledge where most of them are not significant. Meanwhile, behavior dimension gave different result with high significant value for measuring security awareness level. Indicators of behaviour dimension is good for measuring dimension of behaviour because only one indicator that isn't significant.

One of information security management elements is information security awareness program. Usually, this programs only involve the employees within the organization. Some organizations also consider security awareness for some parties outside the organization like providers, vendors, and contractors. This paper add consumers as variable to be considered in information security awareness program as there are also some threats for organization through them. Information security awareness will be measured from user’s knowledge, behavior, and attitude of five information security focus areas in telecommunication, especially related with smartphone users as one segment of telecommunication provider. For smartphone users, information security threats not only from Internet, but also by phone call or texting. Therefore, focus area in this research consist of adhere to security policy, protect personal data, fraud/spam SMS, mobile application, and report for security incident. This research use analytic hierarcy process (AHP) method to measure the information security awareness level from smartphone users. In total, the result indicated that awareness level is good (80%). Although knowledge and attitude dimension are in good criteria of awareness level, but behaviour dimension is average. It can be a reason why there are still many information security breach against smartphone user despite good awareness level.

Student awareness of information security (IS) ensures the security of students in the current technological era, but compliance with IS has not been fully carried out by students. This measurement of Information Security Awareness (ISA) is important to improve student understanding and long-term compliance that secures all aspects of devices, students, organizations, and schools. Using the Knowledge, Attitude, and Behavior model, this study aims to measure students' information security awareness. An online survey was conducted to evaluate student's information security awareness in 4 focus areas (passwords, internet safety, email safety, and digital payment) through the use of Likert scales. The overall awareness level of students was measured to be 73.79%, which is considered an average level of ISA. The awareness level of the password, internet safety, and email safety areas were average (69.19%, 71.31%, and 77.83% respectively, while the awareness level for the digital payment area was good at 80.35%. The Pearson's correlation coefficient (R) for the knowledge and behavior dimensions was 0.9497, indicating a strong positive correlation, while the coefficient for the attitude and behavior dimensions was 0.5428, indicating a moderate positive correlation. Thus, it can be recommended that awareness programs dedicated to raising ISA for students can focus on strengthening knowledge about IS so that students can exhibit good ISA behavior.

The proliferation of online social media use amongst employees has been reported to be incriminating organizational information security. Despite the benefits of social media to organizations, there were cases of information leakage, malware, identity theft, espionage and sabotage through such use. This paper explores employees' awareness of information security around social media and presents the initial findings of a study on a tertiary education institution in Malaysia. As an extension to a previous study, this study also found that employees were not only disclosing personal information but they are also disclosing organizational information on social media. This indicates there is a potential for information security threats to organizations through employees' use of social media. Nevertheless, the findings demonstrate that some participants were aware about the implications of employees' use of social media to information security.

Along with the increasing use of information and communication technology, information security becomes something fundamental. BATAN as one of the government agencies currently wants to increase the security awareness of its employees. As a national nuclear agency, information security awareness is crucial, as it relates to the safety of the society. This study aims to know how the relationship between the three variables of knowledge, attitude and behavior in BATAN. A nuclear agency has a special characteristics of information security because it has a higher standard related to information security than other institutions. By knowing how the interaction of these three variables, is expected to know how to improve employee behavior toward information security. The arrangement of research variables and instruments is done through Focus Group Discussion (FGD). FGD results were then compiled into questionnaires, distributed to 420 Batan employees. From 420 questionnaire, 381 was returned and processed using regression analysis. As a result, it is known that employee knowledge of information security affects employee attitudes to information security, employee attitudes to information security affect employee behavior in reducing security risks, and employee knowledge of information security affects employee behavior in reducing security risks.

The human aspect is one of the key success factors in information security (InfoSec). Its impact on InfoSec is so significant that multiple studies have shown that a balanced approach combining technology and security awareness is needed in order to maintain the integrity of an organisation’s security. At present, one of the methods most often used to address InfoSec awareness is to develop security awareness programmes that can be used to educate its users within an organisation. This method has several drawbacks; however, as such programmes might not be comprehensive enough, or quick enough to address newer threats. It can furthermore lead to the users developing InfoSec fatigue, which renders most attempts at improving security awareness pointless. These problems are compounded by non-traditional organisational structures, such as those found in educational institutions, where both students and staff should be made aware of information security risks on a regular basis. In order to address the potential information security awareness problem at educational institutions, this paper investigates the feasibility of using Social Network Analysis (SNA) to improve existing security awareness programmes. Following a brief introduction to SNA, two illustrative examples are offered to show that SNA presents a viable option to improve programmes for raising information security awareness in an academic environment, by allowing for the effective selection of ideal target locations.

With increasing dependence on information technology and information system, enterprises are confronting with a more and more complicated information security environment. Thus, information security has become an intractable problem for many enterprises. Generally speaking, there are two methods to improve enterprises’ information security level, that is, technology and management means. Technology means mainly settle software and hardware security of computers and networks, while management means mainly regulate and restrain the entire enterprise system including software, hardware, and employees. At present, a lot of enterprises mostly employ the technology means to solve information security problems. However, the lack or imperfection of information security institutions leads to bad enterprise information security situation. Therefore, technology and management means to solve information security are complementary to each other. As such, it is urgent and necessary to establish and improve information security institutions for many enterprises. In fact, enterprise information security is a complicated activity which needs different sectors to get involved in. More specifically, the information security departments play the very critical role in the implementation of information security institutions, and all employees should comply with the information security policy. Therefore, only the top management teams have the ability to coordinate the relationship between different departments, determine the introduction of information technology, and deploy the information systems. In response, top management support has an important impact on the construct of information security institutions and the effectiveness of information security management. So far, few studies have investigated the mechanism that how top management support affects information security legitimation, and legitimation information security management. Therefore, it has great theoretical and practical significance to the exploration of whether the legitimation supported by top management can improve the effectiveness of information security management. The objective of the current study is to explore whether legitimation prompted by top management team can improve the effectiveness of enterprise information security management. By doing so, the data was collected from the enterprises which have passed the certification of information security management system, and analyzed by using PLS-SEM. The results indicate that information security awareness can improve top management support（including top management belief and top management participation）and the effectiveness of information security management respectively. In addition, top management belief can improve implementation（the first stage of legitimation）and internalization（the second stage of legitimation）. Moreover, implementation can improve the effectiveness of information security management. This paper analyzes the way to enhance effectiveness of information security management, which has a reality-oriented meaning for prompting information security management of enterprises from the standpoint of institution.

Information systems user security: A structured model of the knowing–doing gap

Kebocoran data di lingkup pemerintah melatarbelakangi penulisan penelitian ini, sistem keamanan informasi pemerintah daerah yang pernah mengalami kebocoran diamankan salah satunya melalui persandian. Persandian adalah kegiatan di bidang pengamanan data/informasi yang dilaksanakan dengan menerapkan konsep, teori, seni dan iImu kripto beserta ilmu pendukung Iainnya secara sistematis, metodoIogis dan konsisten serta terkait pada etika profesi sandi. Persandian masuk dalam salah satu urusan wajib yang tidak berkaitan dengan pelayanan dasar. Penelitian ini bertujuan untuk memperoleh informasi dan mendeskripsikan bagaimana evaluasi pengelolaan persandian dalam menjaga keamanan informasi serta untuk mengukur tingkat kesiapan Diskominfo dan Persandian dalam menerapkan keamanan informasi menggunakan lndeks KAMl 4.1 di Diskominfo dan Persandian Kabupaten Lombok Timur. Riset kualitatif dengan metode deskriptif pendekatan induktif dan teknik wawancara, observasi, serta dokumentasi digunakan dalam pengumpulan data. Reduksi data, penyajian data, dan verifikasi data digunakan dalam teknik analisis data. Menggunakan teori evaluasi Context, Input, Process, Product (CIPP) memperoleh situasi yang masih kurang dikarenakan anggaran belanja dan operasional persandian, infastruktur komunikasi dan sarana prasarana persandian yang masih terbatas, kompetensi SDA persandian, kesadaran akan keamanan informasi yang masih rendah. Mengatasi hambatan tersebut dilakukan upaya meningkatkan sumber daya manusia dan pemenuhan infrastruktur bidang persandian, meningkatkan kesadaran pemerintah dan masyarakat mengenai keamanan informasi dan membangun Command Center serta merilis Aplikasi LotimOne dan LotimGo. Pengelolaan persandian dalam menjaga keamanan informasi berjalan baik. Tetapi Hasil akhir untuk mengukur tingkat kesiapan keamanan informasi menggunakan Indeks KAMI 4.1 yaitu 243 dengan status kesiapan Tidak Layak. Serta produk salah satunya penghargaan anugerah keterbukaan informasi publik (KIP) tahun 2021 tingkat provinsi NTB.

Purpose – The purpose of this paper was to analyse existing theories from the social sciences to gain a better understanding of factors which contribute to student mobile phone users’ poor information security behaviour. Two key aspects associated with information security behaviour were considered, namely, awareness and behavioural intent. This paper proposes that the knowing-and-doing gap can possibly be reduced by addressing both awareness and behavioural intent. This research paper explores the relationship between student mobile phone user information security awareness and behavioural intent in a developmental university in South Africa. Design/methodology/approach – Information security awareness interventions were implemented in this action research study, and student information security behavioural intent was observed after each cycle. Findings – The poor security behaviour exhibited by student mobile phone users, which was confirmed by the findings of this study, is of particular interest in the university context, as most undergraduate students are offered a computer-related course which covers certain information security-related principles. Existing researchers in the field of information security still grapple with the “knowing-and-doing” gap, where user information security knowledge/awareness sometimes does not result in safer behavioural practises. Originality/value – Zhang et al. (2009) suggest that understanding human behaviour is important when dealing with the problems caused by human errors. Harnesk and Lindstrom (2011) expressed a concern that existing research does not address the interlinked relationship between anticipated security behaviour and the enactment of security procedures. This study acknowledges Choi et al. (2008) contribution in their discussions on the “knowing-and-doing gap” suggests a link between awareness and actual behaviour that is confirmed by the findings of this study.

The purpose of this study is to contribute to creating awareness of information security requirements in customized health applications. The study refers to how developing mobile applications affect information security in accordance with the developments in health informatics and evaluates the aspects of network and information security in the health-related systems as well as attacks and types of attacks. Today, health information systems are modeled in integrated systems as application, control, tracking and warning systems. These systems have been turning into systems that collect private information as long as they have patients on one side. With this approach, the concept of mobility has become a must in systems because of the patient. Data communication can be performed from machine to machine (M2M) between the systems without the human factor. This ensures the communication of accurate and timely data. This study contributes to health administrators’ awareness of information security in health with a different point of view.

In recent years, information security has gained significant academic attention. The present research sought to examine shifts in undergraduates' Information Security Awareness (ISA) as they advanced in their academic pursuits. Comprising two distinct phases, the initial phase involved adapting the Human Aspects of Information Security Questionnaire (HAIS-Q) to fit the context of Chinese tertiary institutions, a process overseen by five eminent ISA specialists. The adapted instrument was then piloted with 647 students, utilising snowball and criterion sampling techniques. Construct validity was established through exploratory factor analysis, and the questionnaire's reliability was ascertained via Cronbach's alpha. The subsequent primary survey engaged 5148 undergraduates from three Chinese academic institutions to further validate the instrument and investigate its relevance to student cohorts. Distinctively, participants exhibited pronounced proficiency in the Attitude component, yet lagged in Behavioural aspects. Analytical outcomes highlighted discernible interactions between gender, academic progression, and the Knowledge, Attitude, and Behaviour (KAB) facets. Notably, female respondents consistently outperformed their male counterparts. However, a marked decline in ISA cognisance and comportment was observed as students ascended academically. The HAIS-Q stands as a reliable tool for evaluating ISA in tertiary education, offering fresh insights to the scholarly discourse on educational information security.