Cybersecurity Awareness and Adaptive Behavior: Does Prior Exposure Lead to Adaptive Behavior?

2023 | Americas Conference on Information Systems | Citations: 0

Authors: Bhagat, Sarbottam; Pravin, Dipakkumar

Abstract: We adopt and use technology almost as fast as it comes into existence, however, ... Expand

Abstract: We adopt and use technology almost as fast as it comes into existence, however, our mental models and intuitions advance at a much slower pace to the vulnerabilities and threats that come with new technologies. This creates an opportunity for perpetrators to take advantage of the cyber citizens. It is common knowledge that human beings will remain as the ultimate defense (or the final firewall) of cyber assets, and yet they are most vulnerable to a variety of cyber-attacks. Considering these assertions, this research aims to explain whether knowledge and experience build the necessary awareness that leads to action. The proposed model expands on the Knowledge-Attitude-Behavior model to explore the role of prior cybersecurity training, incidents, awareness, and attitude towards cybersecurity education in individuals' adaptive behaviors given cybersecurity risks. The findings could inform the academic community and policymakers on creating effective cybersecurity awareness programs to promote cyber hygiene in today's digital world. Collapse

Topics: IT security cybersecurity awareness information system use

Decide wisely: Interactive videos as appealing educational element to attract students to information security

2023 | International Conference on Business Informatics | Citations: 0

Authors: Brehmer, Martin

Abstract: Educational videos play an important role in university education. However, the ... Expand

Abstract: Educational videos play an important role in university education. However, they are often not designed to foster active learning and the learning process is not immersive. Interactive digital storytelling is a promising game design element but requires a rigorous evaluation to avoid negative side effects. Therefore, we adopt a design science research approach to design and evaluate an interactive video that includes interactive storytelling and real-world recordings. The proposed artifact aims to raise information security awareness among bachelor students at a German university for malicious USB sticks and the reporting of incidents. In our evaluation, we focus on learning progress before and after using the video as well as qualitative feedback about the experience with the learning object. Our results show that videos that are based on interactive choice-based storytelling can foster an active and immersive process, and significant learning outcomes. Collapse

Topics: IT security training data security anonymity cybersecurity awareness user experience

Methods: parametric test Student's t-test survey design science descriptive statistic

Using stakes consciousness to better understand information security awareness

2023 | Americas Conference on Information Systems | Citations: 0

Authors: Kouyo, Guy Alain Sylvanus; Nishant, Rohit; Khechine, Hager

Abstract: ... Expand

Abstract: Collapse

Topics: cybersecurity awareness IT security data security human resource management technology adoption

Theories: big five model

Analysis of Security Threats in the Supply Chain of ICT Products Based on Evolutionary Game Theory

2023 | Group Decision and Negotiation | Citations: 0

Authors: Li, Qing; Li, Yan; Yuan, Tianlongyi; Chen, Dawei

Abstract: The network information security regulation of information and communication tec ... Expand

Abstract: The network information security regulation of information and communication technology (ICT) product supply chain is an important issue for governments globally. The whole life cycle of ICT supply chain is a complex process, comprising the design and development stage, outsourcing integration stage and service operation and maintenance stage. Each of these stages may be maliciously attacked, leading to network information security crisis. Therefore, a tripartite evolutionary game model comprising ICT product suppliers, demand customers (such as system integrators, operation and maintenance suppliers and service providers) and government regulatory authorities was constructed from the perspective of security threats and government regulation in the supply chain of ICT products based on bound rationality. The effects of each element on the tripartite strategy selection were evaluated by determining the evolutionary stability of upstream and downstream supply chains. The evolution path was simulated using Matlab2016a software and external variables were included for simulation analysis. The results showed that: (1) the costs of design development and production of high-quality ICT products directly affect the strategy choice of the producers, and determine the stable strategy time of the demanding customers, implying that excessive R&D costs negatively affect healthy development of the supply chain; (2) increase in incentives by the government within a reasonable range promotes the development of products with high security performance and ensures standardization of the implementation standards of information security acceptance of products by customers. However, the increase in incentives leads to a decrease in government supervision; (3) the initial probability of selection of product manufacturers plays an important role in the convergence rate of demand customers. The participating enterprises and government’s operational decision were explored using the tripartite evolutionary game of the ICT product supply chain to formulate recommendations to enhance the construction of information security. Collapse

Topics: data security supply chain management IT security decision making IT investment

Methods: simulation

Introduction to the Minitrack on Security and Privacy Aspects of Human-Computer-Interactions

2023 | HICSS | Citations: 0

Authors: Rosenthal, Paul; Müller, Nicholas; Weber, Kristin

Abstract: Special-Track IntroductionWith increasing digitization, the security and privac ... Expand

Abstract: Special-Track IntroductionWith increasing digitization, the security and privacy aspects of information are a non-negotiable factor in information system design and operation.Especially the human factor of information systems is a pivotal role in information security and increasingly relevant in establishing user-privacy concepts. More often than not, their knowledge about security aspects and ways of user-manipulation tactics are the last line of defense against cyber-attacks. However, studies show users are also seen as the weakest link in information security. Therefore, they are also the primary target of attackers.In addition to the traditional forms of user-computerinteractions in the form of mouse-keyboard-inputdevices, new ways of system-interactions, e.g., physiological data from fitness-trackers, eye-tracking devices or even pupillary responses indicating cognitive-load-levels, are increasingly feasible as everyday HCI-components. With the interest in data privacy increasing, are users aware how valuable those personal input data is and how do they value data privacy measures? Therefore, we have identified two main aspects relevant to researchers within the domain of Software Technology:1) how to securely deal with input data (also focusing on privacy aspects) 2) how this data can be utilized in order to increase secure behavior or to raise awareness among users (help the users to make better securityrelated decisions)In this minitrack we sought papers that explore concepts, prototypes and evaluations of how users interact with information systems and what implications these interactions have for information security and privacy. Further, we welcomed new and innovative ways of human-computer-interaction and securityrelated concepts currently examined in the field. This year two papers will be discussed within this minitrack which cover the above-mentioned facets of security aspects. Developing a Maturity Model for Information Security Awareness Using a Polytomous Extension of the Rasch ModelThe first paper by Fertig, Schütz and Weber is about Information Security Awareness (ISA), and how to apply it in a targeted way. They developed a system of five maturity levels and were able to show, by conducting a survey, that the maturity model is an effective way to identify strengths and weaknesses regarding ISA within organizations. The Forgotten Model -Validating the Integrated Behavioral Model in Context of Information Security AwarenessThe second paper by Fertig and Schütz is also focused on information security awareness and how this interacts or can be explained by applying the Integrated Behavioral Model (IBM). The authors therefore present an extended model of the IBM within the ISA context and apply a high level of detail to help companies to enhance ISA in a systematic way. Collapse

Topics: privacy data security cybersecurity awareness

Methods: design artifact

Sustainable Information Security Sensitization in SMEs: Designing Measures with Long-Term Effect

2023 | HICSS | Citations: 0

Authors: Scholl, Margit

Abstract: This paper outlines an overall scenario for ongoing personnel development measur ... Expand

Abstract: This paper outlines an overall scenario for ongoing personnel development measures designed to increase information security awareness in small and medium-sized enterprises (SMEs) in Germany and to help small businesses improve their security levels and defenses. The three-year project combines different actors and a multitude of methods, with a focus on conducting interviews and online surveys with companies, developing customized game-based awareness trainings, tests, and on-site attacks, and creating measurements and evaluations as well as maturity statements, guidelines, and low-threshold security concepts. A mix of analog/digital serious games and operational trainings with reviews are of key importance here. Compared with the findings from the applied scientific literature on behavioral research and design, the ultimate goal at project’s end is to extrapolate statements on the success and efficacy of the measures and their long-term effect. Collapse

Topics: cybersecurity awareness anonymity

Methods: qualitative interview survey

Cultivating security culture for information security success: A mixed-methods study based on anthropological perspective

2023 | Information & Management | Citations: 0

Authors: Tejay, Gurvirender P.S.; Mohammed, Zareef A.

Abstract: The continuous information security failures in organizations have led focus tow ... Expand

Abstract: The continuous information security failures in organizations have led focus toward organizational culture. It is argued that the development of culture of information security would subsequently lead to a secure organization. However, limited studies have been conducted to understand information security culture. This study aims to understand information security culture and its impact on success with information security efforts in an or­ ganization. The research model is based on the theory of primary message systems, which is an established theory from the anthropology discipline. We followed a mixed-methods research design involving two phases of the study. In the first phase, 25 semi-structured interviews with experienced cybersecurity practitioners were conducted to develop the research model. The second phase empirically validated the research model using survey data from 473 participants who completed a web-based survey in Southeast USA from multiple com­ panies. For data analysis, we employed Partial Least Squares - Structural Equation Modeling using SmartPLS. Our findings indicate that group cohesiveness, professional code, information security awareness, and informal work practices have significant influence on information security culture. Further, the security culture has positive impact on information security success perception. The contribution of this research lies in establishing the role of security culture and information security awareness in contributing toward information security success. Collapse

Topics: data security cybersecurity awareness IT security organizational culture anonymity

Methods: survey mixed method qualitative interview statistical hypothesis test partial least squares regression

Security is Local: The Influence of the Immediate Workgroup on Information Security

2023 | Journal of the Association for Information Systems | Citations: 0

Authors: Wang, Dawei; Durcikova, Alexandra; Dennis, Alan

Abstract: Information security is a multilevel phenomenon with employee security decision ... Expand

Abstract: Information security is a multilevel phenomenon with employee security decisions being influenced by macrolevel factors (e.g., organizational policies), mesolevel factors (e.g., one's immediate workgroup-IW), and microlevel factors (e.g., individual personalities). We argue that an employee's local IW (i.e., immediate supervisor and coworkers) has a strong effect on security. This paper focuses on the effects of these mesolevel factors in the presence of macro-and microlevel factors. Drawing on the social structure and social learning framework as well as workgroup research, we hypothesize that the security behavior of an employee's IW supervisor and coworkers moderated by the nature of these relationships influences information security decisions. Our research, based on a sample of 217 full-time employees, reveals that the IW significantly affects security decisions, over and above the micro-and macrolevel factors. These effects are moderated by the nature of the relationship between employees and their IW supervisor (leader-member exchange) and coworkers (team-member exchange). A post hoc analysis shows that the mesolevel factors alone had the same explanatory power as the micro-and macrolevels combined. Our research suggests that future theory and research should include the IW and that organizations should share security responsibilities with line managers and help them understand their substantial impact on information security. Security training programs should ask employees about the behaviors of their IW supervisor and coworkers and, where needed, deliver anti-neutralization training to mitigate the effects of the IW's noncompliance behaviors.Alexandra Durcikova is an associate professor of MIS at the Price College of Business, University of Oklahoma. Her research focuses on knowledge management, knowledge repositories, and human compliance with security policy and characteristics of successful phishing attempts within the area of computer security, and health information systems. Collapse

Topics: data security IT security threat IT security password self efficacy

Methods: survey theory development descriptive statistic data transformation factor analysis

Theories: big five model social learning theory leader–member exchange theory

Gamifying a Learning Management System: Narrative and Team Leaderboard in the Context of Effective Information Security Education

2023 | HICSS | Citations: 0

Authors: Brehmer, M.; Reinelt, R.

Abstract: Gamified learning management systems (LMS) can be effective in case game-design ... Expand

Abstract: Gamified learning management systems (LMS) can be effective in case game-design elements (GDE) address users' motivation to engage with the topic and lower barriers to learning. In the context of Security Education, Training, and Awareness (SETA) programs, gamification is stated to be a major success factor. However, there is scarce research about the relationship between GDE and learning outcomes such as information security awareness. The evaluation of GDE regarding the application context is important because inappropriate gamified approaches can lead to negative outcomes, e.g., anxiety or inappropriate behavior. Thus, we first derive narrative and team leaderboard (TL) as appropriate GDE for the context of SETA. Second, Spearman correlation analyses indicate positive significant relationships between the experience of narrative and team leaderboard with information security awareness. Therefore, we implicate integrating narrative and team leaderboard within an LMS in the context of SETA programs. Collapse

Topics: gamification user experience data security knowledge base privacy

Methods: survey correlation analysis design science design principle descriptive statistic

Introduction to the Minitrack on Organizational Cybersecurity: Advanced Cyber Defense, Cyber Analytics, and Security Operations

2023 | HICSS | Citations: 0

Authors: Steiner, Stuart; Plachkinova, Miloslava; Conte De Leon, Daniel; Shepherd, Morgan

Abstract: Cybersecurity touches all aspects of organizational management, with organizati ... Expand

Abstract: Cybersecurity touches all aspects of organizational management, with organizational systems, networks, and critical infrastructures increasingly targeted by determined malicious actors with advanced skills and resources. Such attacks have the potential for major disruption of our society including damage to assets, people, and the environment. Organizations, of all sizes and at all levels, are faced with the challenge of continuously, effectively, and efficiently protecting their systems while enabling and ensuring their mission. Organizational cybersecurity aims to advance knowledge on the theory and practice of cybersecurity management. Collapse

Topics: IT security decision making IT manager information technology capability IT security training

Methods: natural language processing personal interview case study qualitative content analysis