Citizens’ Cybersecurity Behavior: Some Major Challenges

Ying Li,Tong Xin,Mikko Siponen

DOI: https://doi.org/10.1109/MSEC.2021.3117371

IF: 3.105

2022-01-01

IEEE Security & Privacy

Abstract:Citizens’ cybersecurity behaviors are an important concern in the modern age. This work discusses the challenges of studying citizen cybersecurity behaviors and the directions for future research.

What problem does this paper attempt to address?

A Novel Approach to the Behavioral Aspects of Cybersecurity

Sarah Sharifi

2023-01-23

Abstract:The Internet and cyberspace are inseparable aspects of everyone's life. Cyberspace is a concept that describes widespread, interconnected, and online digital technology. Cyberspace refers to the online world that is separate from everyday reality. Since the internet is a recent advance in human lives, there are many unknown and unpredictable aspects to it that sometimes can be catastrophic to users in financial aspects, high-tech industry, and healthcare. Cybersecurity failures are usually caused by human errors or their lack of knowledge. According to the International Business Machines Corporation (IBM) X-Force Threat Intelligence Index in 2020, around 8.5 billion records were compromised in 2019 due to failures of insiders, which is an increase of more than 200 percent compared to the compromised records in 2018. In another survey performed by the Ernst and Young Global Information Security during 2018-2019, it is reported that 34% of the organizations stated that employees who are inattentive or do not have the necessary knowledge are the principal vulnerabilities of cybersecurity, and 22% of the organizations indicated that phishing is the main threat to them. Inattentive users are one of the reasons for data breaches and cyberattacks. The National Cyber Security Centre (NCSC) in the United Kingdom observed that 23.2 million users who were victims of cybersecurity attacks used a carelessly selected password, which is 123456, as their account password. The Annual Cybersecurity Report published by Cisco in 2018 announced that phishing and spear phishing emails are the root causes of many cybersecurity attacks in recent years. Hence, enhancing the cybersecurity behaviors of both personal users and organizations can protect vulnerable users from cyber threats. Both human factors and technological aspects of cybersecurity should be addressed in organizations for a safer environment.

Human-Computer Interaction,Cryptography and Security
Cybersecurity for children: an investigation into the application of social media

Victor Chang,Lewis Golightly,Qianwen Ariel Xu,Thanaporn Boonmee,Ben S. Liu

DOI: https://doi.org/10.1080/17517575.2023.2188122

2023-03-17

Enterprise Information Systems

Abstract:The paper discusses cybersecurity for children (particularly teenagers) and focuses on Social Media's impact using a theoretical approach. Many social media users are unaware of their Cybersecurity in Social Media and all-round digital privacy and do not understand the importance of developing privacythrough taking both digital and physical measures. We identify seven categories of hacking motivations through multimedia platforms: Emotions, Financial gains, Entertainment, Proficiency for jobs, Hacktivism, Espionage, and Cyber-warfare, particularly for children. As vulnerable people, they can be the principal victims. We explore various methods used for hacking, such as Sexting, Facebook depression, and Influence on buying advertisements. In our findings, we demonstrate that the most critical protection method is to fully understand the digital footprint left behind and its possible consequences. The users should know this as a self-protection mechanism to mitigate security issues before problems occur. It means adopting the same mindset and attitude of protecting oneself in the online world as in the real world.

computer science, information systems
Cyber Security Awareness, Knowledge and Behavior: A Comparative Study

Moti Zwilling,Galit Klien,Dušan Lesjak,Łukasz Wiechetek,Fatih Cetin,Hamdullah Nejat Basim

DOI: https://doi.org/10.1080/08874417.2020.1712269

2020-02-14

Journal of Computer Information Systems

Abstract:Cyber-attacks represent a potential threat to information security. As rates of data usage and internet consumption continue to increase, cyber awareness turned to be increasingly urgent. This study focuses on the relationships between cyber security awareness, knowledge and behavior with protection tools among individuals in general and across four countries: Israel, Slovenia, Poland and Turkey in particular. Results show that internet users possess adequate cyber threat awareness but apply only minimal protective measures usually relatively common and simple ones. The study findings also show that higher cyber knowledge is connected to the level of cyber awareness, beyond the differences in respondent country or gender. In addition, awareness is also connected to protection tools, but not to information they were willing to disclose. Lastly, findings exhibit differences between the explored countries that affect the interaction between awareness, knowledge, and behaviors. Results, implications, and recommendations for effective based cyber security training programs are presented and discussed.

computer science, information systems
Cyber Security Behaviour In Organisations

Amy Ertan,Georgia Crossland,Claude Heath,David Denny,Rikke Jensen

DOI: https://doi.org/10.48550/arXiv.2004.11768

2020-04-24

Abstract:This review explores the academic and policy literature in the context of everyday cyber security in organisations. In so doing, it identifies four behavioural sets that influences how people practice cyber security. These are compliance with security policy, intergroup coordination and communication, phishing/email behaviour, and password behaviour. However, it is important to note that these are not exhaustive and they do not exist in isolation. In addition, the review explores the notion of security culture as an overarching theme that overlaps and frames the four behavioural sets. The aim of this review is therefore to provide a summary of the existing literature in the area of everyday cyber security within the social sciences, with a particular focus on organisational contexts. In doing so, it develops a series of suggestions for future research directions based on existing gaps in the literature. The review also includes a theoretical lens that will aid the understanding of existing studies and wider literatures. Where possible, the review makes recommendations for organisations in relation to everyday cyber security.

Computers and Society
Citizens' engagement with cybersecurity measures in Bangladesh: a cross-sectional study

Md Shafiul Alam,Saif Ahmed,Mohsin Dhali,Syed Shah Alam

DOI: https://doi.org/10.1007/s10207-024-00918-9

2024-11-01

International Journal of Information Security

Abstract:This study aims to provide a comprehensive understanding of the psychological and technical factors that influence citizen engagement in e-governance systems in Bangladesh, with implications for policy development and future research. This study employs a cross-sectional research design to investigate citizens' engagement with cybersecurity measures in the context of cybersecurity and trust in Bangladesh. The study focuses on the interplay between perceived threat magnitude, perceived exposure risk, and citizens' perceptions on various dimensions of cybersecurity, such as technical security attributes, user-friendly security, and security system efficiency. The analysis reveals that Threat Appraisal plays a pivotal role in influencing Technical Security Attributes, User-Friendly Security, and Benevolence. Moreover, Perceived Technical Competency, Security System Efficiency, E-Gov Integrity, Tech Adoption & Policy Adherence of citizens, and Trust are key determinants in shaping citizens' cybersecurity attitudes and behaviors, especially in contexts like Bangladesh, which are at the cusp of digital transformations. The integrated theoretical framework developed in this study offers a multitude of practical implications that could significantly influence both the development and implementation of cyber security systems, particularly in situations like Bangladesh.

computer science, information systems, theory & methods, software engineering
Emergent Behavior in Cybersecurity

Shouhuai Xu

DOI: https://doi.org/10.48550/arXiv.1502.05102

2015-02-18

Cryptography and Security

Abstract:We argue that emergent behavior is inherent to cybersecurity.
Individual and Contextual Variables of Cyber Security Behaviour -- An empirical analysis of national culture, industry, organisation, and individual variables of (in)secure human behaviour

Marten de Bruin,Konstantinos Mersinas

2024-05-29

Abstract:Cyber security incidents are increasing and humans play an important role in reducing their likelihood and impact. We identify a skewed focus towards technical aspects of cyber security in the literature, whereas factors influencing the secure behaviour of individuals require additional research. These factors span across both the individual level and the contextual level in which the people are situated. We analyse two datasets of a total of 37,075 records from a) self-reported security behaviours across the EU, and b) observed phishing-related behaviours from the industry security awareness training programmes. We identify that national culture, industry type, and organisational security culture play are influential Variables (antecedents) of individuals' security behaviour at contextual level. Whereas, demographics (age, gender, and level or urbanisation) and security-specific factors (security awareness, security knowledge, and prior experience with security incidents) are found to be influential variables of security behaviour at individual level. Our findings have implications for both research and practice as they fill a gap in the literature and provide concrete statistical evidence on the variables which influence security behaviour. Moreover, findings provides practical insights for organisations regarding the susceptibility of groups of people to insecure behaviour. Consequently, organisations can tailor their security training and awareness efforts (e.g., through behaviour change interventions and/or appropriate employee group profiles), adapt their communications (e.g., of information security policies), and customise their interventions according to national culture characteristics to improve security behaviour.

Cryptography and Security
Exploring Workers' Subjective Experiences of Habit Formation in Cybersecurity: A Qualitative Survey

Emily I M Collins,Joanne Hinds

DOI: https://doi.org/10.1089/cyber.2020.0631

Abstract:Employee behaviors remain at the center of the cybersecurity of workplaces, despite the challenges they face in doing so. Time pressures and competing demands mean that users tend to rely on habitual behaviors that often run counter to good cybersecurity practice. One possible solution may be to encourage positive habit formation. Designing such interventions, however, relies on knowledge of the perception and experience of habit formation in the context of cybersecurity. To this end, a qualitative survey containing open-ended questions was completed by 195 participants (mean age = 35.51, 53 percent female) recruited via an online participant panel. Participants were asked what cybersecurity behaviors they perform at work and how they believe any habits were prompted, formed, and maintained. Thematic analysis identified three over-arching themes: (a) forming habits unavoidably or unconsciously (some were mandated, or formed without conscious awareness), (b) consciously cultivating habits (including the roles of intrinsic motivation and external prompts), and (c) social and organizational influences (including the influence of occupational culture, social modeling, previous experiences, and information gathering practices). Based on these findings, we present guidelines for supporting workplace cybersecurity habit formation reflecting these subjective experiences, namely introducing automatic solutions, facilitating external cues, fostering interest in cybersecurity issues among employees, creating a positive cybersecurity occupational culture and highlighting positive behavior, and providing access to accessible cybersecurity information to employees. These results constitute a first step in identifying how habits can be exploited for positive cybersecurity behavior change in a way that accounts for the reliance on habitual behaviors in busy, time-pressured workplaces.
Legal Protection of the Cyber-security Culture

Dai Tianxiu,Ma Minhu

DOI: https://doi.org/10.3969/j.issn.1003-6938.2007.01.022

2007-01-01

Abstract:As the rapid change in the use of information and cyber system,cyber-security has become one of the most important issues that the government,companies,other organizations and the individuals has paid special attention to,who are using or supplying the information systems and internet service."Cyber-security Culture",as the "man's" element in cyber-security,attracted attention of many countries.How to improve the development of the Cyber-security Culture has become a big problem.Learning from foreign countries' experience,we give some suggestions to improve the cyber-security's aims and principles.
Research on Frontier and Trends of Science of Cybersecurity

Hua-shan CHEN,Lan PI,Feng LIU,Dong-dai LIN

DOI: https://doi.org/10.3969/j.issn.1671-1122.2015.03.001

2015-01-01

Abstract:With the rapid development of information technology, internet is playing an increasingly important role across the world. A trustworthy cyberspace has been closely related to national interests and has become a focus of national security and social stability. However, the past security research often focused on the solutions to speciifc threats, which sometimes was termed engineering. But we don’t have a clear understanding of many fundamental problems and universal laws of cybersecurity, that is, cybersecurity research lacks a ifrm scientiifc foundation and theoretical support. In contrast to the past engineering approach, in the recent two years, we have seen a growing push within the research community of information security to promote the study of cybersecurity as a science. This paper introduces the background of developing a science of cybersecurity, depicts the scientiifc connotation of cybersecurity and discusses ifve hard problems in the science of cybersecurity. Finally, the perspective of cybersecurity research is also proposed in this paper.
A Typology of Cybersecurity Behavior among Knowledge Workers

Dennik Baltuttis,Timm Teubner,Marc T.P. Adam

DOI: https://doi.org/10.1016/j.cose.2024.103741

IF: 5.105

2024-02-01

Computers & Security

Abstract:While the cybersecurity literature on behavioral factors has expanded, current countermeasures often overlook employee-specific behavioral differences, leading to generic solutions. This study addresses this gap by introducing a typology of knowledge worker cybersecurity behaviors through cluster analysis. Based on online survey data (n=264), we identify six main dimensions of cybersecurity attitude and behavior and, based on these, four behavioral cybersecurity types with distinct characteristics and demographic profiles: Naïve Greenhorns, Traditional Examiners, Flexible Mavericks, and Reliable Troupers. Contrary to common beliefs, the study found that older employees demonstrate high cybersecurity resilience, while younger ones pose a higher risk. These findings underscore the importance of tailored, human-centered cybersecurity approaches.

computer science, information systems
An Investigation on Cyber Security Threats and Security Models

Kutub Thakur,Meikang Qiu,Keke Gai,Md Liakat Ali

DOI: https://doi.org/10.1109/cscloud.2015.71

2015-11-01

Abstract:Cyber security has been used interchangeably for information security, where later considers the role of the human in the security process while former consider this as an additional dimension and also, focus person has a potential target. However, such discussion on cyber security has important implication as it focuses on the ethical part of the society as a whole. To address the issue of cyber security, various frameworks and models have been developed. It also introduces the concepts of cyber security in terms of its framework, workforces and information related to protecting personal information in the computer. This paper reviews these models along with their limitations and review the past techniques used to mitigate these threats. Furthermore, the report also provides recommendations for future research.
Cyber Security Threats and Countermeasures in Digital Age

DOI: https://doi.org/10.54060/a2zjournals.jase.42

2024-01-01

Abstract:Due to the quick development of technology, the digital age has brought with it ad-vantages never before seen, but it has also opened the door to a flood of new cyber security concerns. This study offers detailed analysis of the cyber threat environment in the digital era along with suggestions for doable protective measures. The report outlines a number of cyber threats, including malware, phishing scams, ransomware, and insider threats. It looks at the continually evolving tactics employed by cyber-criminals, such as social engineering, zero-day flaws, and sophisticated persistent threats. The growing hazards associated with cutting-edge technology, such as the Internet of Things (IoT), cloud computing, and artificial intelligence, are also exam-ined. The importance of a multi-layered security strategy to counter these attacks is emphasized in the article. Among the important preventative measures that are presented are robust network security, secure coding methodologies, user awareness training, encryption, access controls, and incident response planning. It also high-lights how crucial it is for people, businesses, and governments to collaborate in or-der to confront cyber risks. By using the recommended solutions and promoting a culture of cyber security awareness, people and organizations may navigate the dig-ital age with confidence and protect themselves from the continuously evolving environment of cyber risks.
'They're all about pushing the products and shiny things rather than fundamental security' Mapping Socio-technical Challenges in Securing the Smart Home

Jiahong Chen,Lachlan Urquhart

DOI: https://doi.org/10.48550/arXiv.2105.11751

2021-05-25

Abstract:Insecure connected devices can cause serious threats not just to smart home owners, but also the underlying infrastructural network as well. There has been increasing academic and regulatory interest in addressing cybersecurity risks from both the standpoint of Internet of Things (IoT) vendors and that of end-users. In addition to the current data protection and network security legal frameworks, for example, the UK government has initiated the 'Secure by Design' campaign. While there has been work on how organisations and individuals manage their own cybersecurity risks, it remains unclear to what extent IoT vendors are supporting end-users to perform day-to-day management of such risks in a usable way, and what is stopping the vendors from improving such support. We interviewed 13 experts in the field of IoT and identified three main categories of barriers to making IoT products usably secure: technical, legal and organisational. In this paper we further discuss the policymaking implications of these findings and make some recommendations.

Cryptography and Security,Computers and Society,Human-Computer Interaction
Developing a cyber security culture: Current practices and future needs

Betsy Uchendu,Jason R.C. Nurse,Maria Bada,Steven Furnell

DOI: https://doi.org/10.1016/j.cose.2021.102387

2021-10-01

Abstract:<p>While the creation of a strong security culture has been researched and discussed for decades, it continues to elude many businesses. Part of the challenge faced is distilling pertinent, recent academic findings and research into useful guidance. In this article, we aim to tackle this issue by conducting a state-of-the-art study into organisational cyber security culture research. This work investigates four questions, including how cyber security culture is defined, what factors are essential to building and maintaining such a culture, the frameworks proposed to cultivate a security culture and the metrics suggested to assess it. Through the application of the PRISMA systematic literature review technique, we identify and analyse 58 research articles from the last 10 years (2010-2020). Our findings demonstrate that while there have been notable changes in the use of terms (e.g., information security culture and cyber security culture), many of the most influential factors across papers are similar. Top management support, policy and procedures, and awareness for instance, are critical in engendering cyber security culture. Many of the frameworks reviewed revealed common foundations, with organisational culture playing a substantial role in crafting appropriate cyber security culture models. Questionnaires and surveys are the most used tool to measure cyber security culture, but there are also concerns as to whether more dynamic measures are needed. For practitioners, this article highlights factors and models essential to the creation and management of a robust security culture. For research, we produce an up-to-date characterisation of the field and also define open issues deserving of further attention such as the role of change management processes and national culture in an enterprise's cyber security culture.</p>

computer science, information systems
Are critical success factors for cybersecurity just technical issues Cybersecurity management and the human factor

Cenk Aksoy Bilen

DOI: https://doi.org/10.17261/pressacademia.2023.1735

2023-06-30

Pressacademia

Abstract:Purpose- With the rapid advancement of information and communication technologies, businesses are facing growing security risks. The prevalence, intensity, and complexity of cyber attacks worsen these vulnerabilities, leading to a rising focus on cybersecurity. Enterprises exposed to such cyberattacks might not only face considerable financial losses but also experience data breaches, operational interruptions, harm to their reputation, regulatory penalties, legal expenses, reduced competitive standing, and increased insurance premiums. In this concept study discusses the importance of human factors in cybersecurity management. While organizations spend billions on information technology systems and software to detect and prevent cyber threats, individuals play a critical role in managing these risks. Methodology- Through a review of literature and statistical data, study examines the factors contributing to cybersecurity breaches, the allocation of resources to address them, and proposes potential solutions. Findings- In the workplace, most research on cybersecurity focuses on employees as the most important source of vulnerability. In the literature review, it is understood that an employee’s carelessness and lack of awareness pose the greatest risk to cybersecurity. However, businesses often fail to show sufficient attention to human behavior in their efforts to keep organizational data secure and to plan security strategies. It is important to note that effective cybersecurity management requires not only technical controls but also the management of human factors. Meanwhile, security expenditures in enterprises are often disproportionately allocated to technology investments, with 97% being spent on technology investments, despite the fact that over 85% of breaches are attributable to human factors. Conclusion- In the literature review, it is understood that cybersecurity management is not only related to technical controls, but also the management of human factors is of critical importance. The management of individuals is also an essential cybersecurity responsibility. It is important to adopt a holistic approach to cybersecurity management includes both technical and human perspectives. Cybersecurity awareness has significant benefits for businesses to effectively manage cybersecurity which can be achieved by developing appropriate training programs and foster a cybersecurity culture. Keywords: Cybersecurity, cybersecurity management, cybersecurity awareness, technology investments, human factor JEL Codes: M12, M15, L86
A Study on Challenges Faced by Cyber Security on the Latest Technologies

Yajat Panjeta Yajat Panjeta

DOI: https://doi.org/10.29070/60a77420

2024-09-02

Journal of Advances in Science and Technology

Abstract:Artificial intelligence (AI), the Internet of Things (IoT), fifth-generation (5G) networks, andquantum computing are all examples of cutting-edge breakthroughs that have opened up exciting newpossibilities in today's quickly developing technological world. However, these developments also providenovel and difficult cybersecurity issues. The purpose of this research is to illuminate the complicateddifficulties faced by cybersecurity experts in their quest to keep vital information and infrastructure safefrom cyberattacks. This study identifies and analyzes key cybersecurity concerns in the context ofcutting-edge technology by drawing on a thorough analysis of the available literature, case studies, andexpert interviews. According to the most important results, the cybersecurity industry faces formidableproblems due to the growth of Internet of Things devices, the use of artificial intelligence for bothdefensive and offensive reasons, the vulnerabilities created by 5G networks, and the looming threat ofquantum computing.
CYBERSECURITY MANAGEMENT – CURRENT STATE AND DIRECTIONS OF CHANGE

Mirosław Karpiuk,Wojciech Pizło,Krzysztof Kaczmarek

DOI: https://doi.org/10.5604/01.3001.0054.2880

2023-12-31

International Journal of Legal Studies ( IJOLS )

Abstract:The objective of this paper is to analyse the threats arising from the rapid development of information and communication technologies (ICTs) without which contemporary information-based societies would not be able to function properly. The authors have advanced the thesis that most perpetrators turn to social engineering methods to carry out cyberattacks, while users of information systems are the weakest links of every cybersecurity management system. The article is also an attempt to define the notions of cybersecurity and cybersecurity management. To this end, the authors have analysed the applicable legal regulations.They have also explored cyberthreats to which small and medium-sized enterprises are exposed, and demonstrated opportunities for further research into the issues being discussed.
knowCC: Knowledge, awareness of computer & cyber ethics between CS/non-CS university students

Naresh Kshetri,Vasudha,Denisa Hoxha

2023-10-19

Abstract:Technology has advanced dramatically in the previous several years. There are also cyber assaults. Cyberattacks pose a possible danger to information security and the general public. Since data practice and internet consumption rates continue to upswing, cyber awareness has become progressively important. Furthermore, as businesses pace their digital transformation with mobile devices, cloud services, communal media, and Internet of Things services, cybersecurity has appeared as a critical issue in corporate risk management. This research focuses on the relations between cybersecurity awareness, cyber knowledge, computer ethics, cyber ethics, and cyber behavior, as well as protective tools, across university students in general. The findings express that while internet users are alert of cyber threats, they only take the most elementary and easy-to-implement precautions. Several knowledge and awareness have been proposed to knob the issue of cyber security. It also grants the principles of cybersecurity in terms of its structure, workforces, and evidence pertaining to the shield of personal information in the cyber world. The first step is for people to educate themselves about the negative aspects of the internet and to learn more about cyber threats so that they can notice when an attack is taking place. To validate the efficiency of the suggested analysis between CS and non-CS university students, case study along with several comparisons are provided.

Cryptography and Security
Cyber Security Awareness Campaigns: Why do they fail to change behaviour?

Maria Bada,Angela M. Sasse,Jason R. C. Nurse

DOI: https://doi.org/10.48550/arXiv.1901.02672

2019-01-09

Abstract:The present paper focuses on Cyber Security Awareness Campaigns, and aims to identify key factors regarding security which may lead them to failing to appropriately change people's behaviour. Past and current efforts to improve information-security practices and promote a sustainable society have not had the desired impact. It is important therefore to critically reflect on the challenges involved in improving information-security behaviours for citizens, consumers and employees. In particular, our work considers these challenges from a Psychology perspective, as we believe that understanding how people perceive risks is critical to creating effective awareness campaigns. Changing behaviour requires more than providing information about risks and reactive behaviours - firstly, people must be able to understand and apply the advice, and secondly, they must be motivated and willing to do so - and the latter requires changes to attitudes and intentions. These antecedents of behaviour change are identified in several psychological models of behaviour. We review the suitability of persuasion techniques, including the widely used 'fear appeals'. From this range of literature, we extract essential components for an awareness campaign as well as factors which can lead to a campaign's success or failure. Finally, we present examples of existing awareness campaigns in different cultures (the UK and Africa) and reflect on these.

Cryptography and Security,Computers and Society,Human-Computer Interaction

Citizens’ Cybersecurity Behavior: Some Major Challenges

A Novel Approach to the Behavioral Aspects of Cybersecurity

Cybersecurity for children: an investigation into the application of social media

Cyber Security Awareness, Knowledge and Behavior: A Comparative Study

Cyber Security Behaviour In Organisations

Citizens' engagement with cybersecurity measures in Bangladesh: a cross-sectional study

Emergent Behavior in Cybersecurity

Individual and Contextual Variables of Cyber Security Behaviour -- An empirical analysis of national culture, industry, organisation, and individual variables of (in)secure human behaviour

Exploring Workers' Subjective Experiences of Habit Formation in Cybersecurity: A Qualitative Survey

Legal Protection of the Cyber-security Culture

Research on Frontier and Trends of Science of Cybersecurity

A Typology of Cybersecurity Behavior among Knowledge Workers

An Investigation on Cyber Security Threats and Security Models

Cyber Security Threats and Countermeasures in Digital Age

'They're all about pushing the products and shiny things rather than fundamental security' Mapping Socio-technical Challenges in Securing the Smart Home

Developing a cyber security culture: Current practices and future needs

Are critical success factors for cybersecurity just technical issues Cybersecurity management and the human factor

A Study on Challenges Faced by Cyber Security on the Latest Technologies

CYBERSECURITY MANAGEMENT – CURRENT STATE AND DIRECTIONS OF CHANGE

knowCC: Knowledge, awareness of computer & cyber ethics between CS/non-CS university students

Cyber Security Awareness Campaigns: Why do they fail to change behaviour?