Towards Comprehensive Information Security Awareness: A Systematic Classification of Concerns among University Students

In this paper, we have systematically identified and classified information security concerns (ISCs) of university students into areas where users perceive information security threats. 354 university students were asked to elicit their level of concern on a given set of 74 ISCs using a 7-point scale. Factor analysis (PCA) produced an 11-factor solution, each factor depicting an area of concern. These areas were related to Personal (legal awareness), Social (Sociality), Institutional (Staff member lapses, University networks), Technological (Online social network use, Intrusive service providers, Web browsing and email, Smartphone use, Electronic device use, and Conventional threats), and Non-technological (Cards and wallets security) aspects of student’s day-to-day life. The majority of the students (66%) showed concerns related to online social network use, whereas, only 40% of them shown concerns related to sociality. The highest level of concerns was related to service providers, whereas the lowest level of concerns was related to sociality.

Content

Author and article information

Contributors

Ali Farooq

Shamil Alifov

Seppo Virtanen

Jouni Isoaho

Conference

Publication date: July 2018

Publication date (Print): July 2018

Pages: 1-6

Affiliations

[0001]Department of Future Technologies

University of Turku, Finland

[0002]TurkuSec Ry

Turku, Finland

Article

DOI: 10.14236/ewic/HCI2018.117

SO-VID: c39ee61e-78dd-4c92-a7d1-2c5ac2d7b12a

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: Proceedings of the 32nd International BCS Human Computer Interaction Conference

Conference acronym: HCI

Conference number: 32

Conference location: Belfast, UK

Conference date: 4 - 6 July 2018

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Human Computer Interaction Conference

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/HCI2018.117

Self URI (journal page): https://ewic.bcs.org/

References

S. Abraham (2011). Information Security Behavior: Factors and Research Directions In AMCIS 2011.
F. A. Aloul (2010). Informa tion Security Awareness in UAE: A survey paper In 2010 International Conference for Internet Technology and Secured Transactions. (pp. 1–6). IEEE.
E. Amankwa M. Loock, & E. Kritzinger (2014). A conceptual analysis of information security education, information security training and information security awareness definitions In The 9th International Conference for Internet Technology and Secured Transactions (ICITST-2014) (pp. 248–252). IEEE.
S. Aurigemma, & R. Panko (2012). A Composite Framework for Behavioral Compliance with Information Security Policies In 45th Hawaii International Conference on System Sciences (pp. 3248–3257). IEEE.
B. Bulgurcu H. Cavusoglu, & I. Benbasat (2009). Roles of information security awareness and perceived fairness in information security policy compliance In 15th Americas Conference on Information Systems 2009, AMCIS 2009 (Vol. 5, pp. 3269–3277).
L. J. Camp (2009). Mental models of privacy and security IEEE Technology and Society Magazine 28(3), 37–46.
R. E. Crossler F. Bélanger, & D. Ormond (2017). The quest for complete security: An empirical analysis of users' multi-layered protection from security threats Information Systems Frontiers 1–15.
D'J. Arcy A. Hovav, & D. Galletta (2009). User Awareness of Security Countermeasures and its Impact on Information Systems Misuse: A Deterence Approach Information Systems Research 20(1), 79–98.
L. R. Fabrigar D. T. Wegener R. C. Maccallum, & E. J. Strahan (1999). Evaluating the Use of Exploratory Factor Analysis in Psychological Research Psychological Methods 4(3), 272–299.
A. Farooq J. J. Isoaho S. Virtanen, & J. J. Isoaho (2015). Information Security Awareness in Educational Institution: An Analysis of Students' Individual Factors In Proceedings - 14th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2015 (Vol. 1, pp. 352–359). IEEE.
A. Farooq, & S. R. U. Kakakhel (2013). Information security awareness: Comparing perceptions and training preferences In Conference Proceedings - 2013 2nd National Conference on Information Assurance, NCIA 2013 (pp. 53–57). IEEE Computer Society.
A. Farooq S. R. U. Kakakhel S. Virtanen, & J. Isoaho (2016). A taxonomy of perceived information security and privacy threats among IT security students In 10th International Conference for Internet Technology and Secured Transactions, ICITST 2015 (pp. 280–286). IEEE.
S. Furnell, & N. Clarke (2012). Power to the people? The evolving recognition of human aspects of security Computers & Security 31(8), 983–988.
S. M. Furnell A. Jusoh, & D. Katsabas (2006). The challenges of understanding and using security: A survey of end-users Computers & Security 25(1), 27–35.
M. J. Grant, & A. Booth (2009). A typology of reviews: an analysis of 14 review types and associated methodologies Health Information & Libraries Journal 26(2), 91–108.
A. E. Howe I. Ray M. Roberts M. Urbanska, & Z. Byrne (2012). The Psychology of Security for the Home Computer User In 2012 IEEE Symposium on Security and Privacy (pp. 209–223). IEEE.
B. L. Ingerman, & C. Yang (2011). Top-Ten IT Issues 2011 EDUCAUSE Review 46(3), 24.
L. Jaeger (2018). Information Security Awareness: Literature Review and Integrative Framework In 51st Hawaii International Conference on System Sciences.
F. H. Katz (2005). The Effect of a University Information Security Survey on Instruction Methods in Information Security In Proceedings of the 2nd annual conference on Information security curriculum development - InfoSecCD '05 (p. 43). New York, New York, USA: ACM Press.
B. Kerievsky, & Bruce. (1976). Security and Confidentiality in a University Computer Network ACM SIGUCCS Newsletter 6(3), 9–11.
E. B. Kim (2013). Information Security Awareness Status of Business College: Undergraduate Students Information Security Journal: A Global Perspective 22(4), 171–179.
E. B. Kim (2014). Recommendations for information security awareness training for college students Information Management & Computer Security 22(1), 115–126.
E. Kritzinger, & S. H. von Solms (2010). Cyber security for home users: A new way of protection through awareness enforcement Computers & Security 29(8), 840–847.
S. Loucks-Horsley (2010). Designing professional development for teachers of science and mathematics Corwin Press.
A. McCormac T. Zwaans K. Parsons D. Calic M. Butavicius, & M. Pattinson (2017). Individual differences and Information Security Awareness Computers in Human Behavior 69 151–156.
G. R. Milne L. I. Labrecque, & C. Cromer (2009). Toward an Understanding of the Online Consumer's Risky Behavior and Protection Practices Journal of Consumer Affairs 43(3), 449–473.
A. Mylonas A. Kastania, & D. Gritzalis (2013). Delegate the smartphone user? Security awareness in smartphone platforms Computers & Security 34 47–66.
Jason W. Osborne A. B. Costello (2009). Best practices in exploratory factor analysis: Four recommendations for getting the most from your analysis Pan-Pacific Management Review 12(2), 131–146.
S. Pahnila M. Siponen, & A. Mahmood (2007). Employees' Behavior towards IS Security Policy Compliance In 2007 40th Annual Hawaii International Conference on System Sciences (HICSS'07) (p. 156b–156b). IEEE.
K. Parsons A. McCormac M. Butavicius M. Pattinson, & C. Jerram (2014). Determining employee awareness using the Human Aspects of Information Security Questionnaire (HAIS-Q) Computers & Security 42 165–176.
Y. Rezgui, & A. Marks (2008). Information security awareness in higher education: An exploratory study Computers & Security 27(7), 241–253.
M. T. Siponen, & H. Oinas-Kukkonen (2007). A review of information security issues and respective research contributions ACM SIGMIS Database 38(1), 60.
J. M. Stanton K. R. Stam P. Mastrangelo, & J. Jolton (2005). Analysis of end user security behaviors Computers and Security 24(2), 124–133.
A. Tsohou S. Kokolakis M. Karyda, & E. Kiountouzis (2008). Investigating Information Security Awareness: Research and Practice Gaps Information Security Journal: A Global Perspective 17(5–6), 207–227.

Comments

Comment on this article

[1] S. Abraham (2011). Information Security Behavior: Factors and Research Directions In AMCIS 2011.

[2] F. A. Aloul (2010). Informa tion Security Awareness in UAE: A survey paper In 2010 International Conference for Internet Technology and Secured Transactions. (pp. 1–6). IEEE.

[3] E. Amankwa M. Loock, & E. Kritzinger (2014). A conceptual analysis of information security education, information security training and information security awareness definitions In The 9th International Conference for Internet Technology and Secured Transactions (ICITST-2014) (pp. 248–252). IEEE.

[4] S. Aurigemma, & R. Panko (2012). A Composite Framework for Behavioral Compliance with Information Security Policies In 45th Hawaii International Conference on System Sciences (pp. 3248–3257). IEEE.

[5] B. Bulgurcu H. Cavusoglu, & I. Benbasat (2009). Roles of information security awareness and perceived fairness in information security policy compliance In 15th Americas Conference on Information Systems 2009, AMCIS 2009 (Vol. 5, pp. 3269–3277).

[6] L. J. Camp (2009). Mental models of privacy and security IEEE Technology and Society Magazine 28(3), 37–46.

[7] R. E. Crossler F. Bélanger, & D. Ormond (2017). The quest for complete security: An empirical analysis of users' multi-layered protection from security threats Information Systems Frontiers 1–15.

[8] D'J. Arcy A. Hovav, & D. Galletta (2009). User Awareness of Security Countermeasures and its Impact on Information Systems Misuse: A Deterence Approach Information Systems Research 20(1), 79–98.

[9] L. R. Fabrigar D. T. Wegener R. C. Maccallum, & E. J. Strahan (1999). Evaluating the Use of Exploratory Factor Analysis in Psychological Research Psychological Methods 4(3), 272–299.

[10] A. Farooq J. J. Isoaho S. Virtanen, & J. J. Isoaho (2015). Information Security Awareness in Educational Institution: An Analysis of Students' Individual Factors In Proceedings - 14th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2015 (Vol. 1, pp. 352–359). IEEE.

[11] A. Farooq, & S. R. U. Kakakhel (2013). Information security awareness: Comparing perceptions and training preferences In Conference Proceedings - 2013 2nd National Conference on Information Assurance, NCIA 2013 (pp. 53–57). IEEE Computer Society.

[12] A. Farooq S. R. U. Kakakhel S. Virtanen, & J. Isoaho (2016). A taxonomy of perceived information security and privacy threats among IT security students In 10th International Conference for Internet Technology and Secured Transactions, ICITST 2015 (pp. 280–286). IEEE.

[13] S. Furnell, & N. Clarke (2012). Power to the people? The evolving recognition of human aspects of security Computers & Security 31(8), 983–988.

[14] S. M. Furnell A. Jusoh, & D. Katsabas (2006). The challenges of understanding and using security: A survey of end-users Computers & Security 25(1), 27–35.

[15] M. J. Grant, & A. Booth (2009). A typology of reviews: an analysis of 14 review types and associated methodologies Health Information & Libraries Journal 26(2), 91–108.

[16] A. E. Howe I. Ray M. Roberts M. Urbanska, & Z. Byrne (2012). The Psychology of Security for the Home Computer User In 2012 IEEE Symposium on Security and Privacy (pp. 209–223). IEEE.

[17] B. L. Ingerman, & C. Yang (2011). Top-Ten IT Issues 2011 EDUCAUSE Review 46(3), 24.

[18] L. Jaeger (2018). Information Security Awareness: Literature Review and Integrative Framework In 51st Hawaii International Conference on System Sciences.

[19] F. H. Katz (2005). The Effect of a University Information Security Survey on Instruction Methods in Information Security In Proceedings of the 2nd annual conference on Information security curriculum development - InfoSecCD '05 (p. 43). New York, New York, USA: ACM Press.

[20] B. Kerievsky, & Bruce. (1976). Security and Confidentiality in a University Computer Network ACM SIGUCCS Newsletter 6(3), 9–11.

[21] E. B. Kim (2013). Information Security Awareness Status of Business College: Undergraduate Students Information Security Journal: A Global Perspective 22(4), 171–179.

[22] E. B. Kim (2014). Recommendations for information security awareness training for college students Information Management & Computer Security 22(1), 115–126.

[23] E. Kritzinger, & S. H. von Solms (2010). Cyber security for home users: A new way of protection through awareness enforcement Computers & Security 29(8), 840–847.

[24] S. Loucks-Horsley (2010). Designing professional development for teachers of science and mathematics Corwin Press.

[25] A. McCormac T. Zwaans K. Parsons D. Calic M. Butavicius, & M. Pattinson (2017). Individual differences and Information Security Awareness Computers in Human Behavior 69 151–156.

[26] G. R. Milne L. I. Labrecque, & C. Cromer (2009). Toward an Understanding of the Online Consumer's Risky Behavior and Protection Practices Journal of Consumer Affairs 43(3), 449–473.

[27] A. Mylonas A. Kastania, & D. Gritzalis (2013). Delegate the smartphone user? Security awareness in smartphone platforms Computers & Security 34 47–66.

[28] Jason W. Osborne A. B. Costello (2009). Best practices in exploratory factor analysis: Four recommendations for getting the most from your analysis Pan-Pacific Management Review 12(2), 131–146.

[29] S. Pahnila M. Siponen, & A. Mahmood (2007). Employees' Behavior towards IS Security Policy Compliance In 2007 40th Annual Hawaii International Conference on System Sciences (HICSS'07) (p. 156b–156b). IEEE.

[30] K. Parsons A. McCormac M. Butavicius M. Pattinson, & C. Jerram (2014). Determining employee awareness using the Human Aspects of Information Security Questionnaire (HAIS-Q) Computers & Security 42 165–176.

[31] Y. Rezgui, & A. Marks (2008). Information security awareness in higher education: An exploratory study Computers & Security 27(7), 241–253.

[32] M. T. Siponen, & H. Oinas-Kukkonen (2007). A review of information security issues and respective research contributions ACM SIGMIS Database 38(1), 60.

[33] J. M. Stanton K. R. Stam P. Mastrangelo, & J. Jolton (2005). Analysis of end user security behaviors Computers and Security 24(2), 124–133.

[34] A. Tsohou S. Kokolakis M. Karyda, & E. Kiountouzis (2008). Investigating Information Security Awareness: Research and Practice Gaps Information Security Journal: A Global Perspective 17(5–6), 207–227.

Celebrating 65 years of The Computer Journal - free-to-read perspectives - bcs.org/tcj65