protectiv & security researches

protectiv & security researches

Designing and Constructing a Tool for the Evaluation of Cyber Security Culture and Awareness

Document Type : Original Article

Authors
Seddigheh Heydari 1
Majid Barzegar 2
Amirhossein Mohammaddavoudi 3
1 Faculty of Humanities, Saveh Branch, Islamic Azad University, Saveh, Iran
2 Department of Psychology, Faculty of Psychology and Educational Sciences, Marodasht Branch, Islamic Azad University, Marodasht, Iran (corresponding author)
3 Department of Educational Management, Faculty of Humanities, Saveh Branch, Islamic Azad University, Saveh, Iran
Abstract
The current research was conducted with the aim of designing and constructing a tool for the evaluation of cyber security culture and awareness in 1401 in a mixed (qualitative-quantitative) method to answer the question of what items the cyber security culture and awareness evaluation tool consists of? In the qualitative part, the upstream texts of the last three years and the opinions of the experts in this field were used to get the basic structure of the tool, and in the quantitative part, the basic structure of the tool was given to a small sample of the target community to determine the validity and reliability of the tool based on the obtained data. In order to check the validity, content validity, discriminant validity and internal consistency and intra-cluster correlation were used to check the validity of the data. The error percentage of the identification algorithm was 4%, which was calculated with the Holstie coefficient. The findings from the qualitative part showed the number of 75 effective components in cyber security culture and awareness, based on which the initial pool was prepared with 98 items. After placing the initial pool of items at the disposal of the experts, the findings of the content validity check showed that 56 items did not have the required quality and were removed. Examining the differential power showed that the power was higher than 1 for all the items, except item number 41. The validity results showed that item number 8 lacked acceptable correlation, so it was removed from the final form. The upper limit of the ICC confidence interval also indicated a very good agreement between the judges. In general, it can be said that Form 41 of the prepared questionnaires has acceptable content validity and reliability, therefore, it has the necessary conditions for examination at the level of the main sample of the target group and it can be used in a large sample of the target group, in order to achieve the final structure and Norm scores were used..
Keywords
Awareness
Culture
Cyber-Security
Reliability
Validity
 ترخان، محمدرضا و وحید فتوح‌آبادی (1395)، ارائه یک الگوی مفهومی مبتنی بر آگاهی موقعیتی با هدف بهبود امنیت سایبری، دومین کنفرانس بین‌المللی یافته‌های نوین پژوهشی در مهندسی برق و علوم کامپیوتر، رامسر: https://civilica.com/doc/545851.
تقی‌پور، رضا و دیگران (1399)، الگوی راهبردی مدیریت یکپارچه پیشگیری و مقابله با جرائم سایبری در جمهوری اسلامی ایران. فصلنامه پژوهش‌های حفاظتی و امنیتی، 9(35)، 95-124.  https://jpas.ihu.ac.ir/article_206634.html?lang=fa.  
ثقفی، کامیار و علی اسماعیلی (1399)، طراحی الگوی مفهومی پایش تهدیدات سایبری جمهوری اسلامی ایران. فصلنامه پژوهش‌های حفاظتی و امنیتی، 9(35)، 65-94. https://jpas.ihu.ac.ir/article_206633.html.
رجبی، محمد و دیگران (1397)، تحلیل مضمون الزامات تحققِ امنیت انتظامی در اندیشه فرماندهی معظم کل قوا (مدظله‌العالی). فصلنامه انتظام اجتماعی‌، 10(2)، 85-108. http://sopra.jrl.police.ir/article_94576.html.
رشیدی، علی جبار و محمد شکیبازاد (1395)، ارایه چهارچوبی به منظور دستیابی به آگاهی وضعیتی سایبری پویا در صحنه نبرد سایبری، چهارمین کنفرانس بین‌المللی مهندسی برق و کامپیوتر،تهران، https://civilica.com/doc/608950
سرمد، زهره و دیگران (1400)، روش‌های تحقیق در علوم رفتاری، چاپ چهلم، تهران: انتشارات آگه.
سودی، حورا و دیگران (1398)، طراحی و روان­سنجی پرسشنامه مدرسه اثربخش با معیارهای فرهنگی جامعه ایرانی، فصلنامه رهیافتی نو در مدیریت آموزشی، 10 (4، 40)،  87-84. http://jedu.miau.ac.ir/article_3860.html
عسگری، محمود (1400)، فرهنگ امنیتی در جمهوری اسلامی ایران، فصلنامه پژوهش‌های حفاظتی و امنیتی، 10(37)، 163-196. https://jpas.ihu.ac.ir/article_206955.html.
کاویانی، حسن و دیگران (1399)، الگوی توسعه راهبردی منابع انسانی در حوزه امنیت سایبری نیروهای مسلح ج.ا.ایران. فصلنامه علمی راهبرد دفاعی، 18(1)، 37-66. https://ds.sndu.ac.ir/article_1008.html
موحدی‌راد، محمدرضا و ناصر مدیری (1393)، ارائه رویکردی ساختارمند برای پیاده سازی رزمایش‌های سایبری، اولین همایش ملی پژوهش‌های مهندسی رایانه،تهران، https://civilica.com/doc/347171.
Akhter, M. S., Islam, M. H., & Momen, M. N. (2020). Problematic internet use among university students of Bangladesh: The predictive role of age, gender, and loneliness. Journal of Human Behavior in the Social Environment, 30(8), 1082-1093. https://www.tandfonline.com/doi/abs/10.1080/10911359.2020.1784346
Al-Alawi, A. I., & Al-Bassam, S. A. (2021). Assessing The Factors of Cybersecurity Awareness in the Banking Sector. AGJSR 37 (4): 17-32. Retrieved from https://www.researchgate.net/profile/Adel-Al-Alawi/publication/352855616
Alshaikh, M. (2020). Developing cybersecurity culture to influence employee behavior: A practice perspective. Computers & Security, 98, 102003. Retrieved from https://www.sciencedirect.com/science/article/pii/S0167404820302765
Alzubaidi, A. (2021). Measuring the level of cyber-security awareness for cybercrime in Saudi Arabia. Heliyon, 7(1), e06016. https://www.sciencedirect.com/science/article/pii/S2405844021001213
Banciu, D., Radoi, M., & Belloiu, S. (2020). Information security awareness in Romanian public administration: an exploratory case study. Studies in Informatics and Control, 29(1), 121-129. https://sic.ici.ro/information-security-awareness-in-romanian-public-administration-an-exploratory-case-study/
Bino, J. V. (2021). CYBER SECURITY AWARENESS BY USING SOCIAL MEDIA PLATFORMS AMONG STUDENTS. International Journal of Research, 8(5), 581-589. Retrieved from http://ijrjournal.com/index.php/ijr/article/view/51
Cardoso, L., & Castanho, M. (2021). A CYBERCULTURE STUDY: K-POP AND THE NEW MEDIA-BTS AND TWITTER. European Journal of Social Sciences Studies, 6(6). Retrieved from https://www.oapub.org/soc/index.php/EJSSS/article/view/1127/1713
Da Veiga, A., & Martins, N. (2017). Defining and identifying dominant information security cultures and subcultures. Computers & Security, 70, 72-94. https://www.sciencedirect.com/science/article/pii/S0167404817300937
Da Veiga, A., Astakhova, L. V., Botha, A., & Herselman, M. (2020). Defining organisational information security culture—Perspectives from academia and industry. Computers & Security, 92, 101713. https://www.sciencedirect.com/science/article/pii/S0167404820300018
Elradi, M. D., Altigani, A., & Abaker, O. I. (2020). Cyber security awareness among students and faculty members in a Sudanese college. Journal of Electrical Science & Engineering, 2(2), 24–28. https://ojs.bilpublishing.com/index.php/ese/article/view/2477
Evans, M., He, Y., Luo, C., Yevseyeva, I., Janicke, H., & Maglaras, L. A. (2019). Employee perspective on information security related human error in healthcare: Proactive use of IS-CHEC in questionnaire form. IEEE Access, 7, 102087-102101. https://ieeexplore.ieee.org/abstract/document/8755984
Georgiadou, A., Mouzakitis, S., & Askounis, D. (2021a). Designing a cyber-security culture assessment survey targeting critical infrastructures during covid-19 crisis. International Journal of Network Security & Its Applications (IJNSA) Vol, 13, 33-50. Retrieved from https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3787197
Georgiadou, A., Mouzakitis, S., & Askounis, D. (2021c). Working from home during COVID-19 crisis: a cyber security culture assessment survey. Security Journal, 1-20. Retrieved from https://link.springer.com/article/10.1057/s41284-021-00286-2
Grassegger, T., & Nedbal, D. (2021). The role of employees’ information security awareness on the intention to resist social engineering. Procedia Computer Science, 181, 59-66. https://www.sciencedirect.com/science/article/pii/S1877050921001381
Khan, A. H., Sawhney, P. B., Das, S., & Pandey, D. (2020, February). SartCyber Security Awareness Measurement Model (APAT). In 2020 International Conference on Power Electronics & IoT Applications in Renewable Energy and its Control (PARC) (pp. 298-302). IEEE. Retrieved from https://ieeexplore.ieee.org/abstract/document/9087242
Ruhwanya, Z., & Ophoff, J. (2019). Information security culture assessment of small and medium-sized enterprises in Tanzania. In International Conference on Social Implications of Computers in Developing Countries (pp. 776-788). Springer, Cham. https://link.springer.com/chapter/10.1007/978-3-030-18400-1_63
Tolah, A., Furnell, S. M., & Papadaki, M. (2019). A comprehensive framework for understanding security culture in organizations. In IFIP World Conference on Information Security Education (pp. 143-156). Springer, Cham. https://link.springer.com/chapter/10.1007/978-3-030-23451-5_11
Tolah, A., Furnell, S. M., & Papadaki, M. (2021). An Empirical Analysis of the Information Security Culture Key Factors Framework. Computers & Security, 108, 1-34. https://www.sciencedirect.com/science/article/pii/S0167404821001784
Uchendu, B., Nurse, J. R., Bada, M., & Furnell, S. (2021). Developing a cyber security culture: Current practices and future needs. Computers & Security, 109, 102387. Retrieved from https://www.sciencedirect.com/science/article/pii/S016740482100211X
Yuchong, L. & Qinghui, L. (2021). A comprehensive review study of cyber-attacks and cyber security; Emerging trends and recent developments. Energy Reports, 1-11, In Press. https://www.sciencedirect.com/science/article/pii/S2352484721007289