A cybersecurity culture research philosophy and approach to develop a valid and reliable measuring instrument

Abstract

Abstract-A cybersecurity culture must be promoted at an international, national, organizational, and individual level to aid in minimizing risks from a human perspective in cyberspace. To promote such a culture it has to be understood and quantified in order to direct change. This research makes use of the disciplines of information technology and industrial psychology to define a cybersecurity culture. A quantitative research methodology, cybersecurity culture research methodology (CSeCRM), is proposed that can be used to measure a cybersecurity culture. The objective of CSeCRM is to ensure that a reliable and valid measuring instrument is used to measure cybersecurity culture. The results derived from using such an instrument can aid in identifying actions to change and direct the cybersecurity culture at, for instance, schools or businesses, at national or international level. The CSeCRM is illustrated by implementing it in an organization where a cybersecurity culture measuring instrument was validated.

For What Technology Can’t Fix: Building a Model of Organizational Cybersecurity Culture

“…However, though cybersecurity culture has a profound impact on risk, it can be difficult to identify, build, and quantify [6], [7]. Examining other kinds of organizational culture provides a foundation for a model of cybersecurity culture.…”

Cybersecurity Readiness of E-tail Organisations: A Technical Perspective

“…Cyber threats include identity theft [2] and unauthorised access to an organisational network [3]. Denial of Service (DoS) attacks, malicious insiders, web-based attacks [4], human error [3], phishing emails and inadequate security monitoring [5] are also documented threats.…”

“…Cyber threats include identity theft [2] and unauthorised access to an organisational network [3]. Denial of Service (DoS) attacks, malicious insiders, web-based attacks [4], human error [3], phishing emails and inadequate security monitoring [5] are also documented threats. There are some reasons which contribute to the success of these attacks, for example, preventative equipment failures [6], lack of technical awareness [7], unauthorised access [3] and malicious employees [4].…”

“…Denial of Service (DoS) attacks, malicious insiders, web-based attacks [4], human error [3], phishing emails and inadequate security monitoring [5] are also documented threats. There are some reasons which contribute to the success of these attacks, for example, preventative equipment failures [6], lack of technical awareness [7], unauthorised access [3] and malicious employees [4]. Some basic security controls such as encryption, anti-virus software, firewalls and intrusion detection systems (IDS) suggested by Sen, Ahmed and Islam [8] could be used to prevent cyber-attacks.…”

Cybersecurity Culture: An Ill-Defined Problem

“…While the role of cultivating a culture in pursuing cybersecurity is wellappreciated, research focusing intensely on defining and measuring cybersecurity culture is still in its infancy [7]. Furthermore, studies conducted by Reid and van Niekerk [8], [9] revealed that there are no widely accepted key concepts that delimit a cybersecurity culture.…”