Employee Information Security Awareness in the Power Generation Sector of PT ABC

Abstract

Presidential Regulation No. 82 of 2022 demonstrates the Indonesian government's dedication to protecting Vital Information Infrastructure, which has become increasingly susceptible to cyber attacks. Intrusion detections at PT ABC reached 79,575 in 2021, and malware, botnets, targeted attacks, malicious websites/domains, and ransomware attacks may cause considerable financial losses. The implication of these incidents is that employees' awareness of information security is critical, in addition to security technologies like firewalls and monitoring tools. To enhance employees' knowledge of information security, this study aims to evaluate the information security awareness among PT ABC personnel using the HAIS-Q survey instrument alongside ISO/IEC 27001:2013 criteria. The study will provide valuable recommendations to improve the organization's security protocols. This research intends to investigate the correlation between employees' knowledge, attitude, and behavior towards information security. Data was collected through a questionnaire and analyzed using the Pearson Correlation, Cronbach's Alpha, descriptive statistics, linear regression, and Kruskal-Wallis test method. The study findings suggest that the overall information security awareness level among employees is "Good". However, certain areas like internet usage, information handling, asset management, incident reporting, and the use of mobile devices need improvement. To address these areas, the study recommends promoting information security awareness according to employee categories.

Measurement of Employee Information Security Awareness: A Case Study of National Civil Service Agency

“…The questionnaire was employed as the research instrument in this study, which incorporated results from prior scholarly publications and included citations [5]- [7], [10], [16]- [19]. The security question components of the questionnaire are derived from eight areas of the ISO/IEC 27001:2013 standard [7], [11] and seven main areas of the HAIS-Q [7], [18].…”

“…The questionnaire was employed as the research instrument in this study, which incorporated results from prior scholarly publications and included citations [5]- [7], [10], [16]- [19]. The security question components of the questionnaire are derived from eight areas of the ISO/IEC 27001:2013 standard [7], [11] and seven main areas of the HAIS-Q [7], [18]. Password management, email usage, internet usage, social media usage, mobile device usage, information control, and incident reporting are among the seven domains that exhibit substantial overlap.…”

“…The study's results indicated that the research site possessed a moderate level of awareness [6], suggesting that additional monitoring efforts are necessary to raise awareness. Fadlika et al (2023) assessed PT ABC's awareness of information security through the implementation of the HAIS-Q method in conjunction with the IS/IT Asset Management Focus Area. On the basis of the user survey, the authors identified the areas in need of development but refrained from offering recommendations [7].…”

“…Fadlika et al (2023) assessed PT ABC's awareness of information security through the implementation of the HAIS-Q method in conjunction with the IS/IT Asset Management Focus Area. On the basis of the user survey, the authors identified the areas in need of development but refrained from offering recommendations [7].…”

“…The Human Aspects of Information Security-Questionnaire (HAIS-Q) is an internationally acknowledged instrument utilized to assess cognizance of information security on a global scale. The HAIS-Q has been employed in a multitude of instances, encompassing academic institutions, government agencies, and commercial enterprises [5], [7]- [10]. Despite its extensive adoption, previous research has yet to integrate the HAIS-Q with the ISO/IEC 27001:2013 standard, and no research has specifically investigated the extent of awareness of information security among employees of BKN.…”