Scientific Knowledge of the Human Side of Information Security as a Basis for Sustainable Trainings in Organizational Practices

Abstract

Comprehensive digitization leads to new challenges because of cybercrime and related security countermeasures. There is no doubt that this will fundamentally affect our lives and is leading to an increase in the importance of information security (IS). However, technology solutions alone are not sufficient to ensure IS countermeasures. The human side of security is important to protect organizational assets like user information and systems. The paper illustrates these relationships in terms of information security awareness (ISA), examining its goals and the factors influencing it through the systematic analysis and review of scientific literature and the transfer of scientific knowledge for practical purposes. We reviewed the publications of leading academic journals in the field of IS over the past decade.

Information Security Awareness in Public Administrations

“…A constant analysis of threats that companies face is essential to understanding how the strategies of attackers evolve and to building more reliable defenses. The summary of all the reports investigated reveals that cyberattacks target people not technologies [13]. The question is "why?"…”

“…But what is ISA actually? Our comprehensive review of leading academic journals shows that there is no uniform and binding definition of ISA [13]. Many theories build on the background of the scientific literature.…”

“…A number of articles in the international scientific literature are based on the KAB model-knowledge, attitude, and behavior-and show that user knowledge of, or education about, IS is a basis for reflecting on their own attitudes. The overall goal of scientific literature in this research field is to get a better understanding of people's behavior and to develop it in the proper way [13]. Therefore, a large spectrum of theories has been consulted in this context to gain knowledge of actual security behavior and the factors that [34].…”

“…All in all, there are gaps between human knowledge and human attitudes as well as between human attitudes and real human behavior. Psychological factors, subjective norms, and the sociocultural, gender, and age background in nonlinear and complex interactions have a major influence on human ISA and IS behavior [13]. A main problem for human beings seems to be the application of IS knowledge in real-world situations [39].…”

“…This is why human beings are often characterized as the "critical factor" within the reports and literature on IS processes. However, nowadays, there is a rethinking of this characterization of people [13], because there are fundamental strategic deficits in institutions themselves, as shown by several reports and studies:…”