The Cybersecurity Awareness INventory (CAIN): Early Phases of Development of a Tool for Assessing Cybersecurity Knowledge Based on the ISO/IEC 27032

Abstract

Knowledge of possible cyber threats as well as awareness of appropriate security measures plays a crucial role in the ability of individuals to not only discriminate between an innocuous versus a dangerous cyber event, but more importantly to initiate appropriate cybersecurity behaviors. The purpose of this study was to construct a Cybersecurity Awareness INventory (CAIN) to be used as an instrument to assess users’ cybersecurity knowledge by providing a proficiency score that could be correlated with cyber security behaviors. A scale consisting of 46 items was derived from ISO/IEC 27032. The questionnaire was administered to a sample of college students (N = 277). Based on cybersecurity behaviors reported to the research team by the college’s IT department, each participant was divided into three groups according to the risk reports they received in the past nine months (no risk, low risk, and medium risk). The ANOVA results showed a statistically significant difference in CAIN scores between those in the no risk and medium-risk groups; as expected, CAIN scores were lower in the medium-risk group. The CAIN has the potential to be a useful assessment tool for cyber training programs as well as future studies investigating individuals’ vulnerability to cyberthreats.

Mitigating the Impact of Work Overload on Cybersecurity Behavior: The Moderating Influence of Corporate Ethics—A Mediated Moderation Analysis

“…Preventive behaviors mitigate risks before an incident occurs, reactive behaviors respond to an incident after it occurs, and adaptive behaviors involve changing practices based on past incidents or new information about potential threats [35]. In the individual context, cybersecurity behavior involves actions such as creating and managing strong passwords, avoiding suspicious emails or websites, regularly updating and patching software, using secure networks, and backing up data [36]. Research has shown that these behaviors are influenced by a range of factors, including individuals' knowledge, attitudes, and perceptions of threat and vulnerability as well as organizational culture, policies, and training [24][25][26][27]37].…”