A Descriptive Review and Classification of Organizational Information Security Awareness Research

Abstract

Information security awareness (ISA) is a vital component of information security in organizations. The purpose of this research is to descriptively review and classify the current body of knowledge on ISA. A sample of 59 peerreviewed academic journal articles, which were published over the last decade from 2008 to 2018, were analyzed. Articles were classified using coding techniques from the grounded theory literature-review method. The results show that ISA research is evolving with behavioral research studies still being explored. Quantitative empirical research is the dominant methodology and the top three theories used are general deterrence theory, theory of planned behavior, and protection motivation theory. Future research could focus on qualitative approaches to provide greater depth of ISA understanding.

Cyber Suraksha: a card game for smartphone security awareness

“…The general deterrence theory, TPB and PMT are the most widely used theories in information security awareness research (Lebek et al , 2013). While these theories provide insights into information security awareness, some researchers doubt their effectiveness (Hutchinson and Ophoff, 2019). Three essential requirements for behaviour change are capability, opportunity and motivation (Michie et al , 2011).…”

“…Hence, there is a need to focus on improving the cybersecurity behaviour of smartphone users in India. Although the theory of planned behaviour (TPB) and protection motivation theory (PMT) are popular in information security awareness research, they are ineffective (Lebek et al , 2013; Hutchinson and Ophoff, 2019). This need to design better interventions motivated the researchers to develop a serious game for cybersecurity awareness focusing on the threats smartphone users face based on FBM.…”