A taxonomy of perceived information security and privacy threats among IT security students

Abstract

The purpose of this study is to explore students' perceived information security and privacy (IS&P) threats and to classify them in a way that helps in analyzing the problem, creating awareness measures and further improving students' IS&P education. Using a qualitative research approach, a group of forty two Master's degree IT students identified seventy five IS&P threats related to them. The identified threats were classified into fourteen categories. Further, using the affinity diagraming technique, the categories were grouped into four domains -Personnel, Devices, Intranet and Internet. In this way, we defined a taxonomy of students' perceived IS&P threats as well as a model that highlights the domains where students consider themselves prone to IS&P threats. The proposed taxonomy and the domain model can be used as a benchmark for designing information security awareness assessment instruments as well as preparing information security awareness programs. The taxonomy can also be used for highlighting areas where students lack information security related knowledge.

Assessing the Effects of Gamification on Enhancing Information Security Awareness Knowledge

“…The HAIS-Q questionnaire used 21 items to assess students' ISA general knowledge of the seven areas: password management, email use, Internet use, social media use, mobile devices, information handling, and incident reporting. As mentioned earlier, the HAIS-Q was appropriate to measure students' performance because of its consistency with IS education topics [3] and students' perceived threats domains [20]. Table 1 shows the connection between ISA knowledge topics and the areas of the HAIS-Q.…”

“…Parsons et al [1] showed that the HAIS-Q may provide a complete understanding of cybersecurity vulnerabilities caused by human behavior. The IS focuses of the HAIS-Q are primarily aligned with IS education topics suggested by Futcher et al [3] and with students' perceived threats domains identified by Farooq et al [20]. Empirically, the HAIS-Q measurement was utilized to examine the relationship between individual differences and ISA [19] and explain undergraduates' problematic information security behaviors [21].…”

AVARCIBER: a framework for assessing cybersecurity risks

“…In addition, continuing with the application of the snowball technique [25] to the conceptual models indicated in the previous articles, the following conceptual models of ontologies and taxonomies have been considered for this proposal: [26], focused on asset ontologies per user; [27], focused on asset ontologies; [28], paper focused on taxonomy of impacts on assets; [29], focused on mobile asset taxonomy; [30], focused on threat taxonomy; [31], focused on taxonomy of voice over IP threats; [32], focused on attack ontology; [33], focused on attack taxonomy; [34], focused on vulnerability taxonomy; [35], focused on vulnerability taxonomy based on information attributes; [36], paper focused on vulnerability taxonomy; and [37], focused on vulnerability taxonomy.…”

Towards Comprehensive Information Security Awareness: A Systematic Classification of Concerns among University Students

“…The survey took 25-30 minute on an average. Seventy four concerns were taken from (Farooq et al, 2016), and each was presented with a standard statement "How concerned you are for…" in the questionnaire. A 7-point measurement scale (1: not at all concern to 7: extremely concerned) was used.…”