The Determinants of Risky Cybersecurity Behaviour: A Case Study Among Employees in Water Sector in Malaysia

Abstract

Objective: Cybersecurity threats are a growing concern around the world. Research found that the weakest element in the cybersecurity chain is that of the human. The use of security technologies failed to address the problem in instances where employees engage in activities that place themselves and the company at risk. Hence, the role human factors play in cybersecurity is crucial. The present study aims to examine the effects of information security issues awareness, top management support, leadership, information security policy and cybersecurity awareness training on risky cybersecurity behaviour among employees in water sector.
 
 Method: The quantitative method was applied in this study. The data were collected from 425 employees from four water companies located in northern states of Malaysia. The respondents are selected using disproportionate stratified random sampling technique. The survey was conducted using questionnaire. PLS-SEM was used to test the proposed hypotheses.
 
 Results: The results show that security issues awareness and top management support are negatively related to risky cybersecurity behaviour. This suggest that the greater security issues awareness and top management support, lower the tendency to engage in risky cybersecurity behaviour among employees. Contrary to the prediction, cybersecurity awareness training was found to be positively related with risky cybersecurity behaviour.
 
 Conclusions: The findings of the study have several theoretical and practical implications. Security issues awareness and top management support are important factors to avoid threat of cyber-attacks. By ensuring cybersecurity, water security is stored hence the well-being of people is taken care since water is a fundamental need of human lives. The stability and security of the country also can be maintained with secure and sustainable water resiliency. Finally, the economic losses due to cyber-attacks can be reduced.