ALL libraries (COBIB.SI union bibliographic/catalogue database)
  • We need to aim at the top [Elektronski vir] : factors associated with cybersecurity awareness of cyber and information security decision-makers
    Vrhovec, Simon ; Markelj, Blaž
    Cyberattacks pose a significant business risk to organizations. Although there is ample literature focusing on why people pose a major risk to organizational cybersecurity and how to deal with it, ... there is surprisingly little we know about cyber and information security decision-makers who are essentially the people in charge of setting up and maintaining organizational cybersecurity. In this paper, we study cybersecurity awareness of cyber and information security decision-makers, and investigate factors associated with it. We conducted an online survey among Slovenian cyber and information security decision-makers (N = 283) to (1) determine whether their cybersecurity awareness is associated with adoption of antimalware solutions in their organizations, and (2) explore which organizational factors and personal characteristics are associated with their cybersecurity awareness. Our findings indicate that awareness of well-known threats and solutions seems to be quite low for individuals in decision-making roles. They also provide insights into which threats (e.g., DDoS attacks, botnets, industrial espionage, and phishing) and solutions (e.g., security operation center (SOC), advanced antimalware solutions with EDR/XDR capabilities, organizational critical infrastructure access control, centralized device management, multi-factor authentication, centralized management of software updates, and remote data deletion on lost or stolen devices) are cyber and information security decision-makers the least aware of. We uncovered that awareness of certain threats and solutions is positively associated with either adoption of advanced antimalware solutions with EDR/XDR capabilities or adoption of SOC. Additionally, we identified significant organizational factors (organizational role type) and personal characteristics (gender, age, experience with information security and experience with IT) related to cybersecurity awareness of cyber and information security decision-makers. Organization size and formal education were not significant. These results offer insights that can be leveraged in targeted cybersecurity training tailored to the needs of groups of cyber and information security decision-makers based on these key factors.
    Source: ArXiv.org [Elektronski vir]. - ISSN 2331-8422 (6 Apr. 2024, 1 spletni vir (1 datoteka PDF (21 str.)))
    Type of material - e-article ; adult, serious
    Publish date - 2024
    Language - english
    COBISS.SI-ID - 191962371

    Link(s):

    https://arxiv.org/pdf/2404.04725.pdf

Shelf entry