A systematic literature review of cybersecurity scales assessing information security awareness
Information Security Awareness (ISA) is a significant concept that got considerable attention recently and can assist in minimizing the risks associated with information security breaches. Several measurement scales have been developed in this regard, as measuring users’ ISA is paramount. Although I...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Elsevier
2023-03-01
|
| Series: | Heliyon |
| Subjects: | |
| Online Access: | http://www.sciencedirect.com/science/article/pii/S240584402301441X |
| _version_ | 1827972566689513472 |
|---|---|
| author | Rohani Rohan Debajyoti Pal Jari Hautamäki Suree Funilkul Wichian Chutimaskul Himanshu Thapliyal |
| author_facet | Rohani Rohan Debajyoti Pal Jari Hautamäki Suree Funilkul Wichian Chutimaskul Himanshu Thapliyal |
| author_sort | Rohani Rohan |
| collection | DOAJ |
| description | Information Security Awareness (ISA) is a significant concept that got considerable attention recently and can assist in minimizing the risks associated with information security breaches. Several measurement scales have been developed in this regard, as measuring users’ ISA is paramount. Although ISA specific scales are very important, yet what methodological rigor they use in terms of initial conceptualization of ISA, data collection and analysis during the development, and scale validation of such scales are some unknown aspects. Therefore, we provide a comprehensive review of the existing ISA specific scales to address all the above concerns. A popular method, PRISMA, is utilized, and a total of 24 articles that match with criteria of this research are included for the final in-depth analysis. Also, a holistic evaluation framework is developed containing three phases and 19 criteria. Findings revealed that most studies treat ISA as a multi-dimensional construct, and ISA researchers rarely conduct both pilot testing and pre-text evaluation while validating and refining the initial scales. Additionally, several articles did not report some of the essential elements used for checking the rigor of factor analysis, and evidence for validities of the identified scales is inadequate. Consequently, existing ISA specific scales must be improved both in terms of the methodological thoroughness of the scale development procedure and their validities. Moreover, not only justifying why the development of a new scale is necessary, but also improving the quality of the existing scales by doing multiple iterations is significant in the future. Likewise, the inclusion of all the dimensions of ISA, while generating the initial items pool is an important aspect to be considered. A thorough discussion, recommendations for future research, conclusions, and study limitations are provided. |
| first_indexed | 2024-04-09T19:22:58Z |
| format | Article |
| id | doaj.art-053d62ae75f64024a58ff0bb57af7b8b |
| institution | Directory Open Access Journal |
| issn | 2405-8440 |
| language | English |
| last_indexed | 2024-04-09T19:22:58Z |
| publishDate | 2023-03-01 |
| publisher | Elsevier |
| record_format | Article |
| series | Heliyon |
| spelling | doaj.art-053d62ae75f64024a58ff0bb57af7b8b2023-04-05T08:21:30ZengElsevierHeliyon2405-84402023-03-0193e14234A systematic literature review of cybersecurity scales assessing information security awarenessRohani Rohan0Debajyoti Pal1Jari Hautamäki2Suree Funilkul3Wichian Chutimaskul4Himanshu Thapliyal5School of Information Technology, King Mongkut's University of Technology Thonburi, Bangkok 10140, ThailandInnovative Cognitive Computing Research Center (IC2), King Mongkut's University of Technology Thonburi, Bangkok 10140, Thailand; Corresponding author.School of Technology, JAMK University of Applied Sciences, Jyväskylä, FinlandSchool of Information Technology, King Mongkut's University of Technology Thonburi, Bangkok 10140, ThailandSchool of Information Technology, King Mongkut's University of Technology Thonburi, Bangkok 10140, ThailandDepartment of Electrical Engineering and Computer Science, University of Tennessee, Knoxville, USAInformation Security Awareness (ISA) is a significant concept that got considerable attention recently and can assist in minimizing the risks associated with information security breaches. Several measurement scales have been developed in this regard, as measuring users’ ISA is paramount. Although ISA specific scales are very important, yet what methodological rigor they use in terms of initial conceptualization of ISA, data collection and analysis during the development, and scale validation of such scales are some unknown aspects. Therefore, we provide a comprehensive review of the existing ISA specific scales to address all the above concerns. A popular method, PRISMA, is utilized, and a total of 24 articles that match with criteria of this research are included for the final in-depth analysis. Also, a holistic evaluation framework is developed containing three phases and 19 criteria. Findings revealed that most studies treat ISA as a multi-dimensional construct, and ISA researchers rarely conduct both pilot testing and pre-text evaluation while validating and refining the initial scales. Additionally, several articles did not report some of the essential elements used for checking the rigor of factor analysis, and evidence for validities of the identified scales is inadequate. Consequently, existing ISA specific scales must be improved both in terms of the methodological thoroughness of the scale development procedure and their validities. Moreover, not only justifying why the development of a new scale is necessary, but also improving the quality of the existing scales by doing multiple iterations is significant in the future. Likewise, the inclusion of all the dimensions of ISA, while generating the initial items pool is an important aspect to be considered. A thorough discussion, recommendations for future research, conclusions, and study limitations are provided.http://www.sciencedirect.com/science/article/pii/S240584402301441XCybersecurityFactor analysisInformation security awarenessScale developmentReliabilityValidity |
| spellingShingle | Rohani Rohan Debajyoti Pal Jari Hautamäki Suree Funilkul Wichian Chutimaskul Himanshu Thapliyal A systematic literature review of cybersecurity scales assessing information security awareness Heliyon Cybersecurity Factor analysis Information security awareness Scale development Reliability Validity |
| title | A systematic literature review of cybersecurity scales assessing information security awareness |
| title_full | A systematic literature review of cybersecurity scales assessing information security awareness |
| title_fullStr | A systematic literature review of cybersecurity scales assessing information security awareness |
| title_full_unstemmed | A systematic literature review of cybersecurity scales assessing information security awareness |
| title_short | A systematic literature review of cybersecurity scales assessing information security awareness |
| title_sort | systematic literature review of cybersecurity scales assessing information security awareness |
| topic | Cybersecurity Factor analysis Information security awareness Scale development Reliability Validity |
| url | http://www.sciencedirect.com/science/article/pii/S240584402301441X |
| work_keys_str_mv | AT rohanirohan asystematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT debajyotipal asystematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT jarihautamaki asystematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT sureefunilkul asystematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT wichianchutimaskul asystematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT himanshuthapliyal asystematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT rohanirohan systematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT debajyotipal systematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT jarihautamaki systematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT sureefunilkul systematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT wichianchutimaskul systematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness AT himanshuthapliyal systematicliteraturereviewofcybersecurityscalesassessinginformationsecurityawareness |