Enhancing employees information security awareness in private and public organisations : A systematic literature review

• Preserving the confidentiality, integrity and availability (CIA) of an organisation's sensitive information systems assets against attacks and threats is a challenge in this digital age. Or-ganisations worldwide make huge investments in information security technological coun-termeasures. Nonetheless, organisations in many cases fail to protect their information as-sets as they rely mainly on technical solutions which are not contextually compatible and sufficient. As a matter of fact, a significant number of organisational information security in-cidents are due to the exploitation of human elements that directly and/or indirectly cause the majority of security incidents. Therefore, employees' information security awareness (ISA) becomes one of the critical aspects of protection against undesirable information se-curity behaviours. However, to date, there is limited synthesised knowledge about methods for enhancing ISA and integrated insights on factors affecting employees' ISA levels. This study, therefore, provides a systematic review of the literature on ISA and puts forward a state-of-the-art collection of ISA methods and factors for enhancing employees' ISA within both private and public sector organisations. The results indicate that various methods and factors are used to enhance employees' ISA in organisations. Theoretical models and gami-fication are the methods widely used in both private and public organisations, whereas the constructivist approach and violation detections are some of the methods used only in pri-vate organisations. Furthermore, this study offers some insights into the latest trends in ISA content development methods and factors, and fosters good ISA practice by disseminating information and knowledge amongst Information Security professionals to help them build an overarching ISA development programme in their organisations.

Ämnesord

NATURVETENSKAP  -- Data- och informationsvetenskap -- Datavetenskap (hsv//swe)

NATURAL SCIENCES  -- Computer and Information Sciences -- Computer Sciences (hsv//eng)

Nyckelord

Information security awareness

Literature review

Private organisations

Public organisations

Information Security Management

Awareness methods

Awareness factors

Publikations- och innehållstyp

ref (ämneskategori)

for (ämneskategori)