Exploring the Frontiers of Cybersecurity Behavior: A Systematic Review of Studies and Theories
Source abstract
Abstract
Cybersecurity procedures and policies are prevalent countermeasures for protecting organizations from cybercrimes and security incidents. Without considering human behaviors, implementing these countermeasures will remain useless. Cybersecurity behavior has gained much attention in recent years. However, a systematic review that provides extensive insights into cybersecurity behavior through different technologies and services and covers various directions in large-scale research remains lacking. Therefore, this study retrieved and analyzed 2210 articles published on cybersecurity behavior. The retrieved articles were then thoroughly examined to meet the inclusion and exclusion criteria, in which 39 studies published between 2012 and 2021 were ultimately picked for further in-depth analysis. The main findings showed that the protection motivation theory (PMT) dominated the list of theories and models examining cybersecurity behavior. Cybersecurity behavior and intention behavior counted for the highest purpose for most studies, with fewer studies focusing on cybersecurity awareness and compliance behavior. Most examined studies were conducted in individualistic contexts with limited exposure to collectivistic societies. A total of 56% of the analyzed studies focused on the organizational level, indicating that the individual level is still in its infancy stage. To address the research gaps in cybersecurity behavior at the individual level, this review proposes a number of research agendas that can be considered in future research. This review is believed to improve our understanding by revealing the full potential of cybersecurity behavior and opening the door for further research opportunities.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Cybercrime and Law Enforcement Studies · Privacy, Security, and Data Protection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Faculty of Engineering & IT, The British University in Dubai, Dubai P.O. Box 345015, United Arab Emirates
General Department of Forensic Science and Criminology, Dubai Police G.H.Q., Dubai P.O. Box 1493, United Arab Emirates
Department of Computer Techniques Engineering, Dijlah University College, Baghdad 00964, Iraq
References (100+)
Show source-provided references
1. The Effect of Emotional Intelligence on Cyber Security: The Mediator Role of Mindfulness10.14686/buefad.1040614 ↗
2. Design recommendations for online cybersecurity courses10.1016/j.cose.2018.09.009 ↗
3. NIST (2017). NIST Special Publication 800-181: National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework, National Institute of Standards and Technology.
4. Toward a cybercrime classification ontology: A knowledge-based approach10.1016/j.chb.2018.11.039 ↗
5. NIST (2012). Cyber Attack—Glossary, CSRC.
6. Lewis, J.A. (2002). Assessing the Risks of Cyber Terrorism, Cyber War and Other Cyber Threats, Center for Strategic & International Studies.
7. Almomani, O., Almaiah, M.A., Alsaaidah, A., Smadi, S., Mohammad, A.H., and Althunibat, A. (2021, January 14–15). Machine Learning Classifiers for Network Intrusion Detection System: Comparative Study. Proceedings of the 2021 International Conference on Information Technology (ICIT), Amman, Jordan.10.1109/ICIT52682.2021.9491770 ↗
8. Intrusion Detection Using a New Hybrid Feature Selection Model10.32604/iasc.2021.016140 ↗
9. From information security to cyber security10.1016/j.cose.2013.04.004 ↗
10. VPN Encrypted Traffic classification using XGBoost10.30534/ijeter/2021/20972021 ↗
11. Cybersecurity Education Guides (2023, March 19). Cybersecurity Industries and Domains|Careers and Jobs. Available online: https://www.cybersecurityeducationguides.org/industries-and-domains/.
12. Understanding cybersecurity behavioral habits: Insights from situational support
13. “Get a red-hot poker and open up my eyes, it’s so boring”1: Employee perceptions of cybersecurity training10.1016/j.cose.2021.102281 ↗
14. The role of technology adoption in sustainable development: Overview, opportunities, challenges, and future research agendas10.1016/j.techsoc.2023.102240 ↗
15. Time pressure in human cybersecurity behavior: Theoretical framework and countermeasures10.1016/j.cose.2020.101931 ↗
16. Cybersecurity Behaviour: A Conceptual Taxonomy10.1007/978-3-030-20074-9_11 ↗
17. Cyber Security Awareness, Knowledge and Behavior: A Comparative Study
18. Rogers, R.W. (1983). Social Psychophysiology: A Sourcebook, Guilford Press.
19. The theory of planned behavior10.1016/0749-5978(91)90020-T ↗
20. Enhancing employees information security awareness in private and public organisations: A systematic literature review10.1016/j.cose.2021.102267 ↗
21. Svabensky, V., Vykopal, J., and Celeda, P. (2020, January 11–14). What Are Cybersecurity Education Papers About? A Systematic Literature Review of SIGCSE and ITiCSE Conferences. Proceedings of the 51st ACM Technical Symposium on Computer Science Education, SIGCSE 2020, Portland, OR, USA.10.1145/3328778.3366816 ↗
22. Fujs, D., Mihelič, A., and Vrhovec, S.L.R. (2019, January 26–29). The power of interpretation: Qualitative methods in cybersecurity research. Proceedings of the 14th International Conference on Availability, Reliability and Security, Canterbury, UK.10.1145/3339252.3341479 ↗
23. AlShamsi, M., Al-Emran, M., and Shaalan, K. (2022). A Systematic Review on Blockchain Adoption. Appl. Sci., 12.10.3390/app12094245 ↗
24. Al-Qaysi, N., Mohamad-Nordin, N., and Al-Emran, M. (2021). Recent Advances in Intelligent Systems and Smart Applications, Springer.
25. Alqudah, A.A., Al-Emran, M., and Shaalan, K. (2021). Technology Acceptance in Healthcare: A Systematic Review. Appl. Sci., 11.10.3390/app112210537 ↗
26. Mobile Learning Adoption: A Systematic Review of the Technology Acceptance Model from 2017 to 202010.3991/ijet.v16i05.18093 ↗
27. The Importance of Security Matters for Quality of Experience in Mobile Web Context
28. Rahman, T., Rohan, R., Pal, D., and Kanthamanon, P. (2021–1, January 29). Human Factors in Cybersecurity: A Scoping Review. Proceedings of the 12th International Conference on Advances in Information Technology, Bangkok, Thailand.10.1145/3468784.3468789 ↗
29. In Defence of the Human Factor
30. Review and insight on the behavioral aspects of cybersecurity10.1186/s42400-020-00050-w ↗
31. Developing cybersecurity culture to influence employee behavior: A practice perspective10.1016/j.cose.2020.102003 ↗
32. Edkrantz, M., Truve, S., and Said, A. (2015, January 3–5). Predicting Vulnerability Exploits in the Wild. Proceedings of the 2nd International Conference on Cyber Security and Cloud Computing, New York, NY, USA.10.1109/CSCloud.2015.56 ↗
33. Hacking Humans? Social Engineering and the Construction of the “Deficient User” in Cybersecurity Discourses10.1177/0162243921992844 ↗
34. Cybersecurity awareness for children: A systematic literature review10.1016/j.ijcci.2021.100343 ↗
35. Herath, T.B.G., Khanna, P., and Ahmed, M. (2022). Cybersecurity Practices for Social Media Users: A Systematic Literature Review. J. Cybersecur. Priv., 2.10.3390/jcp2010001 ↗
36. Cybersecurity in healthcare: A narrative review of trends, threats and ways forward10.1016/j.maturitas.2018.04.008 ↗
37. Nifakos, S., Chandramouli, K., Nikolaou, C.K., Papachristou, P., Koch, S., Panaousis, E., and Bonacina, S. (2021). Influence of Human Factors on Cyber Security within Healthcare Organisations: A Systematic Review. Sensors, 21.10.3390/s21155119 ↗
38. The cybersecurity behavioral research: A tertiary study10.1016/j.cose.2022.102826 ↗
39. The impact of time pressure on cybersecurity behaviour: A systematic literature review10.1080/0144929X.2019.1583769 ↗
40. Sulaiman, N.S., Fauzi, M.A., Wider, W., Rajadurai, J., Hussain, S., and Harun, S.A. (2022). Cyber–Information Security Compliance and Violation Behaviour in Organisations: A Systematic Review. Soc. Sci., 11.10.3390/socsci11090386 ↗
41. Jeong, J., Mihelcic, J., Oliver, G., and Rudolph, C. (2019, January 12–14). Towards an improved understanding of human factors in cybersecurity. Proceedings of the 5th International Conference on Collaboration and Internet Computing (CIC), Los Angeles, CA, USA.10.1109/CIC48465.2019.00047 ↗
42. Identifying Strategies to Address Human Cybersecurity Behavior: A Review Study
43. Extracting Key Factors of Cyber Hygiene Behaviour among Software Engineers: A Systematic Literature Review10.1109/ACCESS.2021.3097144 ↗
44. Information Security Policy Compliance Behavior Models, Theories, and Influencing Factors: A Systematic Literature Review
45. Appraising the Manifestation of Optimism Bias and Its Impact on Human Perception of Cyber Security: A Meta Analysis
46. Cybersecurity for children: An investigation into the application of social media10.1080/17517575.2023.2188122 ↗
47. Kannelønning, K., and Katsikas, S.K. (2023). A systematic literature review of how cybersecurity-related behavior has been assessed. Inf. Comput. Secur.10.1108/ICS-08-2022-0139 ↗
48. A Systematic Review of Mobile Payment Studies from the Lens of the UTAUT Model10.1007/978-3-030-64987-6_6 ↗
49. Technology acceptance model: A literature review from 1986 to 201310.1007/s10209-014-0348-1 ↗
50. Fatehah, M., Mezhuyev, V., and Al-Emran, M. (2021). Recent Advances in Intelligent Systems and Smart Applications, Springer.
51. Social media adoption in education: A systematic review of disciplines, applications, and influential factors10.1016/j.techsoc.2023.102249 ↗
52. Kitchenham, B., and Charters, S. (2007). Guidelines for Performing Systematic Literature Reviews in Software Engineering, Software Engineering Group, School of Computer Science and Mathematics, Keele University.
53. Key knowledge management processes for innovation: A systematic literature review
54. Alqahtani, H., and Kavakli-Thorne, M. (2020). HCI for Cybersecurity, Privacy and Trust, Springer International Publishing.
55. Exploring user behavioral data for adaptive cybersecurity10.1007/s11257-019-09236-5 ↗
56. Costly but effective: Comparing the factors that influence employee anti-malware behaviours10.1016/j.chb.2018.05.023 ↗
57. Al-Emran, M., AlQudah, A.A., Abbasi, G.A., Al-Sharafi, M.A., and Iranmanesh, M. (2023). Determinants of Using AI-Based Chatbots for Knowledge Sharing: Evidence From PLS-SEM and Fuzzy Sets (fsQCA). IEEE Trans. Eng. Manag.10.1109/TEM.2023.3237789 ↗
58. Factors affecting risky cybersecurity behaviors by U.S. workers: An exploratory study10.1016/j.chb.2020.106319 ↗
59. Malware Avoidance Motivations and Behaviors: A Technology Threat Avoidance Replication10.17705/1atrr.00015 ↗
60. Employees’ Behavior in Phishing Attacks: What Individual, Organizational, and Technological Factors Matter?
61. Modeling anti-malware use intention of university students in a developing country using the theory of planned behavior10.1108/K-05-2018-0226 ↗
62. Towards a wearable education: Understanding the determinants affecting students’ adoption of wearable technologies using machine learning algorithms
63. The Impact of Age, Gender, and Educational level on the Cybersecurity Behaviors of Tertiary Institution Students: An Empirical investigation on Malaysian Universities10.1088/1742-6596/1339/1/012098 ↗
64. Investigating the impact of cybersecurity policy awareness on employees’ cybersecurity behavior10.1016/j.ijinfomgt.2018.10.017 ↗
65. Gramm-Leach-Bliley Gets a Systems Upgrade: What the Ftc’S Proposed Safeguards Rule Changes Mean for Small and Medium American Financial Institutions10.1080/07366981.2021.1911387 ↗
66. Buzan, T. Tony Buzan|Inventor of Mind Mapping.
67. What leads to social learning? Students’ attitudes towards using social media applications in Omani higher education10.1007/s10639-019-10074-6 ↗
68. Al-Qaysi, N., Mohamad-Nordin, N., Al-Emran, M., and Al-Sharafi, M.A. (2019, January 15–17). Understanding the differences in students’ attitudes towards social media use: A case study from Oman. Proceedings of the 2019 IEEE Student Conference on Research and Development (SCOReD), Bandar Seri Iskandar, Malaysia.10.1109/SCORED.2019.8896251 ↗
69. Online social networks security and privacy: Comprehensive review and analysis10.1007/s40747-021-00409-7 ↗
70. Measuring attitude towards personal data for adaptive cybersecurity10.1108/ICS-11-2016-0085 ↗
71. Mediating effects of information security awareness10.1016/j.cose.2021.102313 ↗
72. Risk as affect: The affect heuristic in cybersecurity10.1016/j.cose.2019.101651 ↗
73. Secure authentication scheme to thwart RT MITM, CR MITM and malicious browser extension based phishing attacks
74. Correlating human traits and cyber security behavior intentions10.1016/j.cose.2017.11.015 ↗
75. Fischer, E.A. (2016). Cybersecurity Issues and Challenges: In Brief, Congressional Research Service.
76. (2021, October 28). Cybint 15 Alarming Cyber Security Facts and Stats. Available online: https://www.cybintsolutions.com/cyber-security-facts-stats/.
77. Proofpoint (2020). An In-Depth Look at User Awareness, Vulnerability and Resilience, Proofpoint.
78. Research communities in cyber security: A comprehensive literature review10.1016/j.cosrev.2021.100431 ↗
79. Examining the roles of students’ beliefs and security concerns for using smartwatches in higher education10.1108/JEIM-02-2020-0052 ↗
80. The influence of organizational, social and personal factors on cybersecurity awareness and behavior of home computer users
81. Keeping customers’ data secure: A cross-cultural study of cybersecurity compliance among the Gen-Mobile workforce10.1016/j.chb.2020.106531 ↗
82. Employees’ behavioural intention to smartphone security: A gender-based, cross-national study10.1016/j.chb.2019.106184 ↗
83. Gender differences in predictors of technology threat avoidance10.1108/ICS-01-2020-0008 ↗
84. Gender Difference and Employees’ Cybersecurity Behaviors10.1016/j.chb.2016.12.040 ↗
85. A systematic review of multi perspectives on human cybersecurity behavior10.1016/j.techsoc.2023.102258 ↗
86. From awareness to influence: Toward a model for improving employees’ security behaviour10.1007/s00779-021-01551-2 ↗
87. Il Information system security policy noncompliance: The role of situation-specific ethical orientation10.1108/ITP-03-2019-0109 ↗
88. From hindrance to challenge: How employees understand and respond to information security policies10.1108/JEIM-01-2019-0018 ↗
89. Alqahtani, H., Kavakli-Thorne, M., and Alrowaily, M. (2020). HCI for Cybersecurity, Privacy and Trust, Springer International Publishing.
90. Phishing Happens beyond Technology: The Effects of Human Behaviors and Demographics on Each Step of a Phishing Process10.1109/ACCESS.2021.3066383 ↗
91. It ain’t my business: A coping perspective on employee effortful security behavior10.1108/JEIM-10-2018-0229 ↗
92. Verkijika, S.F. (2020, January 25–27). Employees’ Cybersecurity Behaviour in the Mobile Context: The Role of Self-Efficacy and Psychological Ownership. Proceedings of the 2nd International Multidisciplinary Information Technology and Engineering Conference (IMITEC), Kimberley, South Africa.10.1109/IMITEC50163.2020.9334097 ↗
93. Familiarity with Internet threats: Beyond awareness10.1016/j.cose.2017.01.010 ↗
94. “If you know what to do, will you take action to avoid mobile phishing attacks”: Self-efficacy, anticipated regret, and gender10.1016/j.chb.2019.07.034 ↗
95. (2021, October 29). Packetlabs Cybersecurity Statistics for 2021. Available online: https://www.packetlabs.net/cybersecurity-statistics-2021/.
96. ACSC (2021, October 29). ACSC Annual Cyber Threat Report 2020–21, Available online: https://www.cyber.gov.au/acsc/view-all-content/reports-and-statistics/acsc-annual-cyber-threat-report-2020-21.
97. A quantitative analysis of factors related to Taiwan teenagers’ smartphone addiction tendency using a random sample of parent-child dyads10.1016/j.chb.2019.05.032 ↗
98. Behavioral Intentions towards adoption of Information Protection and Cyber security (Email Security and Online Privacy): SEM model
99. Cybersecurity compliance behavior: Exploring the influences of individual decision style and other antecedents10.1016/j.ijinfomgt.2019.102056 ↗
100. Ensuring employees’ information security policy compliance by carrot and stick: The moderating roles of organizational commitment and gender10.1108/ITP-09-2019-0452 ↗