Search results

This paper aims to explore the factors affecting cybersecurity implementation in organizations in various countries and develop a cybersecurity framework to improve cybersecurity practices within organizations for cybersecurity risk management through a systematic literature review (SLR) approach.

This SLR adhered to RepOrting Standards for Systematics Evidence Syntheses (ROSES) publication standards and used various research approaches. The study’s article selection process involved using Scopus, one of the most important scientific databases, to review articles published between 2014 and 2023.

This review identified the four main themes: individual factors, organizational factors, technological factors and governmental role. In addition, nine subthemes that relate to these primary topics were established.

This research sheds light on the multifaceted nature of cybersecurity by exploring factors influencing implementation and developing an improvement framework, offering valuable insights for researchers to advance theoretical developments, assisting industry practitioners in tailoring cybersecurity strategies to their needs and providing policymakers with a basis for creating more effective cybersecurity regulations and standards.

The purpose of this study is to investigate the extent to which a sample of the Australian cybersecurity industry is impacted by burnout.

Based on the review of the literature, this research investigates the following three hypotheses. Gender will significantly predict burnout scores. Those who identify as women will score higher on average than those who identify as men (because of being in a male-dominated industry). Self-reported burnout will differ across job roles. In addition, the authors expect these relationships to hold across the three dimensions of burnout, namely, emotional exhaustion, depersonalisation and professional efficacy. Sleep quality will be associated with burnout.

Gender and job role were significant predictors of emotional exhaustion, but not depersonalisation or professional efficacy. The interaction between gender and job role was also significant. Senior managers experienced poorer quality sleep, and poorer sleep quality was associated with greater reported emotional exhaustion at work. For emotional exhaustion, female respondents who worked in security consultant roles tended to score higher than their male counterparts.

Left unaddressed, the high level of workplace burnout may add to the well-being and retention problems developing within the cybersecurity community. These results indicate that organisations should look to measure the well-being of their own cyber workforce and implement meaningful changes if they wish to keep their cyber talent and enable them to thrive at work.

This research paper is an extension of a previous paper by the same authors which is titled “Is Your CISO Burnt Out Yet”. This paper examined the demographic differences in workplace burnout among cybersecurity professionals.

This study aims to identify the publication phase, performance and scientific contributions of research papers related to enterprise risk management (ERM) and to visualise the emerging themes in addressing volatility, uncertainty, complexity and ambiguity (VUCA).

The biblioshiny technique based on the bibliometrix R package was used to draw journal papers’ performance and scientific contributions by displaying distinctive features from the bibliometric method used in prior studies. The data was extracted from the Web of Science (WOS) and Scopus databases.

Since the 1990s, ERM publication has gained momentum, and it is generally categorised into four main themes. Studies by Miller (1992) and Bromiley et al. (2015) scored the highest in global and local citations, respectively. However, the Economic Outlook ranked first in quality of publications while the Journal of Risk and Insurance topped in quantity of publications. Collaborative research mainly exists between two authors, and the dynamic number of collaborative networks is evident in the USA.

This study is limited by the filtered keywords used to generate the search on journal papers’ in WOS and Scopus. It is imperative to have more comprehensive and rigorous analytics on ERM research to enable a direction for future research. Finally, ERM implementation better equips firms to mitigate risk in a VUCA environment.

This study attempts to fill a vacuum of ERM literature, specifically in business economics, in addressing VUCA. Moreover, it covers a comprehensive predetermined period of from its inception in 1983 until 2022.

The purpose of the study is to identify cybersecurity threats that hinder the adoption of digital banking and provide sustainable strategies to combat cybersecurity risks in the banking industry.

Systematic literature review guidelines were used to conduct a quantitative synthesis of empirical evidence regarding the impact of cybersecurity threats and risks on the adoption of digital banking.

A total of 84 studies were initially examined, and after applying the selection and eligibility criteria for this systematic review, 58 studies were included. These selected articles consistently identified identity theft, malware attacks, phishing and vishing as significant cybersecurity threats that hinder the adoption of digital banking.

With the country’s banking sector being new in this area, this study contributes to the scant literature on cyber security, which is mostly in need due to the myriad breaches that the industry has already suffered thus far.

In the modern digital realm, while artificial intelligence (AI) technologies pave the way for unprecedented opportunities, they also give rise to intricate cybersecurity issues, including threats like deepfakes and unanticipated AI-induced risks. This study aims to address the insufficient exploration of AI cybersecurity awareness in the current literature.

Using in-depth surveys across varied sectors (N = 150), the authors analyzed the correlation between the absence of AI risk content in organizational cybersecurity awareness programs and its impact on employee awareness.

A significant AI-risk knowledge void was observed among users: despite frequent interaction with AI tools, a majority remain unaware of specialized AI threats. A pronounced knowledge difference existed between those that are trained in AI risks and those who are not, more apparent among non-technical personnel and sectors managing sensitive information.

This study paves the way for thorough research, allowing for refinement of awareness initiatives tailored to distinct industries.

It is imperative for organizations to emphasize AI risk training, especially among non-technical staff. Industries handling sensitive data should be at the forefront.

Ensuring employees are aware of AI-related threats can lead to a safer digital environment for both organizations and society at large, given the pervasive nature of AI in everyday life.

Unlike most of the papers about AI risks, the authors do not trust subjective data from second hand papers, but use objective authentic data from the authors’ own up-to-date anonymous survey.

In response to the growing interest in Internet of Things (IoT) technology and its profound implications for businesses and individuals, this bibliometric study focuses on a critical yet understudied aspect, i.e. cybersecurity. As IoT adoption grows, so do concerns regarding user privacy and data security. This study aims to provide a comprehensive understanding of the current research in this vital area, shedding light on research trends, gaps and emerging themes.

The study conducted a bibliometric analysis and systematic review of literature spanning over two decades (2013–2023). Bibliometric analysis is conducted using Biblioshiny which is R-software-based advanced analytical tool. Further, VOSviewer is used to conduct network analysis. The study highlights the evolving landscape of IoT cybersecurity, emphasizing interdisciplinary intersections and the ethical dimensions of IoT technologies.

The study uncovers crucial concerns related to IoT adoption, emphasizing the urgent need for comprehensive cybersecurity protocols. It identifies emerging themes such as artificial intelligence and blockchain integration, indicating a shift toward interdisciplinary solutions. Furthermore, the research highlights ethical gaps in current IoT discussions, emphasizing the importance of responsible innovation.

Businesses can bolster their cybersecurity strategies, policymakers can craft informed regulations and researchers are encouraged to explore IoT’s ethical dimensions.

This study pioneers a nuanced analysis of IoT cybersecurity, filling a crucial gap in the existing business and management literature. By synthesizing a decade of scholarly work, it provides foundational insights for researchers, businesses and policymakers. The research not only informs academic discourse but also offers practical guidance for enhancing IoT security measures and fostering ethical innovation.

The human factor is the most important defense asset against cyberattacks. To ensure that the human factor stays strong, a cybersecurity culture must be established and cultivated in a company to guide the attitudes and behaviors of employees. Many cybersecurity culture frameworks exist; however, their practical application is difficult. This paper aims to demonstrate how an established framework can be applied to determine and improve the cybersecurity culture of a company.

Two surveys were conducted within eight months in the internal IT department of a global software company to analyze the cybersecurity culture and the applied improvement measures. Both surveys comprised the same 23 questions to measure cybersecurity culture according to six dimensions: cybersecurity accountability, cybersecurity commitment, cybersecurity necessity and importance, cybersecurity policy effectiveness, information usage perception and management buy-in.

Results demonstrate that cybersecurity culture maturity can be determined and improved if accurate measures are derived from the results of the survey. The first survey showed potential for improving the dimensions of cybersecurity accountability, cybersecurity commitment and cybersecurity policy effectiveness, while the second survey proved that these dimensions have been improved.

This paper proves that practical application of cybersecurity culture frameworks is possible if they are appropriately tailored to a given organization. In this regard, scientific research and practical application combine to offer real value to researchers and cybersecurity executives.

The purpose of this paper is to explore the current practices in security convergence among and between corporate security and cybersecurity processes in commercial enterprises.

This paper is the first phase in a planned multiphase project to better understand current practices in security optimization efforts being implemented by commercial organizations exploring means and methods to operate securely while reducing operating costs. The research questions being examined are: What are the general levels of interest in cybersecurity and corporate security convergence? How well do the perspectives on convergence align between organizations? To what extent are organizations pursuing convergence? and How are organizations achieving the anticipated outcomes from convergence?

In organizations, the evolution to a more optimized security structure, either merged or partnered, was traditionally due to unplanned or unforeseen events; e.g. a spin-off/acquisition, new security leadership or a negative security incident was the initiator. This is in contrast to a proactive management decision or formal plan to change or enhance the security structure for reasons that include reducing costs of operations and/or improving outcomes to reduce operational risks. The dominant exception was in response to regulatory requirements. Preliminary findings suggest that outcomes from converged organizations are not necessarily more optimized in situations that are organizationally merged under a single leader. Optimization may ultimately depend on the strength of relationships and openness to collaboration between management, cybersecurity and corporate security personnel.

This report and the number of respondents to its survey do not support generalizable findings. There are too few in each category to make reliable predictions and in analysis, there was an insufficient quantity of responses in most categories to allow supportable conclusions to be drawn.

Practitioners may find useful contextual clues to their needs for convergence or in response to directives for convergence from this report on what is found in some other organizations.

Improved effectiveness and/or reduced costs for organizational cybersecurity would be a useful social outcome as organizations become more efficient in the face of increasing levels of cyber security threats.

Convergence as a concept has been around for some time now in both the practice and research communities. It was initially promoted formally by ASIS International and ISACA in 2005. Yet there is no universally agreed-upon definition for the term or the practices undertaken to achieve it. In addition, the business drivers and practices undertaken to achieve it are still not fully understood. If convergence or optimization of converged operations offers a superior operational construct compared to other structures, it is incumbent to discover if there are measurable benefits. This research hopes to define the concept of security collaboration optimization more fully. The eventual goal is to develop and promote a tool useful for organizations to measure where they are on such a continuum.

In recent years, the frequency and severity of cybersecurity incidents have prompted customers to seek out specialized insurance products. However, this has also presented insurers with operational challenges and increased costs. The assessment of risks for health systems and cyber–physical systems (CPS) necessitates a heightened degree of attention. The significant values of potential damages and claims request a solid insurance system, part of cyber-resilience. This research paper focuses on the emerging cyber insurance market that is currently in the process of standardizing and improving its risk analysis concerning the potential insured entity.

The authors' approach involves a quantitative analysis utilizing a Likert-style questionnaire designed to survey cyber insurance professionals. The authors' aim is to identify the current methods used in gathering information from potential clients, as well as the manner in which this information is analyzed by the insurers. Additionally, the authors gather insights on potential improvements that could be made to this process.

The study the authors elaborated it has a particularly important cyber and risk components for insurance area, because it addresses a “niche” area not yet proper addressed in specialized literature – cyber insurance. Cyber risk management approaches are not uniform at the international level, nor at the insurer level. Also, not all insurers can perform solid assessments, especially since their companies should first prove that they are fully compliant with international cyber security standards.

This research has concentrated on analyzing the current practices in terms of gathering information about the insured entity before issuing the cyber insurance policy, level of details concerning the cyber security posture of the insured entity and way such information should be analyzed in a standardized and useful manner. The novelty of this research resides in the analysis performed as detailed above and the proposals in terms of information gathered, depth of analysis and standardization of approach made. Future work on the topic can focus on the standardization process for analyzing cyber risk for insurance clients, to improve the proposal based also on historical elements and trends in the market. Thus, future research can further refine the standardization process to analyze in more depth the way this can be implemented and included in relevant legislation at the EU level.

Proposed improvements include proposals in terms of the level of detail and the usefulness of an independent centralized approach for information gathering and analysis, especially given the re-insurance and brokerage activities. The authors also propose a common practical procedural approach in risk management, with the involvement of insurance companies and certification institutions of cyber security auditors.

The study investigates the information gathered by insurers from potential clients of cyber insurance and the way this is analyzed and updated for issuance of the insurance policy.