A model for information security vulnerability awareness

Abstract

As new and evolving technologies are rapidly adopted by organizations, often without the integration of cybersecurity safeguards, information systems have become increasingly vulnerable to a range of cyber threats. Our research suggests a multi-criteria approach in analyzing possible factors that influence an awareness of information security vulnerabilities. Drawing from prior cybersecurity and vulnerability assessment research, this empirical field study develops a research model to analyze possible determinants influencing information security vulnerability awareness. Three constructs were considered to explore their association to information security vulnerability awareness: vulnerability assessment, assessment of IS security controls, and knowledge of an organization's cyber threatscape. The data analyzed was obtained via a survey questionnaire instrument. Confirmatory factor analysis and structural equation modeling were used to validate the proposed research model. Results of this analysis indicate that these three constructs and their related indicator constructs are significantly correlated with an awareness of information security vulnerability. These results provide useful insights for organizations regarding their awareness of information security vulnerability in an increasingly evolving global cyber threatscape.