Information Security Behavior in Higher Education Institutions : A Systematic Literature Review
محتوى المقال
الملخص
Information security remains a significant concern in higher education, evidenced by the numerous security-related incidents reported over the last decade. This study investigates the vulnerabilities and threats confronting higher education institutions and proposes information security measures to enhance safety. Key vulnerabilities identified include decentralized IT infrastructure, a diverse user base, legacy systems, insider threats, and insufficient investment in information security. Correspondingly, potential threats and attacks on information in HEIs encompass social engineering attacks, distributed denial-of-service attacks, malware, and insider breaches. Furthermore, the findings advocate for the integration of artificial intelligence in information security monitoring, the incorporation of security education into university curricula, and the implementation of multi-faceted information security measures, including technological, organizational, environmental, and human measures, to ensure robust information security protection in HEIs. The study also highlights areas for future research.
الكلمات المفتاحية
Higher education institutions، information security، information security behavior، information security measures، risk، threats، vulnerabilities
التنزيلات
المراجع
Aborujilah, A., Adamu, J., Mokhtar, S. A., Al-Othmani, A. Z., Al-alwi, E. Y., & Yahya Al-Hidabi, D. A. (2023). CIA-based Analysis for E-Leaming Systems Threats and Countermeasures in Malaysian Higher Education: Review Paper. 2023 17th International Conference on Ubiquitous Information Management and Communication (IMCOM), 1–8. https://doi.org/10.1109/IMCOM56909.2023.10035569
Aborujilah, A., Al-Alawi, E. Y., Al-Hidabi, D. A., & Al-Othmani, A. Z. (2022). Exploring Critical Challenges and Factors Influencing E-Learning Systems Security During COVID-19 Pandemic. 2022 International Conference on Intelligent Technology, System and Service for Internet of Everything (ITSS-IoE), 1–5. https://doi.org/10.1109/ITSS-IoE56359.2022.9990935
Africa Cyber Security Report . (2023).
Ahlan, A. R., Lubis, M., & Lubis, A. R. (2015). Information Security Awareness at the Knowledge-Based Institution: Its Antecedents and Measures. Procedia Computer Science, 72, 361–373. https://doi.org/10.1016/j.procs.2015.12.151
Ahmed, A. A. A., & Abas, H. (2024). Factors Influencing Information Security Policy Compliance Behavior in High Education Institutions: Systematic Literature Review. Advances in Social Sciences Research Journal , 11(7), 260–273.
Alenezi, M. (2023). Digital Learning and Digital Institution in Higher Education. Education Sciences, 13(1), 88. https://doi.org/10.3390/educsci13010088
Al-Ibrahim, M., & Shams Al-Deen, Y. (2014). The Reality of Applying Security in Web Applications in Education. www.conference.thesai.org
Alshare, K. A., Lane, P. L., & Lane, M. R. (2018). Information security policy compliance: a higher education case study. Information & Computer Security, 26(1), 91–108. https://doi.org/10.1108/ICS-09-2016-0073
Arina, A., & Anatolie, A. (2021). Cyber Security Threat Analysis In Higher Education Institutions As A Result Of Distance Learning. INTERNATIONAL JOURNAL OF SCIENTIFIC & TECHNOLOGY RESEARCH, 10(3), 128–133.
bin Md Ajis, A. F., Rohayu, binti A., & Suhaila, binti O. (2020). Catalyst of Information Security in Malaysia Higher Learning Institutions.
Bondoc, C. E., & Malawit, T. G. (2020). Cybersecurity for higher education institutions: adopting regulatory framework. Global Journal of Engineering and Technology Advances, 2(3), 016–021. https://doi.org/10.30574/gjeta.2020.2.3.0013
Bongiovanni, I. (2019). The least secure places in the universe? A systematic literature review on information security management in higher education. Computers & Security, 86, 350–357. https://doi.org/10.1016/j.cose.2019.07.003
Botchway, E. A., Agyekum, K., Pittri, H., & Lamina, A. (2024). Deployment of physical access control (PAC) devices in university settings in Ghana. Frontiers in Engineering and Built Environment, 4(1), 1–14. https://doi.org/10.1108/FEBE-01-2023-0006
Canada-Meza, D. D., Prudente-Tixteco, L., Mercado-Hernandez, P. R., Arenas-Hernandez, J. G., & Ugalde-Eduardo, M. (2023). Recommendations of Security Controls Using Threat Modeling in Information Systems in Higher Education Institutions. 2023 IEEE International Conference on Engineering Veracruz, ICEV 2023. https://doi.org/10.1109/ICEV59168.2023.10329765
Cavusoglu, H. (2004). Economics of IT Security Management. In Economics of Information Security (pp. 71–83). Kluwer Academic Publishers. https://doi.org/10.1007/1-4020-8090-5_6
Choong, M. K., Galgani, F., Dunn, A. G., & Tsafnat, G. (2014). Automatic Evidence Retrieval for Systematic Reviews. Journal of Medical Internet Research, 16(10), e223. https://doi.org/10.2196/jmir.3369
Daneshmandnia, A. (2023). Exploring Information Security Processes Effectiveness in Educational Institutions: Impacts of Organizational Factors). Proceedings of the 2023 IEEE Asia-Pacific Conference on Computer Science and Data Engineering, CSDE 2023. https://doi.org/10.1109/CSDE59766.2023.10487771
De Kock, R., & Futcher, L. A. (2016). Mobile device usage in higher education institutions in South Africa. 2016 Information Security for South Africa (ISSA), 27–34. https://doi.org/10.1109/ISSA.2016.7802925
Dekkers, R., Carey, L., & Langhorne, P. (2022). Quality of Literature Reviews. In Making Literature Reviews Work: A Multidisciplinary Guide to Systematic Approaches (pp. 57–105). Springer International Publishing. https://doi.org/10.1007/978-3-030-90025-0_3
Dioubate, B. M., Daud, W., & Norhayate, W. (2022). Cyber Security Risk Management Frameworks Implementation in Malaysian Higher Education Institutions. International Journal of Academic Research in Business and Social Sciences, 12(4). https://doi.org/10.6007/IJARBSS/v12-i4/12300
Do, C. T., Tran, N. H., Hong, C., Kamhoua, C. A., Kwiat, K. A., Blasch, E., Ren, S., Pissinou, N., & Iyengar, S. S. (2018). Game Theory for Cyber Security and Privacy. ACM Computing Surveys, 50(2), 1–37. https://doi.org/10.1145/3057268
Edward, K. (2024, January 18). https://www.upguard.com/blog/top-cybersecurity-problems-for-universities-colleges. Upguard.
Flores, P., Farid, M., & Samara, K. (2019). Assessing E-Security Behavior among Students in Higher Education.
Forrester Research. (2021). Insider Threats Drive Data Protection Improvements Threat Detection, Analytics, And Staffing Lead Investment Priorities.
Ganesen, R., Bakar, A. A., Ramli, R., Rahim, F. A., & Zawawi, M. N. A. (2022a). Cybersecurity Risk Assessment: Modeling Factors Associated with Higher Education Institutions. International Journal of Advanced Computer Science and Applications, 13(8). https://doi.org/10.14569/IJACSA.2022.0130843
Ganesen, R., Bakar, A. A., Ramli, R., Rahim, F. A., & Zawawi, M. N. A. (2022b). Cybersecurity Risk Assessment: Modeling Factors Associated with Higher Education Institutions. International Journal of Advanced Computer Science and Applications, 13(8). https://doi.org/10.14569/IJACSA.2022.0130843
Grama, J. L., & Milford, K. (2019). Ahead of the Curve: IoT Security, Privacy, and Policy in Higher Ed (pp. 73–86). https://doi.org/10.1007/978-3-030-15705-0_5
Hina, S., & Dominic, D. D. (2016). Information Security Policies: Investigation of Compliance in Universities. International Conference On Computer And Information Sciences (ICCOINS), 564–569.
Hina, S., & Dominic, D. D. (2017). Need for Information Security Policies Compliance: A Perspective in Higher Education Institutions. IEEE.
Hina, S., & Dominic, P. D. D. (2020). Information security policies’ compliance: a perspective for higher education institutions. In Journal of Computer Information Systems (Vol. 60, Issue 3, pp. 201–211). Taylor and Francis Inc. https://doi.org/10.1080/08874417.2018.1432996
Hina, S., Panneer Selvam, D. D. D., & Lowry, P. B. (2019). Institutional governance and protection motivation: Theoretical insights into shaping employees’ security compliance behavior in higher education institutions in the developing world. Computers & Security, 87, 101594. https://doi.org/10.1016/j.cose.2019.101594
Huerta Suárez, C. I., Toapanta T, S. M., Gómez Díaz, E. Z., Huerta Vélez, A. E., Suarez, C. I., & Vizuete, M. Z. (2024). Analysis for Information Security in Virtual Environments for a Higher Education Institution. 1739–1745. https://doi.org/10.1109/csci62032.2023.00286
Imbaquingo-Esparza, D., Díaz, J., Ron Egas, M., Fuertes, W., & Molina, D. (2022). Information Security at Higher Education Institutions: A Systematic Literature Review (pp. 294–309). https://doi.org/10.1007/978-3-031-18272-3_20
Joshi, C., & Singh, U. K. (2017). Information security risks management framework – A step towards mitigating security risks in university network. Journal of Information Security and Applications, 35, 128–137. https://doi.org/10.1016/j.jisa.2017.06.006
Kam, H.-J., & Katerattanakul, P. (2014). Information Security in Higher Education: A Neo-Institutional Perspective. Journal of Information Privacy and Security, 10(1), 28–43. https://doi.org/10.1080/15536548.2014.912482
Karabatak, S., & Karabatak, M. (2019). Information Security Awareness of School Administrators (A. Varol, Ed.). IEEE.
Kencana Sari, P., & Nurshabrina, N. (2016). Factor Analysis on Information Security Management in Higher Education Institutions.
Lallie, H. S., Thompson, A., Titis, E., & Stephens, P. (2023). Understanding Cyber Threats Against the Universities, Colleges, and Schools.
Li, J., Xiao, W., & Zhang, C. (2023). Data security crisis in universities: identification of key factors affecting data breach incidents. Humanities and Social Sciences Communications, 10(1), 270. https://doi.org/10.1057/s41599-023-01757-0
Liu, C.-W., Huang, P., & Lucas, H. C. (2020). Centralized IT Decision Making and Cybersecurity Breaches: Evidence from U.S. Higher Education Institutions. Journal of Management Information Systems, 37(3), 758–787. https://doi.org/10.1080/07421222.2020.1790190
Marcelo, R. (2024, January 24). 2024 State of Ransomware in Education: 92% spike in K-12 attacks - ThreatDown by Malwarebytes. https://www.threatdown.com/blog/2024-state-of-ransomware-in-education-92-spike-in-k-12-attacks/
Merchan-Lima, J., Astudillo-Salinas, F., Tello-Oquendo, L., Sanchez, F., Lopez, G., & Quiroz, D. (2019). Information Security Management Frameworks in Higher Education Institutions: An Overview. 2019 3rd Cyber Security in Networking Conference (CSNet), 63–65. https://doi.org/10.1109/CSNet47905.2019.9108845
Moletsane, T., & Tsibolane, P. (2020). Mobile Information Security Awareness Among Students in Higher Education : An Exploratory Study. 2020 Conference on Information Communications Technology and Society (ICTAS), 1–6. https://doi.org/10.1109/ICTAS47918.2020.233978
Moloja, D., Ngqondi, T., & Mpekoa, N. (2024). BYODelving: Unmasking Security Risks in Higher Education Learning Management Systems - A South African Perspective. In M. Cunningham & P. Cunningham (Eds.), IST-Africa 2024 Conference Proceedings (pp. 1–8). IIMC International Information Management Corporation.
Muhenda, M. B. (2018). The Ugandan Journal Of Management And Public Policy Studies Managing Students’ Academic Information: How Are Public Higher Education Institutions In Uganda Prepared To Deal With Internal Cyber-Attacks?
Musarurwa, S., Gamundani, A. M., & Shava, F. B. (2017). A Review of Security Challenges for Control of Access to Wi-Fi Networks in Tertiary Institutions. In P. Cunningham & M. Cunningham (Eds.), IST-Africa 2017 Conference Proceedings (pp. 1–8). IIMC International Information Management Corporation.
Naga, J. F., & Tinam-isan, M. A. C. (2024). EXPLORING THE INFLUENCE OF PERSONALITY TRAITS ON STUDENTS’ INFORMATION SECURITY RISK-TAKING BEHAVIORS: A BFI ASSESSMENT. Procedia Computer Science, 234, 527–536. https://doi.org/10.1016/j.procs.2024.03.036
Ndiege, J. R., & Okello, G. (2018). Towards Information Security Savvy Students in Institutions of Higher Learning in Africa: A Case of a University in Kenya. In Paul Cunningham & Miriam Cunningham (Eds.), IST-Africa 2018 Conference Proceedings (pp. 1–8). IIMC International Information Management Corporation.
Nguyen, T. (2024). Understanding Shadow IT usage intention: a view of the dual-factor model. Online Information Review, 48(3), 500–522. https://doi.org/10.1108/OIR-04-2022-0243
Nurse, J. R. C. (2021). Cybersecurity Awareness. In Encyclopedia of Cryptography, Security and Privacy (pp. 1–4). Springer Berlin Heidelberg. https://doi.org/10.1007/978-3-642-27739-9_1596-1
Rastenis, J., Ramanauskaitė, S., Janulevičius, J., & Čenys, A. (2019, April 25). Credulity to Phishing Attacks: A Real-World Study of Personnel with Higher Education. 2019 Open Conference of Electrical, Electronic and Information Sciences .
Rehman, H., Masood, A., & Cheema, A. R. (2013). Information Security Management in Academic Institutes of Pakistan. 2nd National Conference on Information Assurance (NCIA), 47–51.
Rohan, R., Funilkul, S., Chutimaskul, W., Kanthmanon, P., Papasratorn, B., & Pal, D. (2023). Information Security Awareness in Higher Education Institutes: A Work in Progress. 2023 15th International Conference on Knowledge and Smart Technology (KST), 1–6. https://doi.org/10.1109/KST57286.2023.10086884
Salem, Y., Moreb, M., & Rabayah, K. S. (2021). Evaluation of Information Security Awareness among Palestinian Learners. 2021 International Conference on Information Technology (ICIT), 21–26. https://doi.org/10.1109/ICIT52682.2021.9491639
Scott, Z. (n.d.). A Recap of Recent Cybersecurity Incidents at Universities. Retrieved October 1, 2024, from https://www.schellman.com/blog/cybersecurity/cybersecurity-incidents-at-universities-2023
Setiawan, B., & Rizal, M. A. (2024). Measurement of Information Security and Privacy Awareness in College Students after the Covid-19 Pandemic. Procedia Computer Science, 234, 1396–1403. https://doi.org/10.1016/j.procs.2024.03.138
Snyder, H. (2019). Literature review as a research methodology: An overview and guidelines. Journal of Business Research, 104, 333–339. https://doi.org/10.1016/j.jbusres.2019.07.039
Taha, N., & Dahabiyeh, L. (2021). College students information security awareness: a comparison between smartphones and computers. Education and Information Technologies, 26(2), 1721–1736. https://doi.org/10.1007/s10639-020-10330-0
Toapanta, S. M. T., Del Pozo Durango, R. H., Díaz, E. Z. G., Trejo, J. A. O., Gallegos, L. E. M., Arellano, Ma. R. M., Vizuete, M. Z., & Hifóng, M. M. B. (2023). Proposal for a security model applying artificial intelligence for administrative management in a higher education institution. 2023 International Conference on Computer, Information and Telecommunication Systems (CITS), 1–5. https://doi.org/10.1109/CITS58301.2023.10188801
Ulven, J. B., & Wangen, G. (2021). A systematic review of cybersecurity risks in higher education. In Future Internet (Vol. 13, Issue 2, pp. 1–40). MDPI AG. https://doi.org/10.3390/fi13020039
Wohlin, C., Kalinowski, M., Romero Felizardo, K., & Mendes, E. (2022). Successful combination of database search and snowballing for identification of primary studies in systematic literature studies. Information and Software Technology, 147, 106908. https://doi.org/10.1016/j.infsof.2022.106908
Xiao, Y., & Watson, M. (2019). Guidance on Conducting a Systematic Literature Review. Journal of Planning Education and Research, 39(1), 93–112. https://doi.org/10.1177/0739456X17723971
تفاصيل المقال
هذا العمل مرخص بموجب Creative Commons Attribution-NonCommercial 4.0 International License.