Human Aspects of Information Security and Assurance, 2021
Education institutions within and outside Ghana continue to experience mass information leakages ... more Education institutions within and outside Ghana continue to experience mass information leakages at an alarming rate even with the huge investment made in information technology infrastructure to secure their information assets. The lack of organisational commitment to enhance the nontechnical aspects of information securitythus, information security culture (ISC)largely accounts for the consistent rise of security breaches in institutions like the educational institutions. Securing information assets goes beyond technical controls and encompasses people, technology, policy, and operations. The aim of this paper is to identify a comprehensive list of the factors of ISC and construct a conceptual ISC framework (InfoSeCulF) that can be used to provide guidance for the cultivation of a strong ISC in higher learning institutions to secure information assets. A scoping literature review was conducted to determine what constitutes a comprehensive list of factors for cultivating ISC in higher learning institutions. The study proposes a comprehensive list of factors and provides a conceptual framework (InfoSeCulF) which serves as guide for cultivating a strong ISC in institutions.
Cybersecurity Education for Awareness and Compliance, 2019
A security culture can be a competitive advantage when employees uphold strong values for the pro... more A security culture can be a competitive advantage when employees uphold strong values for the protection of information and exhibit behavior that is in compliance with policies, thereby introducing minimal incidents and breaches. The security culture in an organization might, though, not be similar among departments, job levels, or even generation groups. It can pose a risk when it is not conducive to the protection of information and when security incidents and breaches occur due to employee error or negligence. This chapter aims to give organizations an overview of the concept of security culture, the factors that could influence it, an approach to assess the security culture, and to prioritize and tailor interventions for high-risk areas. The outcome of the security culture assessment can be used as input to define security awareness, training, and education programs aiding employees to exhibit behavior that is in compliance with security policies.
2018 Conference on Information Communications Technology and Society (ICTAS), 2018
Information privacy concerns extend to the online environment with consumers having different exp... more Information privacy concerns extend to the online environment with consumers having different expectations towards privacy. While privacy is regulated in many countries the perception of online consumers, the privacy culture, vary as indicated in various global surveys. This research aims to develop a validated instrument that can be used to measure the online information privacy culture of consumers. For this purpose a conceptual Online Information Privacy Culture Index Framework (OIPCIF) is proposed based on the Fair Information Practice Principles (FIPPs) and the OECD privacy guidelines. The Online Information Privacy Culture Index Questionnaire (OIPCIQ) is conceptualized and validated using factor and item analysis. The OIPCO was rolled out in South Africa as the first participating country in the study for which recommendations are made based on the outcomes.
2019 Conference on Information Communications Technology and Society (ICTAS), 2019
SMMEs are increasingly depending on IT to manage their business operations effectively. In South ... more SMMEs are increasingly depending on IT to manage their business operations effectively. In South Africa, there is an increase of cyberattacks on organisations regardless of size and industry, although SMMEs are most impacted. Yet, SMMEs do not always pay attention to cyber security issues. The primary objective of this paper is to review, discover and update researchers about prior cyber security awareness (CSA) studies conducted in the context of South African SMMEs, which warrant future work. A second objective is to discover and analyse frameworks to identify building blocks for a CSA framework. Therefore, in order to respond to research questions, the literature was reviewed systematically. The evaluation shows the absence of previous studies on the topic. However, it was concluded that none of the identified frameworks can be utilised in an SMME context. In addition, ten common components of CSA were identified, that can be considered in future research.
The information security culture of an organisation is influenced by various factors, of which on... more The information security culture of an organisation is influenced by various factors, of which one could be related to legal and regulatory requirements. While employees must comply with organisational policies, external factors like data protection legislation might influence the manner in which employees protect information assets. This research sets out to investigate whether the information security culture level is consistent across offices of an organisation located in jurisdictions with and without data protection legislation and if the timeframe of the implemented data protection regulation might have had an impact. An information security culture survey was conducted in an organisation that follows a centralised approach to information security. Statistical analysis was conducted to compare the information security culture data of offices across six data protection jurisdictions where the organisation operates, namely Mauritius, Switzerland, Guernsey, South Africa, United K...
This work is based on research supported wholly by the National Research Foundation of South Afri... more This work is based on research supported wholly by the National Research Foundation of South Africa (Grant Numbers: 105735)
A cybersecurity culture must be promoted at an international, national, organizational, and indiv... more A cybersecurity culture must be promoted at an international, national, organizational, and individual level to aid in minimizing risks from a human perspective in cyberspace. To promote such a culture it has to be understood and quantified in order to direct change. This research makes use of the disciplines of information technology and industrial psychology to define a cybersecurity culture. A quantitative research methodology, cybersecurity culture research methodology (CSeCRM), is proposed that can be used to measure a cybersecurity culture. The objective of CSeCRM is to ensure that a reliable and valid measuring instrument is used to measure cybersecurity culture. The results derived from using such an instrument can aid in identifying actions to change and direct the cybersecurity culture at, for instance, schools or businesses, at national or international level. The CSeCRM is illustrated by implementing it in an organization where a cybersecurity culture measuring instrument was validated.
Innovations in Education and Teaching International, 2019
Academic communities of practice (ACoPs) are formed in collaboration with professionals from indu... more Academic communities of practice (ACoPs) are formed in collaboration with professionals from industry and the community with the aim of providing innovative solutions to real-world problems. There are no adequate frameworks and clear support structures for managing academic communities of practice (ACoP). The main aim of this paper is to develop an integrated ACoP model and elaborate on external and internal support structures to endow innovation through academic communities of practice. In the first stage of this study, a preliminary ACoP model was developed and deployed at an institution of higher education. The model was further elaborated in stage two of this study. The main elements of the model were discussed, highlighting external and internal support mechanisms. The key findings indicate the crucial role of the ACoP core group management and fundraising as well as overcoming multiple barriers to innovation.
Purpose This study aims, firstly, to determine what influence the information security policy has... more Purpose This study aims, firstly, to determine what influence the information security policy has on the information security culture by comparing the culture of employees who read the policy to those who do not, and, secondly, whether a stronger information security culture is embedded over time if more employees have read the information security policy. Design/methodology/approach An empirical study is conducted at four intervals over eight years across 12 countries using a validated information security culture assessment (ISCA) questionnaire. Findings The overall information security culture average scores as well as individual statements for all four survey assessments were significantly more positive for employees who had read the information security policy compared with employees who had not. The overall information security culture also improved from one assessment to the next. Research limitations/implications The information security culture should be measured and benchm...
This paper proposes a unique information security training and awareness approach (ISTAAP) that c... more This paper proposes a unique information security training and awareness approach (ISTAAP) that can be used to instil an information security-positive culture which will assist in addressing the risk that human behaviour poses to the protection of information. An information security culture assessment tool is used as the critical diagnostic instrument to assess the information security culture within the context of ISTAAP. A case study is discussed where the ISTAAP was deployed. This provided empirical data to illustrate the value of ISTAAP to direct employee behaviour through focused training and awareness based on the outcome of the information security culture assessment data.
2019 Conference on Next Generation Computing Applications (NextComp)
This study aimed to ascertain the types of approaches that are applied in the assessments of info... more This study aimed to ascertain the types of approaches that are applied in the assessments of information security and cybersecurity user awareness and training programs. The study focused on achieving two objectives. The first objective focused on to find out what measurements are used in the assessment of the effectiveness of information security and cybersecurity user awareness and training programs. The second objective focused on studies that made use of maturity models to measure the progress of these programs. A Scoping Literature Review process was followed to achieve these objectives. The study found that there is a gap in current literature with regards to the assessment of these programs, as only five papers and two maturity models focused on the assessment of these programs. The study further recommends that more studies be conducted in the assessment of these programs, as most researchers are encouraging the use of the programs in the fight against cyber-attacks.
2016 Information Security for South Africa (ISSA), 2016
Personal information is collected and processed by various companies when individuals buy product... more Personal information is collected and processed by various companies when individuals buy products and services, share their information on social media or enter their details in competitions and so on. This personal information, which could potentially also be shared with third party companies, is analyzed to tailor services and products to consumer's preferences and online behavior, with the objective of creating a data value chain. When the Protection of Personal Information (PoPI) Act (2013) comes into effect in South Africa, companies will have to comply with the conditions of PoPI and protect individuals' personal information accordingly. Companies will only be allowed to use personal information for the agreed purpose it was collected for and must obtain individuals' consent to share or further process their information. This research sets out to monitor the flow of personal information through an experiment to establish if data value chains are shaped within the South African insurance industry, and to establish whether the consumer's personal information, which is part of the data value chain, is processed in line with certain conditions of PoPI. The experiment highlighted that some of the insurance companies in the selected sample did not comply with the opt-in or opt-out preferences of the researcher. In addition some did not meet with the condition to obtain consent before sharing personal information with third parties for marketing purposes. No formal data value chains could be identified during the time frame of this experiment as it was found that the researcher was contacted randomly about generic marketing and communication offerings.
In the United Kingdom (UK), the Data Protection Act (DPA) has been in force since 1998, whereas S... more In the United Kingdom (UK), the Data Protection Act (DPA) has been in force since 1998, whereas South African (SA) organisations are preparing for compliance with the Protection of Personal Information Act (POPIA). The objective of this research is to compare aspects of data protection compliance between the UK and SA to establish if a country that has had data protection in place for a longer period of time has a higher level of compliance with data protection requirements in an online context compared to a country that is preparing for compliance, using the results to make recommendations for non-compliance aspects. To fulfil the research objective, an insurance industry multi-case study was conducted. Similar data privacy requirements from the DPA and POPIA were selected for the multi-case study and as such, consent for direct marketing, secure processing of personal information (PI), privacy policies and sharing of PI collected via websites were evaluated. For each country, PI o...
Personal information is being generated and distributed at an increasingly rapid pace. This pheno... more Personal information is being generated and distributed at an increasingly rapid pace. This phenomenon provides both opportunity and risk in equal measure. The flow of personal information allows corporations to use information about what services are needed and where they are needed. Harnessing the power of this big data can potentially transform society for both corporations and their customers. However, personal information could be exploited for private commercial gain without permission being sought or the individual being informed. It is for this reason that relevant legislation has been passed in South Africa in the form of the Protection of Personal Information (PoPI) Act, bringing South Africa on par with international privacy legislation. This research explores both positive and negative aspects of forming personal information value chains in South Africa by means of an experiment within the scope of the South African insurance industry. This experiment demonstrates the la...
2017 Information Security for South Africa (ISSA), 2017
The Protection of Personal Information Act of 2013 (POPIA) regulates the processing of personal i... more The Protection of Personal Information Act of 2013 (POPIA) regulates the processing of personal information in South Africa and also includes provisions for the use of personal information for the purposes of direct marketing. While it is anticipated that the law will commence in the near future, many organizations are still in the process of implementing measures to comply with POPIA. The objective of this research was to establish if the retail and medical aid industries comply with certain conditions of POPIA and specifically the opt-in and opt- out preferences for direct marketing. Other aspects, such as the secure processing of personal information, availability of a privacy policy on websites and possible data leakage with third parties, were also investigated. A case study research design was followed where personal information was deposited on websites in the retail and medical aid industries. The data indicates that preferences for direct marketing were not honored and that personal information was shared with third parties, especially in the retail industry. The majority of the medical aid companies included in the sample did not have secure websites or a privacy policy on their website. In order to maintain consumer trust and to comply with regulatory requirements, organizations in South Africa should ensure that they implement the necessary processes and technology to process information in a lawful and secure manner at all times.
Purpose This study aims to conduct a survey in a bank to measure the perception of employees towa... more Purpose This study aims to conduct a survey in a bank to measure the perception of employees towards the effective governance of information privacy and at the same time validating the information privacy governance questionnaire (IPGQ) used in this study. Design/methodology/approach A quantitative research approach was followed using an online survey questionnaire to collect data in a bank in South Africa. Findings The survey results showed that employees perceived the governance of privacy in the organisation in a positive way. Three significant differences were identified, namely, Generation-Y being significantly more positive than Generation-X regarding privacy control assessment. Also, that the contractor/vendor group was significantly more positive than permanent employees regarding organisational commitment and privacy control assessment. Exploratory factor analysis was used to validate the IPGQ and four factors were identified: privacy control assessment, personal informatio...
Human Aspects of Information Security and Assurance, 2020
Privacy issues extend to students as universities acquire and use their personal information for ... more Privacy issues extend to students as universities acquire and use their personal information for various reasons. This research study was aimed at determining the awareness, expectations and confidence levels of students when the university processes their personal information. The research was also aimed at validating the Information Privacy Perception Survey (IPPS) instrument. The instrument was designed based on the Fair Information Practice Principles, incorporating privacy principles and guidelines from the Organisation for Economic Cooperation and Development’s Protection of Privacy and Transborder Flows of Personal Data document, the General Data Protection Regulation and the Zimbabwe Data Protection Act bill. A survey research strategy was used following a quantitative research design where data were collected from 287 students at a selected university using a convenience sampling method. The IPPS instrument was validated using exploratory factor analysis. Seven factors resulted; university confidence, privacy expectations, individual awareness, external awareness, privacy education, practice confidence and correctness expectations. The IPPS can be used by universities to establish the level of awareness and confidence students have regarding how their privacy is upheld by the university. The results show the areas of improvement in the university’s privacy practices to create an environment that instils and favours upholding the privacy of students’ personal information. Aspects for improvement can be integrated in the university’s awareness programmes or policies.
2019 Conference on Information Communications Technology and Society (ICTAS), 2019
The increase in threats to information systems resources in organisations has been attributed to ... more The increase in threats to information systems resources in organisations has been attributed to the failure by employees to adhere to information security policies. Research into the information security behaviour of employees is still predominantly based on the extrinsic model, while the intrinsic model has not received as much attention. Therefore, this paper aims to contribute to the understanding of the intrinsic motivations that lead to information security compliant behaviour. To this end, a review of literature on this topic was conducted to understand what other researchers have found in this area. The results show that intrinsic motivational factors could provide alternative explanations for information security compliant behaviour. This paper proposes a conceptual framework for compliant behaviour based on the self-determination theory.
Human Aspects of Information Security and Assurance, 2021
Education institutions within and outside Ghana continue to experience mass information leakages ... more Education institutions within and outside Ghana continue to experience mass information leakages at an alarming rate even with the huge investment made in information technology infrastructure to secure their information assets. The lack of organisational commitment to enhance the nontechnical aspects of information securitythus, information security culture (ISC)largely accounts for the consistent rise of security breaches in institutions like the educational institutions. Securing information assets goes beyond technical controls and encompasses people, technology, policy, and operations. The aim of this paper is to identify a comprehensive list of the factors of ISC and construct a conceptual ISC framework (InfoSeCulF) that can be used to provide guidance for the cultivation of a strong ISC in higher learning institutions to secure information assets. A scoping literature review was conducted to determine what constitutes a comprehensive list of factors for cultivating ISC in higher learning institutions. The study proposes a comprehensive list of factors and provides a conceptual framework (InfoSeCulF) which serves as guide for cultivating a strong ISC in institutions.
Cybersecurity Education for Awareness and Compliance, 2019
A security culture can be a competitive advantage when employees uphold strong values for the pro... more A security culture can be a competitive advantage when employees uphold strong values for the protection of information and exhibit behavior that is in compliance with policies, thereby introducing minimal incidents and breaches. The security culture in an organization might, though, not be similar among departments, job levels, or even generation groups. It can pose a risk when it is not conducive to the protection of information and when security incidents and breaches occur due to employee error or negligence. This chapter aims to give organizations an overview of the concept of security culture, the factors that could influence it, an approach to assess the security culture, and to prioritize and tailor interventions for high-risk areas. The outcome of the security culture assessment can be used as input to define security awareness, training, and education programs aiding employees to exhibit behavior that is in compliance with security policies.
2018 Conference on Information Communications Technology and Society (ICTAS), 2018
Information privacy concerns extend to the online environment with consumers having different exp... more Information privacy concerns extend to the online environment with consumers having different expectations towards privacy. While privacy is regulated in many countries the perception of online consumers, the privacy culture, vary as indicated in various global surveys. This research aims to develop a validated instrument that can be used to measure the online information privacy culture of consumers. For this purpose a conceptual Online Information Privacy Culture Index Framework (OIPCIF) is proposed based on the Fair Information Practice Principles (FIPPs) and the OECD privacy guidelines. The Online Information Privacy Culture Index Questionnaire (OIPCIQ) is conceptualized and validated using factor and item analysis. The OIPCO was rolled out in South Africa as the first participating country in the study for which recommendations are made based on the outcomes.
2019 Conference on Information Communications Technology and Society (ICTAS), 2019
SMMEs are increasingly depending on IT to manage their business operations effectively. In South ... more SMMEs are increasingly depending on IT to manage their business operations effectively. In South Africa, there is an increase of cyberattacks on organisations regardless of size and industry, although SMMEs are most impacted. Yet, SMMEs do not always pay attention to cyber security issues. The primary objective of this paper is to review, discover and update researchers about prior cyber security awareness (CSA) studies conducted in the context of South African SMMEs, which warrant future work. A second objective is to discover and analyse frameworks to identify building blocks for a CSA framework. Therefore, in order to respond to research questions, the literature was reviewed systematically. The evaluation shows the absence of previous studies on the topic. However, it was concluded that none of the identified frameworks can be utilised in an SMME context. In addition, ten common components of CSA were identified, that can be considered in future research.
The information security culture of an organisation is influenced by various factors, of which on... more The information security culture of an organisation is influenced by various factors, of which one could be related to legal and regulatory requirements. While employees must comply with organisational policies, external factors like data protection legislation might influence the manner in which employees protect information assets. This research sets out to investigate whether the information security culture level is consistent across offices of an organisation located in jurisdictions with and without data protection legislation and if the timeframe of the implemented data protection regulation might have had an impact. An information security culture survey was conducted in an organisation that follows a centralised approach to information security. Statistical analysis was conducted to compare the information security culture data of offices across six data protection jurisdictions where the organisation operates, namely Mauritius, Switzerland, Guernsey, South Africa, United K...
This work is based on research supported wholly by the National Research Foundation of South Afri... more This work is based on research supported wholly by the National Research Foundation of South Africa (Grant Numbers: 105735)
A cybersecurity culture must be promoted at an international, national, organizational, and indiv... more A cybersecurity culture must be promoted at an international, national, organizational, and individual level to aid in minimizing risks from a human perspective in cyberspace. To promote such a culture it has to be understood and quantified in order to direct change. This research makes use of the disciplines of information technology and industrial psychology to define a cybersecurity culture. A quantitative research methodology, cybersecurity culture research methodology (CSeCRM), is proposed that can be used to measure a cybersecurity culture. The objective of CSeCRM is to ensure that a reliable and valid measuring instrument is used to measure cybersecurity culture. The results derived from using such an instrument can aid in identifying actions to change and direct the cybersecurity culture at, for instance, schools or businesses, at national or international level. The CSeCRM is illustrated by implementing it in an organization where a cybersecurity culture measuring instrument was validated.
Innovations in Education and Teaching International, 2019
Academic communities of practice (ACoPs) are formed in collaboration with professionals from indu... more Academic communities of practice (ACoPs) are formed in collaboration with professionals from industry and the community with the aim of providing innovative solutions to real-world problems. There are no adequate frameworks and clear support structures for managing academic communities of practice (ACoP). The main aim of this paper is to develop an integrated ACoP model and elaborate on external and internal support structures to endow innovation through academic communities of practice. In the first stage of this study, a preliminary ACoP model was developed and deployed at an institution of higher education. The model was further elaborated in stage two of this study. The main elements of the model were discussed, highlighting external and internal support mechanisms. The key findings indicate the crucial role of the ACoP core group management and fundraising as well as overcoming multiple barriers to innovation.
Purpose This study aims, firstly, to determine what influence the information security policy has... more Purpose This study aims, firstly, to determine what influence the information security policy has on the information security culture by comparing the culture of employees who read the policy to those who do not, and, secondly, whether a stronger information security culture is embedded over time if more employees have read the information security policy. Design/methodology/approach An empirical study is conducted at four intervals over eight years across 12 countries using a validated information security culture assessment (ISCA) questionnaire. Findings The overall information security culture average scores as well as individual statements for all four survey assessments were significantly more positive for employees who had read the information security policy compared with employees who had not. The overall information security culture also improved from one assessment to the next. Research limitations/implications The information security culture should be measured and benchm...
This paper proposes a unique information security training and awareness approach (ISTAAP) that c... more This paper proposes a unique information security training and awareness approach (ISTAAP) that can be used to instil an information security-positive culture which will assist in addressing the risk that human behaviour poses to the protection of information. An information security culture assessment tool is used as the critical diagnostic instrument to assess the information security culture within the context of ISTAAP. A case study is discussed where the ISTAAP was deployed. This provided empirical data to illustrate the value of ISTAAP to direct employee behaviour through focused training and awareness based on the outcome of the information security culture assessment data.
2019 Conference on Next Generation Computing Applications (NextComp)
This study aimed to ascertain the types of approaches that are applied in the assessments of info... more This study aimed to ascertain the types of approaches that are applied in the assessments of information security and cybersecurity user awareness and training programs. The study focused on achieving two objectives. The first objective focused on to find out what measurements are used in the assessment of the effectiveness of information security and cybersecurity user awareness and training programs. The second objective focused on studies that made use of maturity models to measure the progress of these programs. A Scoping Literature Review process was followed to achieve these objectives. The study found that there is a gap in current literature with regards to the assessment of these programs, as only five papers and two maturity models focused on the assessment of these programs. The study further recommends that more studies be conducted in the assessment of these programs, as most researchers are encouraging the use of the programs in the fight against cyber-attacks.
2016 Information Security for South Africa (ISSA), 2016
Personal information is collected and processed by various companies when individuals buy product... more Personal information is collected and processed by various companies when individuals buy products and services, share their information on social media or enter their details in competitions and so on. This personal information, which could potentially also be shared with third party companies, is analyzed to tailor services and products to consumer's preferences and online behavior, with the objective of creating a data value chain. When the Protection of Personal Information (PoPI) Act (2013) comes into effect in South Africa, companies will have to comply with the conditions of PoPI and protect individuals' personal information accordingly. Companies will only be allowed to use personal information for the agreed purpose it was collected for and must obtain individuals' consent to share or further process their information. This research sets out to monitor the flow of personal information through an experiment to establish if data value chains are shaped within the South African insurance industry, and to establish whether the consumer's personal information, which is part of the data value chain, is processed in line with certain conditions of PoPI. The experiment highlighted that some of the insurance companies in the selected sample did not comply with the opt-in or opt-out preferences of the researcher. In addition some did not meet with the condition to obtain consent before sharing personal information with third parties for marketing purposes. No formal data value chains could be identified during the time frame of this experiment as it was found that the researcher was contacted randomly about generic marketing and communication offerings.
In the United Kingdom (UK), the Data Protection Act (DPA) has been in force since 1998, whereas S... more In the United Kingdom (UK), the Data Protection Act (DPA) has been in force since 1998, whereas South African (SA) organisations are preparing for compliance with the Protection of Personal Information Act (POPIA). The objective of this research is to compare aspects of data protection compliance between the UK and SA to establish if a country that has had data protection in place for a longer period of time has a higher level of compliance with data protection requirements in an online context compared to a country that is preparing for compliance, using the results to make recommendations for non-compliance aspects. To fulfil the research objective, an insurance industry multi-case study was conducted. Similar data privacy requirements from the DPA and POPIA were selected for the multi-case study and as such, consent for direct marketing, secure processing of personal information (PI), privacy policies and sharing of PI collected via websites were evaluated. For each country, PI o...
Personal information is being generated and distributed at an increasingly rapid pace. This pheno... more Personal information is being generated and distributed at an increasingly rapid pace. This phenomenon provides both opportunity and risk in equal measure. The flow of personal information allows corporations to use information about what services are needed and where they are needed. Harnessing the power of this big data can potentially transform society for both corporations and their customers. However, personal information could be exploited for private commercial gain without permission being sought or the individual being informed. It is for this reason that relevant legislation has been passed in South Africa in the form of the Protection of Personal Information (PoPI) Act, bringing South Africa on par with international privacy legislation. This research explores both positive and negative aspects of forming personal information value chains in South Africa by means of an experiment within the scope of the South African insurance industry. This experiment demonstrates the la...
2017 Information Security for South Africa (ISSA), 2017
The Protection of Personal Information Act of 2013 (POPIA) regulates the processing of personal i... more The Protection of Personal Information Act of 2013 (POPIA) regulates the processing of personal information in South Africa and also includes provisions for the use of personal information for the purposes of direct marketing. While it is anticipated that the law will commence in the near future, many organizations are still in the process of implementing measures to comply with POPIA. The objective of this research was to establish if the retail and medical aid industries comply with certain conditions of POPIA and specifically the opt-in and opt- out preferences for direct marketing. Other aspects, such as the secure processing of personal information, availability of a privacy policy on websites and possible data leakage with third parties, were also investigated. A case study research design was followed where personal information was deposited on websites in the retail and medical aid industries. The data indicates that preferences for direct marketing were not honored and that personal information was shared with third parties, especially in the retail industry. The majority of the medical aid companies included in the sample did not have secure websites or a privacy policy on their website. In order to maintain consumer trust and to comply with regulatory requirements, organizations in South Africa should ensure that they implement the necessary processes and technology to process information in a lawful and secure manner at all times.
Purpose This study aims to conduct a survey in a bank to measure the perception of employees towa... more Purpose This study aims to conduct a survey in a bank to measure the perception of employees towards the effective governance of information privacy and at the same time validating the information privacy governance questionnaire (IPGQ) used in this study. Design/methodology/approach A quantitative research approach was followed using an online survey questionnaire to collect data in a bank in South Africa. Findings The survey results showed that employees perceived the governance of privacy in the organisation in a positive way. Three significant differences were identified, namely, Generation-Y being significantly more positive than Generation-X regarding privacy control assessment. Also, that the contractor/vendor group was significantly more positive than permanent employees regarding organisational commitment and privacy control assessment. Exploratory factor analysis was used to validate the IPGQ and four factors were identified: privacy control assessment, personal informatio...
Human Aspects of Information Security and Assurance, 2020
Privacy issues extend to students as universities acquire and use their personal information for ... more Privacy issues extend to students as universities acquire and use their personal information for various reasons. This research study was aimed at determining the awareness, expectations and confidence levels of students when the university processes their personal information. The research was also aimed at validating the Information Privacy Perception Survey (IPPS) instrument. The instrument was designed based on the Fair Information Practice Principles, incorporating privacy principles and guidelines from the Organisation for Economic Cooperation and Development’s Protection of Privacy and Transborder Flows of Personal Data document, the General Data Protection Regulation and the Zimbabwe Data Protection Act bill. A survey research strategy was used following a quantitative research design where data were collected from 287 students at a selected university using a convenience sampling method. The IPPS instrument was validated using exploratory factor analysis. Seven factors resulted; university confidence, privacy expectations, individual awareness, external awareness, privacy education, practice confidence and correctness expectations. The IPPS can be used by universities to establish the level of awareness and confidence students have regarding how their privacy is upheld by the university. The results show the areas of improvement in the university’s privacy practices to create an environment that instils and favours upholding the privacy of students’ personal information. Aspects for improvement can be integrated in the university’s awareness programmes or policies.
2019 Conference on Information Communications Technology and Society (ICTAS), 2019
The increase in threats to information systems resources in organisations has been attributed to ... more The increase in threats to information systems resources in organisations has been attributed to the failure by employees to adhere to information security policies. Research into the information security behaviour of employees is still predominantly based on the extrinsic model, while the intrinsic model has not received as much attention. Therefore, this paper aims to contribute to the understanding of the intrinsic motivations that lead to information security compliant behaviour. To this end, a review of literature on this topic was conducted to understand what other researchers have found in this area. The results show that intrinsic motivational factors could provide alternative explanations for information security compliant behaviour. This paper proposes a conceptual framework for compliant behaviour based on the self-determination theory.
Uploads
Papers by Adele Da Veiga