A four-part typology to assess organizational and individual security awareness. Issue 1 (2nd January 2022)

• Record Type: Journal Article
• Authors: Reveraert, Mathias; Sauer, Tom
• Is Part Of: Information security journal. Volume 31:Issue 1(2022)
• Page Start: 64
• Page End: 82
• Publication Date: 2022-01-02
• Subjects: Security awareness -- typology -- threat -- threat mitigation -- COVID-19; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1080/19393555.2020.1855374
• Languages: English
• ISSNs: 1939-3555

Abstract

ABSTRACT: This article provides a four-part typology of security awareness. We argue that existing awareness typologies that distinguish problem awareness from solution awareness and that separate descriptive awareness from prescriptive awareness are on its own insufficient and need to be merged to have a complete picture of security awareness. Renaming and bridging both distinctions leads to four security awareness types: (1) Cognitive awareness of the threat; (2) Attitudinal awareness of the threat; (3) Cognitive awareness of the mitigation; and (4) Attitudinal awareness of the mitigation. Each type is subsequently explained in greater detail and illustrated by referring to the 2020 worldwide outbreak of COVID-19. Furthermore, it is demonstrated that the typology is applicable to study both organizational awareness and individual awareness.