Taxonomy-based approach for understanding and enhancing security culture in universities

Importance of information security in universities

Security awareness has been extensively studied in educational institutions over the years. Given the wide range of increasingly complex and aggressive attacks, it is critical to continually advise students and staff on adapting to technological changes, risks, and the requirements of new cyberspace (Garba et al., 2021). Moreover, with the digitalization of educational institutions, HEIs are more exposed to cyberattacks than any other type of institution. However, there is a notable lack of security awareness among HEIs, possibly because there are no specific standards or guidelines that can be universally applied or enforced. Additionally, most organizations do not monitor their employees’ misbehavior (Garba et al., 2021).

Parrish et al. (2018) emphasized the necessity of information security education to protect against unauthorized use of electronic information. Educational institutions are identified as vulnerable and are regularly targeted by ransomware, leading to data breaches. Consequently, educational institutions must assess their systems and implement security strategies to enhance data security approaches and policies. For example, the University of Michigan experienced a data compromise, allowing unauthorized access to sensitive information (Parrish et al., 2018). A lack of technical skills and social awareness of security issues heightens the risk of security vulnerabilities.

Therefore, HEIs must understand previous HEI hacking incidents, be prepared to protect against potential cyberattacks on their digital and PC systems, and enhance security at all levels. This preparation is crucial because cybersecurity experts have found that better cybersecurity education can prevent security attacks in other critical sectors, such as health care, emphasizing that education is fundamental to any professional career (Almomani, Ahmed & Maglaras, 2021).

Improving information security education and skills is one of the four critical components of the United Kingdom’s 2011 national strategy to secure cyberspace (Garba et al., 2021). Starting from age 11, the United Kingdom’s cyber strategy has incorporated information security at all education levels. The importance of information security has been underscored by an increase in cyberattacks in the education sector, which have become more common, resulting in financial losses and compromised data security. Preliminary findings from a UK information security survey in 2020 showed that educational institutions were among the most frequent targets in successfully reported data attacks (Garba et al., 2021). Therefore, highlighting the significance of information security in academic institutions as critical to helping others understand security training programs and protection methods (Alhogail & Mirza, 2014).

Because of the threats identified in the educational field, it is necessary to provide strategic recommendations based on practical security approaches. Additionally, management or educational authorities can assist in aligning security objectives with academic policies at individual institutions. According to Da Veiga & Martins (2015), cybersecurity policies enhance risk management and guide the education sector in addressing cyber threats (Garba et al., 2021).

Information security culture

According to Schlienger & Teufel (2003) and Mahfuth et al. (2017), ICS is defined as a goal that must be achieved by fostering a culture that supports all related activities. Information security is becoming an integral part of every employee’s daily responsibilities. Ngo, Zhou & Warren (2005), and Martins & Elofe (2002) described ISC as the way individuals and the organization behave in a manner that naturally aligns with information security standards (Alhogail & Mirza, 2014). In research by Martins & Elofe (2002) and Ngo, Zhou & Warren (2005), ISC is defined as the activities that the organization and employees should carry out in tandem to achieve compatibility and consistency with information security principles.

Creating and maintaining a security culture within an organization stems from the human aspect of information security, often regarded as the weakest link. Consequently, successful information security management requires establishing an ISC (Alnatheer, 2012). Therefore, a security culture is viewed as a subculture of an organization that encompasses employees’ daily duties, activities, standards, and practices that must aid them in protecting information assets (Mahfuth et al., 2017). Furthermore, it is crucial to develop an ISC where workers can incorporate acceptable information security practices into their daily behavior for effective information security management. This implies that employees should adopt security-aware behaviors in their work, a vital factor for managing information security (Karlsson & Hedström, 2014).

Awareness levels in universities

A critical behavioral aspect of universities is the creation of an ISC. Despite the recognized need to develop a security culture to maintain and manage information security, it is widely acknowledged that organizations, particularly universities, face significant challenges in securing information systems (Alkahtani, 2018). When examining university awareness levels, a key theme surfaces: the differences in understanding of information security among students and staff. For example, Senthilkumar & Easwaramoorthy (2017) conducted a study among college students in Tamil Nadu, India, to assess their cybersecurity awareness. Their study found that 69.45% of students had a basic understanding of cybersecurity issues, which is considerably higher than average. As a result, Senthilkumar et al. recommend the implementation of higher-level security awareness and training programs to ensure students can protect their data from cyberattacks. However, a significant percentage of students were unaware (Senthilkumar & Easwaramoorthy, 2017).

Accordingly, the security of information systems is becoming more complex and challenging in knowledge-intensive organizations such as universities (Alkahtani, 2018). All universities must secure their students’ data, eliminate risks, and minimize or mitigate any potential related risks. The lack of understanding among students and academic staff members about the threats and risks they may face in cyberspace can lead to the successful execution of such threats. Therefore, instilling a culture of information security awareness among students and academic staff members is crucial. Hence, measuring universities’ information security awareness is considered one of the most critical aspects of this process (Aljohni et al., 2021). Moreover, several studies have addressed security issues, especially in educational environments. For example, Al-Janabi & Al-Shourbaji (2016) investigated data security awareness in the Middle East, specifically in educational institutions, including researchers, undergraduate students, employees, and faculty members. The findings indicate a considerable lack of awareness of information security concepts among participants, who go about their daily work without the necessary knowledge of the importance of information security (IS) fundamentals.

Behavioral aspects of information security

Behavioral aspects of ISC represent another key theme (Sharifi, 2023). Studies have shown that despite a certain degree of awareness, behaviors and practices concerning information security can differ significantly (Sharifi, 2023). Within the context of Saudi Arabia, a growing body of literature has recognized the importance of information security in Saudi Arabia’s HEIs (Masmali & Miah, 2023; Aljohni et al., 2021). For example, Aljohni et al. (2021) aimed to assess the information security awareness level among university students in Saudi Arabia. They stated that securing the safety of cyber environments must be the top priority of every educational system (Aljohni et al., 2021). A survey conducted to collect students’ awareness of cybersecurity threats in Kingdom of Saudi Arabia (KSA) universities showed that students should be taught security issues at a young age (Aljohni et al., 2021). The earlier they learn about the risks to data security, the better prepared they will be in the future because they will focus on security (Aljohni et al., 2021). The survey concluded that there is a lack of emphasis on essential concepts that must be included when assessing and analyzing university students’ information security awareness in KSA (Aljohni et al., 2021). According to the findings, citizens of Saudi Arabia understand IT well but are unaware of information security practices and threats. The study suggested developing a framework to raise information security awareness among university students in the Middle East to prevent cyberattacks (Aljohni et al., 2021).

Addressing unique security culture challenges

A focus on building security culture and practices has been increasing across various sectors, particularly within organizational and educational contexts (da Veiga et al., 2020; Hina, Panneer Selvam & Lowry, 2019). Studies have emphasized that security culture encompasses shared values, beliefs, and behaviors aimed at protecting organizational assets from security threats (da Veiga et al., 2020). These investigations span multiple domains, including general organizations, supply chains, health care, and HEIs, with varying methodologies and insights (da Veiga et al., 2020).

In organizational contexts, studies such as that by Alhogail & Mirza (2014) have provided foundational definitions and reviews of ISC, focusing on systemic values and norms. Similarly, Karlsson, Åström & Karlsson (2014) analyzed state-of-the-art research in ISC but noted a lack of recent advancements (after 2013). Studies such as those by Lim et al. (2009) and Tang, Li & Zhang (2016) have highlighted the interplay between organizational culture and security practices through qualitative methods, stressing the need for robust frameworks that integrate technical, managerial, and human-centric elements.

In the educational domain, there is a clear recognition of HEIs’ unique vulnerabilities, such as decentralized IT structures and the need for awareness and governance strategies. For example, Kumar et al. (2024) proposed a cybersecurity framework emphasizing governance, leadership, and risk assessment tailored to HEIs. Similarly, Mahmood, Chadhar & Firmin (2024) adopted a sociotechnical systems perspective to address security challenges in HEIs, focusing on organizational and crisis-specific interventions. These studies underline the need for practical, validated frameworks to enhance cybersecurity resilience.

Further research specifically within university settings includes that of Rezgui & Marks (2008), who explored security awareness levels, and Durojaiye, Mersinas & Watling (2020), who empirically investigated cybersecurity culture in UK HEIs. Although valuable, these studies have faced limitations such as narrow geographical focus or lack of empirical testing for proposed frameworks. Moreover, works such as those by Furnell & Clarke (2005) and Kofi et al. (2020) have explored conceptual and domain-specific security frameworks without addressing broader institutional challenges.

Considering the lack of research on the taxonomy of security culture in universities, in this research we aim to resolve this problem by providing a taxonomy of BPs for universities. Several researchers (i.e., Furnell & Clarke, 2005, Kofi et al., 2020) have mentioned that their literature reviews reveal security concerns about universities. However, no explicit SLR, especially MLR, offers comprehensive BPs for implementing a taxonomy of ISC within these universities. To address this gap and provide an extensive examination of security practices relevant to universities, we conducted this MLR. The subsequent sections detail the MLR methodology employed in this study. An MLR approach holds greater value than an SLR in exploring security culture. A comparison of these reviews is presented in Tables 1 and 2. This comparison considers the proposed taxonomy, MLR methodology, and university context.

As shown in Tables 1 and 2, none of the previous studies provided a taxonomy of security BPs for universities using MLR. This motivated us to create such taxonomy through MLR.

By exploring the unique IS challenges that universities face and recognizing sociocultural factors that Impact security behaviors, in this study we aim to provide actionable insights for fostering a proactive, secure environment within educational settings, ultimately contributing to a framework that prioritizes information security in academia.

Phase 1 (Planning the multivocal literature review)

The first stage of the MLR involves the planning phase, which entails formulating research questions that encompass the review’s primary objectives. Data are gathered from two sources, FL and GL, using the MLR approach. In the subsequent sections, we will cover both data extraction processes.

Phase 2 (Conducting the multivocal literature review)

Phase 3 (Reporting the multivocal literature review)

We reviewed, assessed, gathered information, and summarized findings from the chosen articles based on the specified research questions outlined in the introduction. From each selected source, we extracted relevant data to respond to these research questions using a set extraction form.

Security culture knowledge area

In this section, we address RQ1. We employed thematic analysis to identify 12 KAs from the selected 81 studies using the MLR approach. Additionally, we utilized a bottom-up approach to uncover more KAs by grouping the BPs. All the identified KAs, along with their definitions, are presented in Table 9.

Best practices for security culture

In this section, we address RQ2 regarding the BPs for security culture. An important stage of our research methodology involved extracting data from the MLR, where we collected all raw practices derived from the MLR findings. We conducted a comprehensive analysis of primary studies to identify BPs for security culture. These identified BPs, derived from both FL and GL, are outlined in Appendix B. The numbers represent the 12 main KAs according to the ISC taxonomy. Each number is linked to a specific knowledge area, such as “1” for the “security policy” KA. Beneath each KA, there are sub-KAs (e.g., 1.4 Account) that further detail the main KA. Each subcategory then breaks down into detailed security BPs (e.g., in 1.4.1, a system will automatically log out after 10 min). This structured numbering approach organizes security practices clearly and shows their relevance to the broader ISC KAs, making the guidelines easy to follow and apply. Also, we have removed the color coding. Moreover, we employed snowballing techniques to enrich the findings further, enabling the discovery of additional practices from the literature. As mentioned before, we identified a total of 12 KAs, and under each KA, we identified a distinct set of BPs and linked them accordingly. In the subsequent stage, we undertook a careful consolidation process, merging certain practices while simultaneously eliminating redundant, ambiguous, or vague practices. This stage underwent a thorough review by the advisor to ensure the accuracy and coherence of the refined practices. The refinement process went through three iterations, as depicted in Table 10, which clearly represents the improvements made to the BPs.

Theoretical validation

Once we finalized the BPs, we conducted a pilot study to obtain expert opinions on the strength and measurability of these practices. We selected three IT experts from University A based on their expertise in security rather than software development. Furthermore, the experts were required to have at least three to four years of relevant experience. We then asked them to apply the identified practices at their respective universities to assess their measurability. Based on the feedback received, we deemed certain practices inadequate and subsequently removed them, whereas we modified others based on the experts’ comments. This iterative process allowed for the refinement of the practices.

We conducted the validation of the practices on two levels. First, we sought expert opinions, serving as the initial level of validation. Then, we asked the experts to assign scores to each practice, and we calculated an average score for each. To enhance clarity and measurability in practices, the Motorola assessment tool served as a theoretical validation method for the results from the second stage. This tool is a standard for measuring and verifying the implementation of specific practice activities. It has been extensively utilized to assess practices for each proposed model in multiple published studies (Mufti et al., 2018; Khan, Niazi & Ahmad, 2009; Ali & Khan, 2016). There are three strong reasons for utilizing Motorola’s instrument: it is a normative tool that allows for adaptation; it has been previously tested successfully at Motorola, and it features a limited number of activities. Additionally, we used a theoretical validation approach by employing the opinions of two academic experts and the Motorola measurement tool to validate the results obtained in the second stage.

Following the validation process with the three IT experts and their valuable feedback, we developed a taxonomy of security culture in universities based on the experts’ opinions. Through thematic analysis, this review facilitated a structured comparison and evaluation of current security culture solutions, as outlined in the Taxonomy of Information Security Culture in Universities section.

Types and frequency of publications

We conducted a data-driven analysis to examine the frequency of data publication in FL and GL from 2010 to 2024. With this analysis we aimed to assess the occurrence of publications over the specified period. The findings, depicted in Fig. 3, indicate that the frequency of FL has been consistently much higher than that of GL throughout the last 13 years examined.

Figure 4 displays the details of scientific literature sourced from four libraries. Based on the findings, it is evident that a significant portion of the studies addressing security culture issues and BPs are published in Springer. The results indicate that Springer has the highest number of publications in this area compared to other sources, with IEEE having the lowest number of publications.

Classification of application domains

In this section, we address RQ3 concerning the application domain for security culture. We utilized the thematic process outlined in “Research Methodology” to categorize the selected primary studies based on their common application domains. The systematic process of identification, categorization, and naming of themes and subthemes is illustrated in Fig. 5. Through this process, we were able to identify at least two or more studies that shared common application domains, which we then grouped under a single umbrella term: “theme.” We have identified five core themes in this study, with the selected studies classified accordingly: (i) Information Security: This theme includes 89.47% of the total; (ii) Nuclear: This theme represents 2.63%; (iii) Intelligent Systems: This theme includes represents 2.63%; (iv) Information Systems and Technology: This theme represents 2.63% (v) Engineering: This theme represents 2.63%. These themes provide a comprehensive framework for organizing and analyzing the selected studies based on their respective application domains.

Types of research and contributions

We have categorized the selected publications into well-established research types, as Khan et al. (2023). These types include evaluation research, proposed solutions, validation research, philosophical essays, opinion pieces, and personal experience articles. Evaluation research focuses on analyzing a particular problem or solution in practice through diverse empirical research methods. Articles proposing a solution focus on developing methods or solutions for relevant problems, although their significance may still need validation. Validation research aims to evaluate the quality attributes of proposed solutions that have yet to be implemented in real-world environments. Philosophical articles revolve around the establishment of theoretical or conceptual frameworks. Opinion articles express the authors’ positive or negative views on specific frameworks, models, or solutions. Personal experience articles involve authors sharing their individual experiences related to specific projects or endeavors.

Furthermore, we have reported the research contributions of each article categorized within these research types. We employed the thematic analysis process, as discussed in “Research Methodology”, to classify the selected 81 primary studies into the aforementioned research types. The set of selected studies consists of 10% solution-based empirical evidence from interview articles, 42% solution-based empirical evidence from questionnaires and surveys, 37% solution-based nonempirical evidence (opinion articles), and 11% personal experience/philosophical articles. We further classified these studies into a separate category, namely the proposal of solution and validation research, as depicted in Fig. 6.

The taxonomy of information security culture in universities

In this section, we answer RQ4 regarding the taxonomy of the information security culture in universities. We created a taxonomy of security culture in universities based on the experts’ opinions after the validation approach with the three IT experts and their valuable feedback.

As shown in Fig. 7, the proposed taxonomy encompasses various dimensions and subdimensions to classify security culture KAs and practices. We have shown the 12 KAs in detail, and we have identified the BPs under each KA. Figure 7 shows a visual representation of the 12 KAs and BPs. These KAs are security policy, security awareness, security training, top management support, knowledge of security, trust, risk analysis and assessment, security compliance, norms and ethical conduct, communications, change management, and attitude.

Top management support

From examining the literature, it is evident that top management support is one of the most critical KAs identified in the MLR regarding security culture. The support and commitment of top management play a crucial role in fostering a strong security culture within an organization, including universities. This KA is essential because it sets the tone for the entire organization and influences the attitudes and behaviors of employees and students toward security. The importance of top management support in establishing and maintaining a strong security culture has been extensively documented, demonstrating that leadership commitment not only sets the tone for organizational behavior but also significantly influences employee and student attitudes toward security (Hu et al., 2012).

Policy-driven security culture

Security policies and procedures: Another significant KA identified in the study regarding security culture is establishing and implementing effective security policies and procedures. These serve as the foundation for developing a robust security culture within universities and play a crucial role in guiding employees and students toward secure behaviors and practices. The analysis indicates that well-defined security policies and procedures are essential for establishing a common understanding of security requirements and expectations. These policies and procedures outline the rules, responsibilities, and consequences related to security practices, providing a framework for individuals to navigate the complex landscape of cybersecurity threats and risks. By implementing comprehensive security policies and procedures, universities can effectively address security challenges, such as data protection, access controls, incident reporting, and password management. Clear guidelines and procedures help individuals understand how to handle sensitive information securely, access systems and resources, and respond to security incidents promptly and appropriately. Research by Hina & Dominic (2020) indicated that clearly articulated security policies considerably boost adherence among university staff and students.

Compliance: We identified compliance as an important KA in universities’ security cultures. Compliance involves adhering to security policies, protocols, and regulations to protect sensitive information and resources. Promoting and enforcing compliance can help universities mitigate security risks; enhance data protection; and create a secure environment for students, staff, and stakeholders. The research conducted by Hina & Dominic (2020) demonstrated that robust compliance significantly strengthens the overall security framework by mitigating risks and highlights the essential function of enforcing security policies within HEIs, illustrating a correlation between stringent compliance, a reduction in security breaches, and an increase in awareness among faculty and students.

Ethical behavior: Ethical conduct and behavior are fundamental aspects of a strong university security culture, involving respecting privacy, adhering to legal requirements, and handling sensitive information carefully. Promoting ethical behavior through clear policies, training on ethical conduct, and enforcing consequences for misconduct contributes to a culture of security where individuals understand the impact of their actions and make conscious efforts to protect the university’s assets and information. Maintaining ethical behavior, supported by clear policies and strict compliance, is critical for reinforcing a security culture. Ethical management of data and respect for privacy are crucial. Guerrero-Dib, Portales & Heredia-Escorza (2020) discussed the consequences of ethical breaches within educational environments and highlighted how ethical breaches can damage trust and reputation, potentially leading to legal consequences and weakening the overall security posture in educational settings.

Change management in security practices

Effective change management is also identified as an important KA. It is significant in successfully implementing and embedding security practices into the organizational culture. Change management processes offer a structured approach to managing changes, ensuring they are implemented smoothly and effectively. By considering change management factors, universities can effectively overcome resistance to change. This approach enhances buy-in from stakeholders and facilitates the successful adoption of security practices. This is particularly important when universities undergo organizational changes, such as mergers or adopting new technologies, necessitating effective communication of the importance of security, alignment of security objectives with new organizational goals, and seamless integration of security into the new structure. May & Stahl (2017) argued that well-structured change management procedures are necessary to mitigate resistance and secure stakeholder support, particularly during technological upgrades or structural changes.

Awareness and training programs

The MLR highlighted the significance of awareness and training programs as essential KAs. These programs aim to increase individuals’ understanding of security risks, BPs, and their roles and responsibilities in maintaining a secure environment. The importance of awareness and training cannot be overstated. These efforts are crucial for elevating understanding of security risks and BPs. Adeshola & Oluwajana (2024) emphasized that customized training programs significantly elevate security awareness throughout university campuses. Furthermore, research on differences in security culture by profession has indicated the need to customize awareness programs based on specific roles and responsibilities within the university (Ramachandran et al., 2013).

By enhancing awareness and providing training, organizations can empower their employees and stakeholders to make informed decisions and actively contribute to the security culture.

Knowledge of security

Security knowledge is important in universities’ development of robust security cultures. This knowledge involves providing education, training, and awareness programs to students, faculty, and staff about security threats, BPs, and preventive measures. Enhancing security knowledge empowers individuals to identify potential risks, make informed decisions, and take proactive steps to safeguard their digital and physical assets, contributing to a collective effort to maintain a secure environment (Guaña-Moya et al., 2024).

Risk management

Conducting regular security risk analysis and assessment is crucial for finding potential vulnerabilities and threats, prioritizing security efforts, effectively allocating resources, and implementing appropriate security controls. Risk assessment also evaluates the effectiveness of security measures and identifies areas for improvement, helping universities minimize the likelihood of security breaches and protect their critical infrastructure and data. Ariff et al. (2014) demonstrated how continuous risk assessments can aid universities in adjusting their security strategies to protect critical infrastructure and minimize breaches.

Communication

Effective communication is a key KA that fosters a strong security culture within universities. This communication involves clearly and timely disseminating security policies, incident reporting procedures, and educational materials. Establishing communication channels promotes awareness, shares security updates, and provides guidance on security-related matters. This transparency encourages individuals to report suspicious activities, seek guidance, and stay informed about emerging security threats. Cheng et al. (2022) discussed how establishing clear communication channels has successfully enhanced the responsiveness to security updates and incidents in educational settings, improving overall security posture.

Building trust

Trust is another KA found in the present study, which is crucial for a successful security culture in universities. Trust is established when individuals have confidence in the security measures that the university has implemented and believe their personal information and assets are protected. Demonstrating a commitment to security by implementing robust security controls, safeguarding sensitive data, and maintaining transparency fosters a sense of responsibility, accountability, and collective ownership in a secure environment. Almadhoun, Dominic & Lai (2014) explored how transparency and consistent enforcement of security policies build trust among university stakeholders, leading to more proactive participation in security initiatives.

The analysis offers important insights for both practitioners and researchers in information security at universities, offering practical guidance for building and managing a robust security culture. By addressing these KAs, universities can cultivate a strong security culture that fosters a proactive and resilient approach to information security. The findings also highlight the need for further research on topics such as change management processes and the influence of national security culture on security culture within universities.