Development of the cybersecurity scale (CS-S): Evidence of validity and reliability

Abstract

This study aimed to develop a cybersecurity scale to measure individuals’ practices and perceptions regarding cybersecurity. The study tested psychometric properties of the Cybersecurity Scale (CS-S) by employing a multi-stage research design. In the first study, an Exploratory-Factor-Analysis (EFA) was conducted to explore the underlying factor structure and evaluate internal consistency reliability of the CS-S. The EFA results showed good internal consistency reliability (α = .88) and a six-factor structure. In the second study, a Confirmatory-Factor-Analysis (CFA) was conducted to verify the factor structure. The CFA results indicated that the six-factor model (i.e., confidentiality, control/possession, integrity, authenticity, availability, and utility) fits the data well. Significant individual differences were observed in each dimension of the CS-S. Results indicated that the CS-S has evidence of convergent, discriminant, and construct validity along with internal consistency reliability. The results suggested that the CS-S is a valid and reliable instrument to measure individuals’ cybersecurity practices and perceptions.

Keywords

cybersecurity cybersecurity scale cyberspace scale development CS-S

Get full access to this article

View all access options for this article.

References

Andress

(2014) The basics of information security: Understanding the fundamentals of InfoSec in theory and practice. Syngress, Elsevier, USA.

Ashiku

Dagli

(2019) Cybersecurity as a Centralized Directed System of Systems using SoS Explorer as a Tool. 14th Annual Conference System of Systems Engineering (SoSE) (pp. 140–145). IEEE.

Buczak

Guven

(2015) A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys and Tutorials, 18(2), 1153–1176. Doi: 10.1109/COMST.2015.2494502

Cherdantseva

Burnap

Blyth

Eden

Jones

Soulsby

Stoddart

(2016) A review of cyber security risk assessment methods for SCADA systems. Computers and Security, 56, 1–27. https://doi.org/10.1016/j.cose.2015.09.009

Fornell

Larcker

(1981) Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, 18(1), 39–50. https://doi.org/10.1177/002224378101800104

International Organization for Standardization/International Electrotechnical Commission (2012) ISO/IEC 27032: Information technology-security techniques-guidelines for cybersecurity.

International Telecommunication Union (2008) International Telecommunication Union, ITU -TX.1205: Series X: Data networks, open system communications and security: Telecommunication security: Overview of cybersecurity. https://www.itu.int/rec/T-REC-X.1205-200804-I

Kline

(2005) Principles and practice of structural equation modeling (2nd ed). New York: Guilford.

Meng

Kwok

(2016) A survey on OpenFlow-based Software Defined Networks: Security challenges and countermeasures. Journal of Network and Computer Applications, 68, 126–139. https://doi.org/10.1016/j.jnca.2016.04.011

10.

Liu

Xiao

Liang

Chen

(2012) Cyber security and privacy issues in smart grids. IEEE Communications Surveys and Tutorials, 14(4), 981–997. Doi: 10.1109/SURV.2011.122111.00145

11.

National Institute of Standards and Technology (2018) Framework for Improving Critical Infrastructure Cybersecurity. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.CSWP.04162018

12.

Parker

(1992) Fighting Computer Crime: A New Framework for Protecting Information. New Jersey, ABD: John Wiley and Sons.

13.

Reid

Van Niekerk

(2014) From information security to cyber security cultures. IEEE Information Security for South Africa (pp. 1–7). Doi: 10.1109/ISSA.2014.6950492

14.

Schumacker

Lomax

(2010) A beginner’s guide to structural equation modeling (3rd ed.). New York, NY: Routledge.

15.

Slusky

Partow-Navid

(2012) Students information security practices and awareness. Journal of Information Privacy and Security, 8(4), 3–26. https://doi.org/10.1080/15536548.2012.10845664

16.

Stuart

Ord

(1994) Kendall’s advanced theory of statistics. London, UK: Edward Arnold.

17.

Tabachnick

Fidell

(2014) Using multivariate statistics (6th ed.). London: Pearson Education Limited.

18.

Teer

Kruck

(2007) Empirical study of students’’ computer security practices/perceptions. Journal of Computer Information Systems, 47(3), 105–110. 10.1080/08874417.2007.11645971

19.

Ten

Liu

Manimaran

(2008) Vulnerability assessment of cybersecurity for SCADA systems. IEEE Transactions on Power Systems, 23(4), 1836–1846. Doi: 10.1109/TPWRS.2008.2002298

20.

Von Solms

Van Niekerk

(2013) From information security to cyber security. Computers and Security, 38, 97–102. https://doi.org/10.1016/j.cose.2013.04.004

21.

Wang

(2013) Cyber security in the smart grid: Survey and challenges. Computer Networks, 57(5), 1344–1371. https://doi.org/10.1016/j.comnet.2012.12.017

22.

Whitman

Mattord

(2011) Principles of Information Security. Cengage Learning, Nelson Education, CA.

23.

Yan

Qian

Sharif

Tipper

(2012) A survey on cyber security for smart grid communications. IEEE Communications Surveys and Tutorials, 14(4), 998–1010. Doi: 10.1109/SURV.2012.010912.00035