Management Information Systems Commons^™

Experts’ Validation Of The Fundamental Cybersecurity Competency Index (Fcci) Using A Commercial Cyber Range Through Human-Generative Artificial Intelligence (Genai) Teaming, Dariusz Witko, Yair Levy, Catherine Neubauer, Greg Simco, Laurie P. Dringus, Melissa Carlton

Journal of Cybersecurity Education, Research and Practice

The increasing volume of cyber threats, combined with a critical shortage of skilled professionals and rising burnout among practitioners, highlights the urgent need for innovative solutions in cybersecurity operations. Generative Artificial Intelligence (GenAI) offers promising potential to augment human analysts in cybersecurity, but its integration requires rigorous validation of the fundamental competencies that enable effective collaboration of human-GenAI teams. This research study employed a mixed-methods research project designed to evaluate human-GenAI teams, emphasizing the role of expert consensus in shaping the experimental assessment of the Fundamental Cybersecurity Competency Index (FCCI) in a commercial cyber range. We engaged 20 Subject Matter …

Higher Education Cybersecurity: A Vulnerability Assessment Of The U.S. South’S Institutional Websites, Zachary W. Taylor, Vivi Vo

Journal of Cybersecurity Education, Research and Practice

As technology continues to advance, it is critical to understand how higher education institutions protect digital information of their stakeholders including students, faculty, and staff through cybersecurity measures. Although conceptual research has articulated various aspects of cybersecurity, no empirical research has explored the cybersecurity of higher education (.edu) websites through a vulnerability scan of these websites via an open PortScan and analysis. To fill a critical gap in the literature, this study conducted a vulnerability scan and open PortScan and analysis of all higher education websites in three of the lowest-income states in the United States: Louisiana (n=112), Mississippi (n=52), …

Impact Of Information Security Awareness Training On Knowledge, Attitude, And Behavior: A K-12 Case Study, Michael S. Robbins, Christopher Robbins

Journal of Cybersecurity Education, Research and Practice

Abstract— Information security breaches remain a serious threat across all sectors, often exploiting human factors rather than technical flaws. This study examines how a structured Information Security Awareness (ISA) training program influences employees’ knowledge of security policies, attitudes towards those policies, and self-reported security behaviors within a K-12 educational environment. A quantitative pre-test/post-test design was employed with 201 staff members (administrators, teachers, and support personnel) in a public school district. Participants completed the Human Aspects of Information Security Questionnaire (HAIS-Q) before and after undergoing an interactive cybersecurity training program. Statistical analysis revealed a significant improvement in information security knowledge, attitudes, …

Arizona’S Experiential Learning Opportunities: Regional Security Operations Centers And Cybersecurity Clinics, Joshua Kipers, Paul Wagner, Robert J. Honomichl

Journal of Cybersecurity Education, Research and Practice

The increasing frequency, sophistication, and economic impact of cybersecurity incidents have intensified the global demand for a skilled cybersecurity workforce. Traditional academic programs often fail to provide the applied experience necessary to prepare graduates for the rapidly evolving threat landscape. This paper examines Arizona’s innovative approaches to experiential cybersecurity education through the establishment of Regional Security Operations Centers (RSOCs) and the Arizona Cybersecurity Clinic. These initiatives integrate Kolb’s Experiential Learning Theory and the NICE Cybersecurity Workforce Framework to align academic preparation with real-world practice. The RSOCs, supported by the Arizona Department of Homeland Security, provide paid student internships focused on …

Prompt Engineering For Genai In Cybersecurity Incident Response: A Multi-Platform Evaluation Based On Nice Pr-Ir-001, Yuanyuan Liu

Journal of Cybersecurity Education, Research and Practice

This study explores the application of prompt engineering in cybersecurity education, mainly by evaluating the performance of different generative artificial intelligence (GenAI) platforms when performing tasks consistent with the NICE framework role pr-ir-001 - Network Defense Incident Responder. The study employed structured prompts designed for a medical technology environment compliant with HIPAA and NIST SP 800-53, while the tasks of the three GenAI models (GPT-4, Gemini, and DeepSeek) were to generate event response scenarios. Their outputs will be evaluated from four aspects: accuracy, relevance, clarity and completeness.

The results show that the three models differ in depth and consistency, but …

Static Malware Analysis For Incident Response: Developing A Tactical Aid With Ember, Joel Meoak, Shengjie Xu

Journal of Cybersecurity Education, Research and Practice

Incident responders face a variety of challenges when identifying malware using existing solutions, particularly when rapid tactical decisions are needed. Traditional malware detection methods are often signature-based, limiting their effectiveness to previously known threats detected by anti-virus (AV) engines. Online analysis tools introduce confidentiality risks, potentially alerting adversaries that their actions are under scrutiny. While free sandbox environments offer useful capabilities, they often require substantial setup time and hardware resources that may not be available in the field. This research leverages the Elastic Malware Benchmark for Empowering Researchers (EMBER) dataset to develop a lightweight, portable tactical decision aid that enables …

Problematic Smartphone Use Experiences Of Students, Gbolahan Olasina

The African Journal of Information Systems

Smartphones extend people's opportunities by improving their daily living and well-being. Hence, given the tool’s features and affordances that promote human development, smartphones facilitate the achievement of the individual liberties and freedoms of ordinary people. However, there are serious concerns about the emotional, social and cultural factors underlying smartphone usage patterns and their association with problematic use and depressive behaviors. Therefore, the overriding goal of the research reported on in this paper was to investigate how smartphone use influences individuals’ emotional wellness, interpersonal relationships and sociocultural contexts. Existing academic literature indicated that there was a need to investigate the intricate …

Factors Influencing The Use Of Gis-Enabled Public E-Participation For Municipal Solid Waste Management, Irene Arinaitwe, Agnes Nakakawa, Gilbert Maiga

The African Journal of Information Systems

Due to rapid global population growth and urbanization, approximately two billion metric tons of waste are generated annually. Municipal solid waste management has become a critical function for urban authorities. However, many urban authorities in low- and middle-income economies cannot provide efficient municipal solid waste management services because of suboptimal stakeholder participation in governance processes and inadequate information exchange. Therefore, this study sought to determine factors that influence the implementation of GIS-enabled public e-participation using Enhanced Adaptive Structuration Theory. A descriptive field study was conducted among staff of municipal authorities and residents in Uganda’s Kampala Metropolitan Area. Data were analyzed …

Experiential Learning: Innovative Approaches To Post-Secondary Cybersecurity Education, Brendan Bertone, Paul Wagner, Joshua Pauli

Journal of Cybersecurity Education, Research and Practice

The cybersecurity profession continues to face a significant shortfall of qualified professionals despite steady growth in degree programs. Employers consistently cite experience as the main barrier for entry-level cybersecurity hires. This paper argues that clinic-based experiential learning offers a scalable solution to that preparation gap. A systematic literature review spanning academic and professional literature was conducted to examine: (1) barriers to entry for aspiring cybersecurity professionals; (2) the effectiveness of experiential learning compared to traditional instruction; and (3) the viability and scalability of cybersecurity clinics. Screening emphasized workforce development, experiential pedagogy, and alignment with the NICE Cybersecurity Workforce Framework. Findings …

Information Security Awareness And Behavior Of Smartphone Users In The Ibadan Metropolis, Nigeria, Funmilola Olubunmi Omotayo

Journal of Cybersecurity Education, Research and Practice

Today, there is a rapid increase in the number of people using the Internet via smartphones and relying on them for most of their daily activities. Consequently, smartphones are becoming the target of criminals for atrocious purposes. This study investigated the information security awareness and behavior of smartphone users in the Ibadan metropolis, Nigeria. The study adopted a descriptive survey design. Data was collected with a questionnaire from 400 respondents who were conveniently selected. Findings revealed that most smartphone users knew about the smartphone security features available on their phones. However, most also engaged in behaviors that threatened their information …

The Effects Of Organisational Culture In Strengthening Resilience And Technological Innovation: A Case Of Smes In South Africa, Lunathi Gwayi, Ayanda Pekane, Luzuko Tekeni

African Conference on Information Systems and Technology

The COVID-19 pandemic changed how small and medium enterprises (SMEs) operated by forcing rapid digital transformation and remote work. This created an urgent need to understand how organisational culture can support resilience and encourage innovation. This study addressed the knowledge gap regarding how a strong organisational culture can help SMEs in South Africa navigate global crises, adapt to digital demands, and sustain long-term growth. The purpose of the study was explanatory, supported by an interpretive, inductive approach, and a qualitative strategy. Through semi-structured interviews with senior managers in the South African IT sector, the research identified Clan and Adhocracy cultures …

The Integration Of Agile Methodologies In Devops Practices Within The Information Technology Industry, Ashley Hourigan, Ridewaan Hanslo

African Conference on Information Systems and Technology

The demand for rapid software delivery in the Information Technology (IT) industry has significantly intensified, emphasising the need for faster software products and service releases with enhanced features to meet customer expectations. Agile methodologies are replacing traditional approaches such as Waterfall, where flexibility, iterative development and adaptation to change are favoured over rigid planning and execution. DevOps, a subsequent evolution from Agile, emphasises collaborative efforts in development and operations teams, focusing on continuous integration and deployment to deliver resilient and high-quality software products and services. This study aims to critically assess both Agile and DevOps practices in the IT industry …

Employee’S Willingness To Engage In Information Security Incident Reporting, Ryan Moodley, Salah Kabanda

African Conference on Information Systems and Technology

Organisations employ several strategies for mitigating insider threats, and yet recent studies have shown that insider threats continue to surge. Strategies are mostly reliant on technological solutions and more recently, a human centered approach where the focus is on psychological profile and behavioural habits of the individual posing the threat (the insider). The role of employees in reporting the insider or in the reporting of security incidents has received limited attention. This paper, through a literature review synthesis, identifies the factors influencing an employee’s willingness to report an insider and consequently reporting of security incidents. Through a thematic analysis of …

Applying Detective Analytics For Mitigating Financial Crime In An Organisation, Nontobeko Mlambo, Tiko Iyamu

African Conference on Information Systems and Technology

Despite the growing popularity of detective analytics, it is consistently challenging to understand the factors that influence the adoption. This is increasingly discouraging organisations, even though the tool is important for tracing, tracking, and mitigating financial crime. This study applied concepts of ‘follow the actors’ and shifting negotiation of actor-network theory (ANT) to gain a better understanding of the factors that influence the adoption of detective analytics in a qualitative case study using a South African-based financial organisation. From the analysis, integration of analytics tools, integration of detective analytics with other systems and processes, development of a template for each …

Exploring The Role Of Affordances And Constraints In Shaping Trust Within The Mobile Money Ecosystem: A Case Of Rural Communities In Sub-Saharan Africa, Raphael Amponsah, Eric Afful-Dadzie, Richard Boateng, Emmanuel Awuni Kolog

African Conference on Information Systems and Technology

This study delves into the intricacies of mobile money technology (MMT) in rural areas of Low-Middle Income Countries (LMICs) and examines its ecosystem dynamics, affordances, constraints, and the role of trust in adoption and sustained usage. It aims to address the existing gaps in understanding the challenges and inconsistencies surrounding MMT interactions in rural communities. Emphasizing the importance of viewing MMT as an evolving ecosystem rather than just a platform, the study seeks to uncover new perspectives on the affordances and constraints shaping trust and adoption in rural communities. Primarily, the study seeks to contribute theoretically to the discourse on …

Optimizing Information Security In Cloud Environments: A Risk Management Approach And Guide For Enterprise Cloud Security, Joshua Olusegun Oyeniyi, Oluwashina Akinloye Oyeniran

Journal of Cybersecurity Education, Research and Practice

In recent years, cloud computing has become increasingly integral to organizational operations due to its scalability, accessibility and cost effectiveness in managing data and resources. However, the rise in security threats and attacks on cloud environments necessitates having robust measures in place to protect data confidentiality, integrity and availability. This paper presents an optimized approach to cloud information security management by reviewing the current threat landscape, evaluating key risk management frameworks, and provided practical solutions for enhancing enterprise cloud security. The study examined three leading cloud security frameworks: the Cloud Controls Matrix (CCM) known for its cloud-specific controls, the NIST …

The National Cybersecurity Teaching Coalition: Expanding Cybersecurity Education Opportunities, Paul Wagner, Melissa Dark, Robert Honomichl, Filipo Sharevski, Sandra Leiterman

Journal of Cybersecurity Education, Research and Practice

The increasing prevalence of cybersecurity threats and the shortage of qualified professionals necessitate innovative solutions for cybersecurity education at all levels. Despite the expansion of post-secondary cybersecurity programs, employer dissatisfaction with graduates and a lack of standardized introductory curricula highlights the need for structured secondary education pathways. The National Cybersecurity Teaching Coalition (NCTC) and its National Cybersecurity Teaching Academy (NCTA) address this gap by equipping high school educators with the necessary knowledge and credentials to teach cybersecurity effectively. NCTA offers an 18-credit cybersecurity graduate certificate program to ensure teachers are competent and confident to develop and teach cybersecurity curriculum with …

The Impact Of Ai Use In Programming Courses On Critical Thinking Skills, Christian Jay St Francis Clarke, Abdullah Konak

Journal of Cybersecurity Education, Research and Practice

Proficiency in computer programming extends far beyond memorizing syntax; it depends on the cultivation of critical thinking. Computer programming requires multiple interconnected competencies, including systematic problem analysis, algorithmic reasoning, mastery of programming languages, debugging capabilities, a comprehensive understanding of software development methodologies, rigorous testing practices, and systematic troubleshooting approaches. These skills are also essential for cybersecurity experts; cybersecurity programs require several programming courses to enhance students’ technical and critical thinking skills. Generative AI (GenAI) technologies have fundamentally changed the process of developing applications and approaches to teaching coding. The growing use of GenAI technologies by students in writing computer code …

The Urgency Of Instituting Systemic Cybersecurity Curriculum Within Stem At Secondary Educational Levels In Preparation For Postsecondary Institutions., Robert Spencer

Journal of Cybersecurity Education, Research and Practice

Over the last 20 years, many secondary institutions have made advances developing curriculum defined as “STEM (Science, Engineering and Mathematics)” in order to ensure secondary students are eligible to apply as well excel in technology degree programs at the college and university levels. Although various initiatives exist, there are studies however, which allude to a great possibility that there will be a lack of cybersecurity professionals filling present day and anticipated future positions. Despite a large number of federal and educational enhancements there is need for additional research regarding instituting overall systemic processes and curriculum which supports secondary student transition …

Educating Students On The Behavioral And Psychological Aspects Of Romance Scam Victimization Via A Social Engineering Competition, Rachel Bleiman, Hwanhee Park, Aunshul Rege

Journal of Cybersecurity Education, Research and Practice

The online dating industry generated 2.98 billion USD in 2023 and is estimated to reach 3.6 billion USD by 2025. Not surprisingly, online dating platforms are rife with romance scams that cause financial damages, with estimated losses of 1.3 billion USD in 2022 alone. Additionally, victims suffer emotional and psychological harms. This paper shares findings from a 2023 Romance Scam and Social Engineering Competition (RSSEC) that introduced students to the behavioral and psychological aspects of romance scams. Specifically, the competition aimed to expose students to (i) understanding how victims experience social engineering (SE) - the psychological manipulation of human behavior, …

Managing Cybersecurity In Local Governments: 2022, Donald F. Norris Phd, Laura K. Mateczun Jd

Journal of Cybersecurity Education, Research and Practice

This paper, based on data from our second nationwide survey of cybersecurity among local or grassroots governments in the U.S., examines how these governments manage this important function. As we have shown elsewhere, cybersecurity among local governments is increasingly important because these governments are under constant or nearly constant cyberattack. Due to the frequency of cyberattacks, as well as the probability that at least some attacks will succeed and cause damage to local government information systems, these governments have great responsibility to protect their information assets. This, in turn, requires these governments to manage cybersecurity effectively, something our data show …

Documenting Blended Learning Resilience During Infrastructure Deficiencies, Lucia Makwasha, Hazel Mubango, Sam Takavarasha Jnr

The African Journal of Information Systems

Blended learning is a combination of eLearning and traditional face-to-face learning. Since challenges have been identified related to blended learning that hinder effective teaching and learning, this study examined student opinions of this learning model. The aim was to get a deep understanding of its effectiveness given infrastructure deficiencies. Twelve in-depth interviews were conducted with students at a university in Zimbabwe that uses blended learning, and an interpretivist paradigm was adopted. The Zone of Proximal Development proposed by Vygotsky was utilized to conceptualize the cognitive development of the students, and third-generation activity theory (AT), developed by, was used for evaluating …

Internet Of Things Devices Users’ Privacy Adherence: A Case Of Digital Ignorance, Akrasia Or Exhaustion?, Philip Bazanye, Walter F. Uys, Wallace Chigona

The African Journal of Information Systems

Internet of Things devices, such as those used in home automation, commercial and retail business, and smart cities, are vulnerable to attacks that affect all aspects of daily life. The upsurge in the use of IoT devices has increased the likelihood of cyber-attacks on end users. This research investigates the factors that influence IoT device users to adhere to privacy standards. This interpretivist exploratory research was guided by a three-phased approach. The interview questions were derived from the conceptual model and the constructs of Activity Theory, and themes were analyzed using deductive thematic analysis. The findings were elaborated with reference …

Navigating Artificial Intelligence Governance: Insights From South African Higher Education It Decision-Makers, John Mangundu

The African Journal of Information Systems

Academics and students alike can benefit from the use of artificial intelligence (AI) in education. AI governance lowers AI risks while ensuring that anticipated AI use objectives are achieved. However, research on AI governance has been lacking, especially in higher education in emerging economies such as South Africa. In light of this serious research gap, the current study presents the findings of a qualitative exploratory investigation of the maturity and preparedness of AI governance in South African higher education institutions. Informed by a combination of the TOE framework, the traditional IT governance model and the adapted IT governance maturity assessment …

Evaluation Of A Timetabling Software Implemented In Tanzanian Higher Education Context, Anna Kayanda, Lazaro Busagala, Matti Tedre

The African Journal of Information Systems

It is not known whether the combination of two IS system implementation approaches, Design Science Research and eXtreme Programming, can help improve information systems success in the Tanzanian HEI context. To investigate this, this study evaluated a system that was implemented using both approaches. The evaluation used DeLone and McLean’s Information Systems Success Model(D&M) and a mixed research method. The results showed that while neither the system quality nor the information quality influenced the use of the system, service quality and user satisfaction both had an influence on system use (p<0.001). System quality, information quality and service quality, however, were found to have a significant effect on user satisfaction, all three with p<0.001. Furthermore, using the system influenced the perceived net benefits (p<0.001) obtained from using the system. The findings may be helpful to other Tanzanian HEI wishing to implement information systems for their organizations as it shed light on factors that should be considered for a successful implementation. Although the D&M model has been useful on this study, it is limited by its lack of explicit recognition of contextual variables, such as organizational culture, user characteristics, and environmental factors, which can significantly impact system success.

What Does Chatgpt Know About Information Systems?, Daniel O'Leary, Veda C. Storey, Aaron M. French, Joseph R. Buckman, Cecil Chua, Andrew William Green, Grace Gu, Fred Niederman, Francis Pereira, Gary Templeton, Linda Wallace

Faculty Articles

Large language models such as ChatGPT provide efficient access to a wealth of information. However, there are significant questions regarding the depth and quality of knowledge in any one domain. This paper focuses specifically on the information systems (IS) field and assesses ChatGPT’s knowledge. To analyze the extent and quality of information systems knowledge derived from queries to ChatGPT, we used over 3,000 queries from a broad range of exam and quiz questions. These queries were obtained from university courses and professional information system certification exams. The query topics are based on a framework for information systems education, with queries …

Exploring School Teachers' Cyber Security Awareness, Experiences, And Practices In The Digital Age, R Ravichandran, Sonam Singh, P Sasikala

Journal of Cybersecurity Education, Research and Practice

This study investigates the awareness and practices of cyber security among school teachers, exploring their understanding of cyber threats, online behaviours, and response mechanisms to cyber incidents. A structured questionnaire was administered to gather data on demographic information, cyber security training, online practices, and experiences with cybercrime. The findings reveal varying levels of awareness among teachers, with many reporting limited knowledge of prevalent cyber threats such as phishing and identity theft. Despite the increasing reliance on digital tools for teaching, a significant number of respondents indicated a lack of formal training in cyber security. The study highlights the necessity for …

Insights In Cybersecurity Of A Smart Campus - A Review, Mircea Ţălu

Journal of Cybersecurity Education, Research and Practice

The profound impact of the Internet of Things (IoT) on various fronts, is driven by technological advancements, the ubiquitous spread of information, and the emergence of transformative events. IoT presents a diverse array of possibilities within university environments, fostering a more connected and enhanced educational experience. This research undertakes a comprehensive review of existing literature to provide context to the IoT and underscore its crucial significance in the realm of smart campuses. Additionally, the paper explores the intricate connections between IoT and key concepts such as cybersecurity and wireless sensor networks to present a holistic perspective. It delves into the …

Digital Twin And Cybersecurity In Additive Manufacturing, Lidong Wang

Journal of Cybersecurity Education, Research and Practice

Additive manufacturing (AM) has been applied to automotive, aerospace, medical sectors, etc., but there are still challenges such as parts’ porosity, cracks, surface roughness, intrinsic anisotropy, and residual stress because of the high level of thermal gradient. It is significant to conduct the modeling and simulation of the AM process and achieve quality products. Digital Twin (DT) can help AM with forecasting defects/errors through simulation and real-time process monitoring. DT is a concept of Industry 4.0, and its digital structure reflects the real-time behaviors of a cyber-physical or physical system. This paper introduces the progress of DT applications in AM, …

Perceived Risk Mediation Of Website Quality In Online Clothing Shopping In A South African Township, Khathutshelo M. Makhitha, Rodney G. Duffett

The African Journal of Information Systems

South Africa lags behind other economies regarding online shopping adoption. Extant literature has focused on the influence of risk factors on consumers’ intention to shop online. However, few studies have considered the effect that mediating factors can have on relationships between other factors related to online shopping. It is particularly important to determine the mediation effect of perceived risk factors on the relationship between perceived website quality and intentions to shop online. A quantitative survey was used to collect data from 300 online shoppers who purchase clothing online and are located in the Soweto Township in Gauteng, South Africa. Perceived …