Management Information Systems Commons^™

Data Without Borders, Sovereignty Without Guarantees: Cybersecurity Risks Of Cross-Border Data Hosting In The Global South, Evidence And Policy Lessons From Mozambique, Faztudo Languisse Eng.

Journal of Cybersecurity Education, Research and Practice

The digital transformation of public and private institutions across the Global South has produced a paradox: as states digitize government services, financial systems, and citizen records, an increasing share of this data is hosted on servers physically located in the United States, the European Union, and other developed economies. This article develops a taxonomy of the cybersecurity and sovereignty risks generated by this dependency, distinguishing deliberate risks, arising from extraterritorial legal instruments such as the United States CLOUD Act, foreign surveillance regimes, and a concentrated hyperscale cloud market, from non-deliberate risks, arising from undersea cable failures, hyperscaler outages, misconfiguration, and …

Specification And Internal Assessment Of A Self Reported Protective Application Use Composite Among Computer Science Undergraduates In Enugu State Nigeria, Adesegun Nurudeen Osijirin, Leonard C. Anigbo, Oliver Okechukwu

Journal of Cybersecurity Education, Research and Practice

This study specifies a Protective Application Use Composite restricted to self-reported protective application use. A cross-sectional survey provided 364 complete records from Computer Science undergraduates at four universities in Enugu State, Nigeria, from 393 distributed questionnaires. The score is the equal-weight average of five questionnaire categories: antivirus, firewall, encryption, multi-factor authentication, and virtual private network use. Reanalysis of the author-supplied item records yielded category means from 2.097 to 2.376 and internal-consistency coefficients from 0.958 to 0.971. The composite mean was 2.170, with a standard deviation of 0.469. The first component of the category-score correlation matrix explained 50.98 percent of variance. …

Markets For Unverified Capability: Why Organizations Facing Real Adversarial Scrutiny Reject The Metrics Academic Ai-Security Research Relies On, Babar Khan Akhunzada

Journal of Cybersecurity Education, Research and Practice

Governments, insurers, and defenders increasingly rely on published capability claims about AI cybersecurity agents to inform procurement, regulation, and risk assessment. Yet a striking pattern runs through the organizations with the most at stake: enterprises and technology companies deploying frontier AI agents against real production infrastructure consistently decline to publish the accuracy metrics that academic and vendor benchmarks compete to report. This paper investigates that pattern as an economic, organizational, and policy problem rather than a purely technical one. We audit eleven independently published AI cybersecurity benchmarks and deployments using a five-dimension integrity rubric and find that benchmarks relying on …

The Digital Responsibility Index: Quantifying Perceived Multi-Layered Responsibility In Cybersecurity, Mircea Ţălu

Journal of Cybersecurity Education, Research and Practice

In the evolving digital landscape, cybersecurity responsibility extends beyond technical safeguards to include individual behavior, organizational governance, and societal impact. This study introduces the Digital Responsibility Index (DRI), a novel metric that quantifies multi-layered accountability across four domains: technical, individual, organizational, and societal. Data were collected through scenario-based Likert-scale surveys with 120 cybersecurity professionals, supplemented by semi-structured interviews with senior leaders. Results reveal that while technical and organizational responsibilities are consistently prioritized, individual and societal accountability remain under-recognized. Leadership engagement significantly enhances responsibility scores across all layers. The proposed DRI framework provides a measurable and potentially actionable basis for assessing …

Ai-Generated Phishing Attacks: Emerging Threats And Detection Strategies For Security Operations Centers, Bahzad Khalid

Journal of Cybersecurity Education, Research and Practice

Artificial intelligence (AI) is transforming cybersecurity by strengthening defensive capabilities while simultaneously enabling more sophisticated phishing attacks. AI generated phishing emails increasingly evade traditional detection methods through improved grammar, contextual relevance and realistic communication styles creating significant challenges for Security Operations Centers (SOCs). This study investigates the effectiveness of current email security systems in detecting AI generated phishing emails compared with traditional phishing emails. A mixed method experimental approach was employed using controlled Gmail and Outlook environments to evaluate the detection and classification of multiple phishing scenarios. The results demonstrate that several AI generated phishing emails successfully bypassed initial security …

A Narrative-Driven, Socratic Instructional Framework For Teaching Adversarial Cognition In Cybersecurity, Joshua K. Goossen

Journal of Cybersecurity Education, Research and Practice

The Socratic method has demonstrated, in studies across law, medicine, and nursing, that dialectic structured questioning improves expert reasoning. Cybersecurity currently teaches tools and techniques but lacks Socratic dialogic leaving graduates underprepared for novel scenarios requiring cross-domain reasoning. Because law, medicine and nursing cultivate similar reasoning as security there is principled reason to expect reasoning benefits could transfer to security students. This paper argues that the correspondence warrants investigation. Investigation requires a named, teachable reasoning target analogous to clinical reasoning and we specify that target as adversarial cognition, a framework integrating adversary features, system architecture, implementation logic, governance structure, human …

Designing For Who Actually Shows Up: A Signal Framework For Online Adult Learners In Cybersecurity And Information Technology, Chad Whistle, Mayyada Al-Hammoshi

Journal of Cybersecurity Education, Research and Practice

Online adult learners pursuing cybersecurity and information technology credentials represent one of the fastest-growing student populations in American higher education, yet the frameworks institutions use to support their success were not designed for them. This population, disproportionately drawn from the 41.9 million Americans who hold some college credit but no credential, arrives workforce-embedded, time-constrained, and skeptical of institutional systems that previously failed to serve them. Existing persistence models grounded in traditional student integration theory inadequately account for the behavioral patterns, motivational structures, and credential expectations that define this learner. This paper proposes the SIGNAL Framework (Skills-based credential architecture, Integrated AI-informed …

Between Digital Transformation And Regulatory Vacuum: Cybersecurity Of Public Services In Mozambique, Faztudo Languisse Eng.

Journal of Cybersecurity Education, Research and Practice

The rapid expansion of digital public services in Mozambique—including e-government platforms, digital health systems, and electronic tax administration—has outpaced the development of a coherent legal framework for cybersecurity. While Law No. 3/2017 (Electronic Transactions Law) of 9 January 2017 introduced foundational data-protection principles, Mozambique long lacked a dedicated cybersecurity regulatory authority, mandatory security standards, and formal incident-notification mechanisms. This regulatory vacuum exposed critical public services to escalating cyber risks as digital transformation was actively promoted as a development priority. This article examines the legal and institutional gaps in Mozambique's cybersecurity governance framework prior to the 2026 Cybersecurity and Cybercrime Laws, …

Clinic-In-A-Box: A Portable, Software-Defined Cyber Range For Realistic, Scenario-Based Cybersecurity Training, Ethan Chumley, Aaron Nair, Royce Yaezenko, Joshua Payne, Veronika Kyles, Paul Wagner, Robert J. Honomichl, Ryan Straight, Shengjie Xu

Journal of Cybersecurity Education, Research and Practice

Realistic, hands-on cybersecurity training has traditionally depended on fixed infrastructure such as dedicated lab hardware, cloud subscriptions, or permanent network connectivity, limiting where and how often it can be delivered. This paper presents the design and implementation of a portable, scenario-based cybersecurity training platform housed in a single travel case and built from commodity hardware, type-1 hypervisor virtualization, containerized service orchestration, and software-defined networking. The platform clones, isolates, and resets complete lab environments on demand, allowing the same physical system to support repeated classroom, workshop, or field deployments with minimal manual reconfiguration. Training scenarios are grounded in generated organizational profiles …

Self Efficacy And Instructional Support Predict Cyber Deception Acceptance In Ics And Ot Cybersecurity, Daniel Ward

Journal of Cybersecurity Education, Research and Practice

Cyber deception can produce high-confidence evidence of unauthorized activity in industrial control systems (ICS) and operational technology (OT), but practitioners must consider the technology useful, safe, understandable, and supported before they will use it. This study reports a secondary quantitative analysis of a deidentified survey of United States-based ICS and OT professionals to determine whether psychological and instructional factors predict adoption readiness and effective utilization beyond education, experience, and sector. Hierarchical ordinary least squares regression with HC3 robust standard errors was conducted on 262 complete cases. The demographics-only model was not significant and explained 2.8 percent of outcome variance. Adding …

Opengrcrmf: A Vendor-Neutral Framework For Teaching And Modeling Rmf Automation, Continuous Authorization, And Zero Trust Governance, Anand Janjal

Journal of Cybersecurity Education, Research and Practice

Abstract—Federal and regulated organizations continue to rely on document-centric Authorization to Operate (ATO) processes even as the NIST Risk Management Framework (RMF), continuous monitoring guidance, Zero Trust Architecture (ZTA), and continuous authorization initiatives require more continuous, evidence-driven risk management [1]-[3], [13], [15]. Manual System Security Plan (SSP) updates, spreadsheet-based Plan of Action and Milestones (POA&M) tracking, and disconnected assessment evidence create governance latency: the delay between operational security events and authorization-ready governance response. This paper presents OpenGRCRMF, a proposed open, vendor-neutral reference framework that models RMF lifecycle activities as workflow states, treats authorization artifacts as structured governance objects, and …

A Return On Investment (Roi) Evaluation Tool For Quantifying The Value Of Cybersecurity Certifications, Nicolas Meysmans, Kelly Hughes

Journal of Cybersecurity Education, Research and Practice

The growing reliance on cybersecurity certifications has increased the financial and professional stakes associated with certification decision-making for cybersecurity professionals. Despite their widespread use in hiring and career advancement, there is limited objective guidance available to help individuals evaluate the return on investment (ROI) of specific certifications. This gap has created uncertainty regarding which credentials provide the greatest value relative to their cost and market impact. This study presents a data-driven, design science–based tool that supports cybersecurity professionals in evaluating certification ROI using practitioner survey data combined with certification cost and labor-market demand indicators. The paper also demonstrates how such …

From Disruption To Replacement: The 2026 Cae Cybersecurity Community Symposium And The Emerging Federal-Academic Compact For An Ai Workforce, Sunday Oludare Ogunlana

Journal of Cybersecurity Education, Research and Practice

The cybersecurity workforce gap in the United States is estimated at several hundred thousand unfilled positions, and the rapid integration of artificial intelligence into adversary tradecraft and federal cyber operations is widening that gap qualitatively as well as quantitatively, threatening national security and the operational readiness of graduates entering the field. This perspective article synthesizes the principal arguments advanced by five federal and academic speakers at the 2026 CAE Cybersecurity Community Symposium, using verbatim session transcripts, a structured thematic extraction process, and triangulation against published workforce policy and peer-reviewed literature. Findings document a unified speaker thesis that artificial intelligence now …

Closing The Awareness–Behavior Gap: A Role-Based Phishing Training Framework For Higher Education, Ranylene O. Olaybal, Ryan A. Olaybal

Journal of Cybersecurity Education, Research and Practice

Phishing remains one of the most persistent cybersecurity threats facing higher education institutions, where diverse user populations and highly connected digital environments increase exposure to social engineering attacks. Although cybersecurity awareness initiatives are widely implemented, high awareness does not always translate into secure behavior. This study examined phishing awareness, phishing-related practices, phishing susceptibility, and phishing experiences among college students, teaching faculty, and administrative staff in a private higher education institution in the Philippines. Using a quantitative cross-sectional design, data were collected from 553 respondents through a validated survey instrument and analyzed using descriptive statistics, one-way analysis of variance, Tukey's honestly …

Stop Blaming My Users: Illumination Of The Technocentric Mythos Bias, Ervin H. Frenzel, Richard Lightcap

Journal of Cybersecurity Education, Research and Practice

 Abstract -This conceptual essay addresses the need for systemic and systematic transdisciplinary analytical techniques within cybersecurity and technical security. This conceptual essay is contingent upon recognition that cybersecurity is not simply technical in nature, it does not need an adversary, and more importantly it is based upon systems engineering and systems thinking.  The essay contributes a socio-technical attribution chain and field-specific ontology/taxonomy which distinguish user-triggered events from root causes, latent conditions, technical debt, validation failures, governance failures, and attribution bias before assigning responsibility to end users. It systematically defines an ontology inclusive of developer technical debt, organizational debt arising from …

Contemporary Cybersecurity Challenges In Emerging Technologies: A Systematic Literature Analysis, Faztudo Languisse Prof

Journal of Cybersecurity Education, Research and Practice

The accelerating convergence of artificial intelligence (AI), the Internet of Things (IoT), cloud computing, blockchain, and quantum computing has fundamentally transformed the global threat landscape, introducing cybersecurity challenges of unprecedented complexity and scale. This systematic literature review synthesizes findings from peer-reviewed publications, institutional reports, and regulatory documents published primarily between 2020 and 2025 to provide an integrated analysis of contemporary cybersecurity challenges across five key emerging technology domains. The review identifies critical vulnerabilities inherent to each domain, documents the evolution of threat actors and attack methodologies — including AI-powered ransomware, adversarial machine learning, and harvest-now-decrypt-later quantum attacks — and evaluates …

Cybersecurity Governance Of Industrial Iot In Sub-Saharan Africa: Policy Gaps, Threat Landscape, And Lessons From Comparative African Contexts, Faztudo Languisse Eng.

Journal of Cybersecurity Education, Research and Practice

The rapid deployment of Industrial Internet of Things (IIoT) systems across Sub-Saharan Africa's extractive, energy, logistics, and agro-industrial sectors has introduced a cybersecurity challenge of growing urgency: industrial networks that were designed for operational efficiency are increasingly exposed to cyber threats for which neither the organizations nor the regulatory frameworks are adequately prepared. This article examines the cybersecurity governance of IIoT systems in a developing African economy, using Mozambique as a primary case study and drawing comparative lessons from South Africa, Rwanda, and Kenya. Through an integrative literature review and documentary analysis of national digital, cybersecurity, and industrial policies, the …

Building The Next Cybersecurity Workforce: A Grades 7–12 Curriculum To Close The Cyber Talent Gap, Mohammed A. Salam, Iqbal Shareef, Rich P. Manprisio

Journal of Cybersecurity Education, Research and Practice

In today’s rapidly evolving technological landscape, cyberattacks pose increasing threats, yet a global shortage of cybersecurity and digital forensics professionals leaves industries vulnerable, similar to having too few law enforcement officers in a densely populated city. The judicial system faces rising digital crimes and fraud cases, further strained by the lack of experts to analyze and extract digital evidence. Despite high demand, millions of positions remain unfilled. This paper identifies the root causes of the cybersecurity workforce shortage and proposes a targeted solution: a curriculum for Grades 7–12 designed to foster cybersecurity awareness and interest. The methodology included a comprehensive …

Security Architecture Decision Framework For Endpoint Protection In Resource-Constrained K-12 Environments, Jason Folker

Journal of Cybersecurity Education, Research and Practice

K-12 educational institutions face an ongoing challenge in protecting endpoints when budgets and staffing prevent the implementation of standard security best practices. Technology directors routinely make difficult decisions about administrative rights, software controls, and security tooling, but they lack frameworks designed for the constraints and priorities specific to educational environments. This paper develops a security architecture decision framework tailored for K-12 endpoint protection. The framework integrates five weighting dimensions to help technology directors evaluate competing architectural choices. These dimensions include educational impact, security risk reduction, resource requirements, compliance obligations, and operational feasibility. The framework creates structured documentation that helps decision-makers …

Operationalizing Supply-Chain Hygiene In Graduate Is Education: A Hands-On Module For Secure Software And Ai/Ml Pipelines, Dominic A. Wilson

Journal of Cybersecurity Education, Research and Practice

Supply-chain attacks (including typosquatting, dependency confusion, compromised builds, dataset poisoning, and backdoored models) pose growing threats to analytics platforms central to Information Systems (IS). While frameworks like the Secure Software Development Framework (SSDF) and Supply-chain Levels for Software Artifacts (SLSA) offer guidance, IS curricula often lack accessible, infrastructure-light modules that build practical skills for mitigating these risks. This experience report presents a two-week module embedded in a graduate Secure Coding course required for a Master’s in Applied Security and Analytics degree. The module operationalizes secure development habits across both traditional software and machine learning (ML) pipelines. The module addresses a …

The Nist Artificial Intelligence Risk Management Framework: Adoption Challenges And Opportunities, Gillian Kennedy, Devin Patel, Humza Sheikh, Paul Wagner, Robert J. Honomichl

Journal of Cybersecurity Education, Research and Practice

Artificial intelligence (AI) is being adopted at an exponential rate to improve efficiency, decision-making, and cybersecurity, but its rapid integration introduces new and often poorly understood risks, including system errors, algorithmic bias, data privacy concerns, security vulnerabilities, and ethical dilemmas. This paper examines how organizations are implementing AI and evaluates the National Institute of Standards and Technology's AI Risk Management Framework (NIST AI RMF) as a tool for managing these risks. It reviews the benefits of AI adoption alongside the risks emerging from its use in business and broader society and examines the legal and ethical challenges organizations face when …

To What Extent Could Quantum Computing Pose A Threat To Global Modern Data Security?, Aniket Maheshwari

Journal of Cybersecurity Education, Research and Practice

Quantum computing has emerged as a transformative technology with the potential to fundamentally disrupt modern cryptographic systems that underpin global data security. This paper examines the extent to which quantum computing could pose a threat to modern global data security by synthesising existing technical, institutional, and policy-oriented literature. Drawing on a narrative review of scholarly research, industry reports, and government frameworks, the analysis focuses on the implications of quantum algorithms such as Shor’s and Grover’s, which challenge the mathematical foundations of widely used cryptographic schemes. The findings suggest that while quantum computing presents a credible long-term threat to asymmetric encryption …

Predicting Cybermindfulness With The Cyber-Health Belief Model, James Robinson, Yan Tian, Thomas Skill

Journal of Cybersecurity Education, Research and Practice

This study describes the development of a Cyber-Health Belief Model (CHBM). The health belief model (HBM) is a message strategy that is widely and successfully used in public health research [1] and has been extended into phish training. Most phish training programs assume  end users are victimized because they have insufficient information to defend themselves. While near-term training effectiveness has shown to be effective, evidence for sustained behavioral change is thin [4]-[7].  This problem indicates that the traditional approaches need to be reconsidered and that new models are needed.  Recent research suggests attentional deficits, cyber-fatigue and fatalism and a sense …

Next-Generation Dns Rpz For Automated Threat Intelligence, Risk-Aware Filtering, And User-Centric Security, Jinu S, Kishore V. Krishnan, Rajarshi Middya, Annasamy Bagubali

Journal of Cybersecurity Education, Research and Practice

The Domain Name System (DNS) remains a critical attack vector exploited by adversaries for command-and-control (C2) communication, data exfiltration, and phishing campaigns. DNS Response Policy Zones (RPZ) have emerged as an effective defense mechanism by enabling the redirection or blocking of queries to malicious domains. However, current RPZ implementations encounter significant challenges related to scalability, adaptability, and user awareness, often resulting in static policies, delayed updates, and a high incidence of false positives. To address these limitations, this paper proposes an enhanced RPZ framework that integrates adaptive threat intelligence, machine learning-driven dynamic policy updates, and user-context-aware security controls. The proposed …

Cyber-Ready Libraries, Building Digital Fortresses For Tomorrow, Adeyinka B. Tella, Oluchi Precious Ogbonna Dr, Adebola Aderemi Olatoye Mrs

Journal of Cybersecurity Education, Research and Practice

Background and Purpose: Libraries are evolving into highly networked information ecosystems in this age of fast digital transformation, which increases their susceptibility to cybersecurity risks. The study "Cyber-Ready Libraries: Building Digital Fortresses for Tomorrow" looks into how prepared libraries are to face cyber threats and considers methods for creating information systems that are safe, robust, and ready for the future. To safeguard digital assets and user data, the study aims to assess existing cybersecurity practices in library settings and offer a roadmap for combining technological, human, and governance solutions.

Design/Method: The existing literature, case studies, and policy frameworks pertaining …

The Intersection Between Mindfulness And Cybersecurity: A Tool To Reduce Burnout And Improve Operational Effectiveness, Ivo Ricardo Dias Rosa

Journal of Cybersecurity Education, Research and Practice

Abstract: This paper offers a conceptual discussion of how mindfulness, understood as present moment awareness and deliberate attention regulation, can support cybersecurity professionals. Drawing on a narrative synthesis of workplace mindfulness, burnout, and high pressure decision making literature, we map plausible self regulation mechanisms to typical cyber defense tasks. Rather than presenting new empirical data, we develop an explanatory framework linking attention, reactivity, and recovery to decision quality, team communication, and adherence to incident playbooks. We focus on two connected outcomes: reducing burnout in roles with sustained cognitive and emotional demands, and improving operational effectiveness during critical situations such as …

A Govsecops-Oriented Governance, Risk, And Compliance Platform For Continuous Authorization In Dod Il4/Il5 Environments, Anand Janjal

Journal of Cybersecurity Education, Research and Practice

Department of Defense (DoD) Impact Level 4 and Impact Level 5 (IL4/IL5) systems require continuous assurance of cybersecurity posture under stringent operational and regulatory constraints. While the NIST Risk Management Framework (RMF) and DoD DevSecOps guidance emphasize continuous authorization supported by real-time evidence, many existing Governance, Risk, and Compliance (GRC) platforms remain documentation-centric and insufficiently integrated with operational telemetry. This paper presents a GovSecOps-oriented GRC architecture that integrates vulnerability ingestion, automated Plan of Action and Milestones (POA&M) lifecycle management, dynamic risk scoring, and continuous authorization dashboards within IL4/IL5 environments. Using a Design Science Research methodology, the study develops and evaluates …

Application Identification With Pfsense, Snort, And Openappid In Academic Lab Networks, Minh-Khanh Vu

Journal of Cybersecurity Education, Research and Practice

This paper evaluates the practical capabilities and limitations of a widely used open-source network security stack—pfSense firewall, Snort Intrusion Detection System (IDS), and OpenAppID detectors—in academic cy- bersecurity laboratories and small-to-medium enterprise (SME)-like environments. In a controlled virtual testbed, we measure application-level and feature-level identifi- cation performance for major applications (Facebook, YouTube, Zoom) using the pfSense/Snort/OpenAppID configuration. The stack achieves 97% application-level identification accuracy for these applications in our lab dataset, drawing on a library of 3,374 OpenAppID detectors. However, our experiments reveal a substan- tial feature-level detection gap: specific functions such as Zoom file transfers and Facebook messaging can- …

Adopting Artificial Intelligence: Cross-Sector Analysis Of Ai Adoption Risks, Brandon Saari, Yona Berger, Yanett Munoz, Alex Agnick, Paul Wagner, Robert J. Honomichl

Journal of Cybersecurity Education, Research and Practice

Artificial intelligence (AI) is rapidly being adopted across public and private sectors. This offers significant gains in efficiency, decision making, and access to information. At the same time, AI introduces complex risks related to cybersecurity, privacy, bias, transparency, accountability, and equity that existing governance and security frameworks do not fully address. This paper presents a cross-sector literature review and comparative analysis of AI adoption risks and mitigation strategies across four critical domains: the federal government, libraries, K–12 education, and healthcare. Drawing on peer-reviewed research, institutional frameworks, and policy guidance, the study identifies sector-specific challenges alongside shared systemic gaps, including insufficient …

Innovations And Applications Of Virtual Private Networks And Sustainable Security In Society 5.0 Libraries, Stella Chinnaya Nduka Dr., Adeyinka Tella Prof, Petros Dlamini Dr

Journal of Cybersecurity Education, Research and Practice

In order to improve digital resilience, privacy, and access equity in contemporary library environments, this study investigates the role of Virtual Private Networks (VPNs) in fostering sustainable cybersecurity within the framework of Society 5.0 libraries. It does this by looking at the latest developments, applications, difficulties, moral dilemmas, and tactical methods associated with VPN deployment. Using peer-reviewed journal articles, conference proceedings, white papers, and policy documents published between 2010 and 2024, a methodical approach to literature review was used. The literature that bridges the fields of cybersecurity, library science, and Society 5.0 concepts was the main focus of the review. …