نوع مقاله : علمی پژوهشی
نویسندگان
1 دانشجوی کارشناسی ارشد رشته مدیریت کسب و کار- سیستم‌های اطلاعاتی و فناوری اطلاعات، واحد کرمانشاه، دانشگاه آزاد اسلامی، کرمانشاه، ایران.
2 دانشیار گروه علم اطلاعات و دانش‌شناسی، واحد کرمانشاه، دانشگاه آزاد اسلامی، کرمانشاه، ایران
کلیدواژه‌ها
عنوان مقاله English
نویسندگان English
Abstract
Background and Objectives: Cybersecurity awareness is essential for organizational resilience because employees’ knowledge, attitudes, and routine actions can either strengthen or weaken the protection of information assets. This issue is particularly important in banks, where financial data and digital services make the consequences of security incidents especially serious. Previous research suggests that organizational culture, formal information security policies, and organizational support and training may shape employees’ security-related behavior. These factors may also influence cybersecurity awareness indirectly by improving employees’ attitudes toward sharing information security knowledge. However, the combined effects of these organizational factors and the mediating role of knowledge-sharing attitudes have received limited attention in Iranian banking. Therefore, this study examined the effects of organizational culture, organizational policy, and organizational support and training on employees’ cybersecurity awareness, with attitude toward information security knowledge sharing as the mediating variable.
Methodology: This applied study used a descriptive-survey design. The statistical population consisted of 270 employees working in branches of Agricultural Bank in Kermanshah, Iran. The study described the sampling procedure as simple random sampling, and the sample size was estimated at 147 using Cochran’s formula. Questionnaires were distributed and collected in person at employees’ workplaces; 126 usable questionnaires were included in the final analysis. The instrument comprised 22 items measuring five constructs: organizational culture (six items), organizational policy (three items), organizational support and training (four items), attitude toward information security knowledge sharing (four items), and cybersecurity awareness (five researcher-developed items). Items for the first four constructs were adapted from Chen et al. (2015), Safa and Von Solms (2016), and Ma (2022). Face validity was assessed by four experts. Content validity was then examined by eight experts using the content validity ratio and content validity index; the final 22 items met the stated acceptance thresholds. Descriptive statistics were used to summarize the data, and partial least squares structural equation modeling was performed in SmartPLS to evaluate the measurement and structural models. The reported factor loadings, Cronbach’s alpha coefficients, composite reliability values, average variance extracted values, and discriminant-validity results supported the adequacy of the measurement model.
Findings: Organizational culture did not have a significant effect on attitude toward information security knowledge sharing (β = 0.057, t = 0.625, p = 0.532). In contrast, organizational policy had a positive and significant effect on knowledge-sharing attitude (β = 0.367, t = 4.064, p < 0.001), as did organizational support and training (β = 0.481, t = 6.392, p < 0.001). Attitude toward information security knowledge sharing also had a positive and significant effect on cybersecurity awareness (β = 0.496, t = 6.020, p < 0.001). The indirect effect of organizational policy on cybersecurity awareness through knowledge-sharing attitude was significant (β = 0.182, t = 3.444, p = 0.001), and the corresponding indirect effect of organizational support and training was also significant (β = 0.238, t = 4.436, p < 0.001). The indirect effect of organizational culture was not significant (β = 0.028, t = 0.595, p = 0.552). The structural model explained 67.2% of the variance in attitude toward information security knowledge sharing and 24.6% of the variance in cybersecurity awareness. Predictive-relevance values were 0.430 and 0.173, respectively. The reported model-fit indices (SRMR = 0.062 for the saturated model and 0.063 for the estimated model; NFI = 0.815) indicated an acceptable fit, while the reported overall goodness-of-fit value was 0.612.
Discussion: The findings indicate that formal information security policies and tangible organizational support and training are more influential than general organizational culture in shaping employees’ willingness to share security-related knowledge. In turn, a favorable knowledge-sharing attitude is associated with greater cybersecurity awareness and transmits part of the effects of policy, support, and training to awareness. The nonsignificant cultural path suggests that broad organizational values alone may be insufficient unless they are translated into clear rules, accessible guidance, practical training, and visible managerial support. Banks should therefore develop and clearly communicate information security policies, provide continuous skills-based cybersecurity training, establish accessible advisory channels for reporting and resolving security problems, and encourage employees to exchange experiences about threats and protective practices. Because the data were collected from employees of one bank in one city and at a single point in time, the findings should be generalized cautiously. Future studies could test the model in other organizational settings and use longitudinal designs to examine whether improvements in policy implementation, training, and knowledge sharing produce changes in cybersecurity awareness.
کلیدواژه‌ها English
