Measuring and evaluating information security awareness with Bloom’s Taxonomy

Research findings among employees of economic organizations

Abstract

Raising awareness of information security can help economic organizations keep their information more secure and prevent employees from exposing information to attackers without intention. But how can we measure how aware the organization's employees are?What areas do they still need to train? The measurement and development can be facilitated by Bloom's taxonomy. It is widely used in the field of education and describes learners' progress through a pyramid of interdependent levels. Information security experts have previously suggested the use of the Bloom taxonomy in the field, but so far there has been no publication on measurement results. The research surveyed 220 employees from economic organizations in questionnaire form, measuring their knowledge on cognitive levels, as well as on the affective domain, which has been given less weight in information security research so far. Affective levels can help determine the users' emotions and how well information security is integrated into their value system. Do they recognize the problems but are unwilling to deal with them? Or are they interested in the topic but lack sufficient knowledge about it? The study presents in detail the results of the cognitive and affective levels achieved by the respondents, such as how familiar they are with types of electronic information security, whether they can recognize a fake tax authority website, or how often they read about current security issues and discuss them with their contacts. Furthermore, the results reveal whether information security knowledge is correlated with age or IT work. With the help of these results, professionals working on information security awareness can get guidance on how to design their training programs, what kind of knowledge assessment tools to use, and which areas require training for users based on the current survey.