TELKOM
NIKA
, Vol.12, No
.2, June 20
14
, pp. 493~5
0
0
ISSN: 1693-6
930,
accredited
A
by DIKTI, De
cree No: 58/DIK
T
I/Kep/2013
DOI
:
10.12928/TELKOMNIKA.v12i2.2015
493
Re
cei
v
ed Fe
brua
ry 2, 201
4; Revi
se
d
May 6, 201
4; Accepted Ma
y
26, 2014
Measuring Information Security Awareness of
Indonesian Smartphone
Users
Puspita Ken
cana Sari*, Candi
w
a
n
F
a
cult
y
of Economic & Busi
n
e
ss,
T
e
lkom Universit
y
Jl.
T
e
lekomu
ni
kasi 1 Ban
d
u
n
g
, Indon
esia
*Corres
p
o
ndi
n
g
author, e-ma
i
l
: puspitak
enc
a
na@te
lkom
universit
y
.ac.id, candi
w
an
@telk
o
muniversit
y
.
ac.id
A
b
st
r
a
ct
One of th
e inf
o
rmatio
n
sec
u
rity mana
ge
ment
el
e
m
e
n
ts i
s
an
infor
m
ati
on sec
u
rity a
w
arenes
s
progr
a
m
me. Usual
ly, this progr
a
m
me o
n
ly inv
o
lves
t
he e
m
p
l
oy
ees
w
i
thin an or
gan
isatio
n. So
me
orga
nisati
ons
also co
nsid
er
security aw
are
ness for
so
me
parties o
u
tsid
e the org
anis
a
tion lik
e prov
id
ers,
vend
ors, and
contractors. T
h
is pa
per
add
consu
m
ers a
s
variab
les to
be co
nsid
ere
d
in an
infor
m
a
t
io
n
security aw
are
ness pro
g
ra
mme
as there
are als
o
so
me threats for the orga
nis
a
ti
on throu
gh th
em.
Information s
e
curity aw
aren
e
ss w
ill be
me
a
s
ured fro
m
a
u
s
er
’
s
know
le
dg
e, beh
avio
ur, a
nd attitud
e
of fi
ve
infor
m
ati
on se
curity focus ar
eas i
n
telec
o
mmu
n
ic
at
ions, e
s
peci
a
lly r
e
late
d to smartph
o
ne us
ers as o
n
e
seg
m
e
n
t of tel
e
co
mmu
n
icati
o
n prov
id
ers. F
o
r smartp
ho
ne
users, infor
m
ation s
e
curity thr
eats are
not
o
n
l
y
from
the Internet, but also from
phone
ca
lls
or texting. T
her
efore, the focu
s area i
n
this r
e
searc
h
cons
is
ts of
adh
erin
g to security policy, pr
otecting p
e
rso
nal d
a
ta
, fraud/spa
m
SMS, mobil
e
ap
plic
atio
ns, and rep
o
rti
ng
a
security i
n
ci
de
nt. T
h
is res
e
a
r
ch us
es a
n
ana
lytic h
i
erar
chy pr
ocess (
A
HP)
meth
od
to
me
asure
th
e
infor
m
ati
on s
e
curity aw
are
n
e
ss lev
e
l fr
o
m
s
m
artpho
ne
users. In t
o
tal, the
resu
lt
indic
a
ted
that
the
aw
areness
lev
e
l is g
ood (
8
0
%
). Althou
gh
know
led
ge
a
n
d
attitude
di
mensi
on ar
e go
od criteri
a
of the
aw
areness
lev
e
l, the b
e
h
a
vi
our d
i
mens
io
n
is aver
ag
e. It can be
a re
ason w
h
y th
er
e are sti
ll
ma
ny
infor
m
ati
on sec
u
rity breac
hes
aga
inst smartp
hon
e users d
e
s
pite a go
od a
w
areness lev
e
l
.
Ke
y
w
ords
: inf
o
rmation security
, aw
areness, meas
ure
m
ent, smartph
o
n
e
, u
s
ers
1. Introduc
tion
There are t
h
ree fun
dam
ental thing
s
that shoul
d be co
nsid
ered
whe
n
applying
informatio
n secu
rity mana
gement in an
organi
zati
o
n
: (1) co
nfident
iality of sensi
t
ive information
by protecting it from unauthori
s
ed
di
scl
osure or intelligible
in
t
e
rception,
(2) integrity, by
safeg
uarding
the a
c
curacy and
com
p
l
e
tene
ss of in
formation,
(3
) availability, by en
suri
ng t
hat
informatio
n and vital servi
c
e
s
are avail
able to
autho
rise
d users when
re
quired
[1]. These m
a
y
lead to
an
a
c
hievement
of
informatio
n
secu
rity in
tenti
on, which i
s
t
o
en
su
re
bu
si
ness
co
ntinui
ty
and to minimi
se bu
sine
ss damag
e by preventing a
n
d
minimising t
he impa
ct of
se
curity inci
d
ents
[2].
Any potential
thre
ats i
n
a
n
organi
sation
are
subj
e
c
t
s
that influe
nce information
se
cu
rity
manag
eme
n
t. Tho
s
e th
reat
s
can
be d
e
te
cted by i
denti
f
ying circum
stance
s
o
r
a
c
ti
vities that ma
y
cau
s
e lo
ss o
r
harm for the orga
nisation, su
ch a
s
fi
nan
cial loss, ab
sence of data or re
sou
r
ce
s, or
even lo
ss of
co
mpany
credibility [1]. Many p
r
od
ucts have
be
en
develo
ped
to gu
ara
n
tee
the
se
curity of inf
o
rmatio
n. Becau
s
e
of the
open
ne
ss
of the network,
the vu
lnerabil
i
ty of operati
ng
system
s, the
se
curity ri
sks in ha
rd
ware
and
softwa
r
e,
and n
e
two
r
k viruses
and
netwo
rk attacks
is con
s
tantly varieda
nd ea
ch day t
hese threats a
r
e g
e
tting more di
fficu
lt to eliminate; so there is
no
cha
n
ce t
o
buil
d
a
n
a
b
sol
u
te
se
cu
rity network
system
[3]. The m
o
st
im
portant
thing
in
informatio
n secu
rity mana
gement i
s
a
w
aren
es
s p
r
og
ramme
s the
m
selve
s
. The
prog
ram
m
es are
to ensu
r
e tha
t
all employees ob
ey the informat
io
n se
curity poli
c
ie
s and pro
c
e
d
u
r
es e
s
tabli
s
h
ed
by the organi
sation. Kru
g
e
r
and Kea
r
ne
y said that “
The initial ai
m
or objective of inform
ation
s
e
c
u
r
i
t
y
aw
arenes
s
w
a
s
to ens
ur
e that
c
o
mputer
user
s
ar
e
aware of the r
i
sks ass
o
c
i
ated
w
i
th
usin
g inform
ation technol
ogy
as
well
as un
de
rst
andin
g
and
abidin
g
by t
he poli
c
ie
s
and
pro
c
ed
ures th
at are in pla
c
e
”
[4].
Rep
o
rted
by
Symantec, th
e tele
comm
u
n
icatio
n
sect
or i
s
in
seco
nd ran
k
(10
%
) after
retail (27%) t
hat ha
s a
risk in d
a
ta b
r
e
a
ch
es th
at co
uld lea
d
to id
entity theft (top 10
se
cto
r
s by
numbe
r
of id
entities
expo
sed
)
[5] i
n
which
Indo
ne
si
a is in
eig
h
th ran
k
of
co
untrie
s
with t
he
highe
st cost
per
capita
of a data b
r
ea
ch. The
Indo
n
e
sia
Com
put
er Eme
r
ge
ncy Respon
se
Team
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 16
93-6
930
TELKOM
NIKA
Vol. 12, No. 2, June 20
14: 493 – 50
0
494
(ID-CERT)
surveyed,
with
som
e
of th
e re
sp
ond
ent
s from tele
communi
catio
n
provide
r
s,
that
53.1% of in
ci
dents
re
porte
d from M
a
rch
to April
2
013
we
re a
bout
netwo
rk
in
cid
ents; 15.4%
are
intellectu
a
l property rig
h
ts;
12.1% are m
a
lwa
r
e
in
cide
nts; and 1
1
.4
% are spam [
6
]. In 2012, the
numbe
r
of ne
twork i
n
ci
den
ts ha
s re
ache
d 76.5
3
%.
Th
erefo
r
e, all
p
r
eventative a
c
tions to
redu
ce
these in
cid
e
n
t
s sho
u
ld be
improve
d
an
d stren
g
t
hen
ed by interne
t
service p
r
o
v
iders, in
clud
ing
the telec
o
mmunication indus
t
ry [7].
The Indones
ia Internet Prof
ile in
Dec
e
mber 2012,
rele
as
ed by
APJ
II, informed that
65.7% of internet u
s
ers in
Indone
sia util
ize sm
artp
ho
nes a
s
thei
r
device
s
. Sma
r
tphon
e u
s
ers in
Indone
sia a
r
e
predi
cted to
rea
c
h 7
1
.6 mi
llion peo
ple i
n
2015, ju
mpi
ng from 2
3
.8
million in 20
1
2
.
This
phen
om
enon i
s
p
o
ssibly be
ca
use of t
he
ch
eape
ning
pri
c
e of g
adg
e
t
s and
se
rvi
c
e
s
provide
d
by telecommu
nication provide
r
s. But
on the
other
hand, t
he u
s
e of m
o
bile technol
o
g
y
also in
crea
se
s the threats
of informatio
n se
cu
rity
. Furthe
rmo
r
e,
with faste
r
de
velopment of
the
internet an
d clou
d com
p
u
t
ing, the security
issu
e h
a
s be
com
e
an overwhel
ming proble
m
for
clou
d servi
c
e
providers.
In
order to m
a
ke the
use of
the
clou
d benefits
to the full extent, these
issue
s
need t
o
be addressed first
[8]. In
2010, Yayasan Layana
n Konsu
m
en In
done
sia (YLK
I)
recorded that
17.1% of 590 con
s
um
ers’
complai
n
ts
are ab
out the telecom
m
u
n
icatio
n se
rvice,
whe
r
e it is infirst ra
nk in
that period.
About
46.7% of those compl
a
ints a
r
e abo
ut ste
a
lin
g
cu
stome
r
s’
b
a
lan
c
e. In the end, this
wi
ll not only
break th
e tru
s
t of the cu
sto
m
ers, but al
so the
credibility of
telecommunications,
which is one of the
concer
ns in i
n
formation
security
manag
eme
n
t.
Users often h
a
ve inade
qua
te awarene
ss of how
to utilise their g
adg
et securely, or they
do have
suffi
cient
kno
w
le
d
ge but d
o
not
impleme
n
t it
prop
erly [9]. Mobile u
s
e
r
s
often save th
eir
person
a
l a
nd
financi
a
l info
rmation in
thei
r ph
one. It m
a
ke
s th
em ex
celle
nt mal
w
a
r
e a
nd
phi
shi
ng
targets. In November 2010, a
virus was spread out to a million
mobile phones in Chi
na.
The
virus wa
s sol
d
to
mobil
e
u
s
ers as an
a
n
t
i-virus
appli
c
ation, but in f
a
ct turned th
e mobile
pho
nes
into zombi
e
s and bega
n sen
d
ing spa
m
SMS to p
eople in the
phon
e boo
k [10]. Based o
n
a
Symantec se
curity rep
o
rt,
the
topthree
mobile thre
ats in 2012
are 32% ste
a
ling inform
a
t
ion,
25% tradition
al threat
s, an
d 13% se
ndi
ng co
nten
t. Stealing info
rm
ation incl
ude
s steali
ng d
e
v
ice
data, ba
nki
n
g troj
an,
Ddo
s
Utility, Ha
cktool; tr
aditio
nal th
reat
s in
clud
e d
o
wnlo
ader,
ba
ckdo
or;
and sendi
ng
conte
n
t inclu
desse
nding
p
r
emium SMS
and spam [5]. In this smart
phon
e era, th
ere
are ne
w thre
ats develo
p
in
g su
ch a
s
vishin
g attacks and smi
s
hin
g
attacks. Vishin
g attack is
phishing
by v
e
rbal
me
ssag
e, whil
e
smishing
atta
ck e
x
ploits SMS
messag
es;
compromised t
e
xt
messag
es ca
n co
ntain e
m
ail and
we
bsit
e add
re
sse
s
that ca
n lea
d
t
he inn
o
cent u
s
er to mal
w
a
r
e
s
i
te [10].
As describe
d
by many experts, the obje
c
ts of
information
security awarene
ss
prog
ram
m
e
s
are
fo
cu
sin
g
on
em
ployee
s within
the
o
r
gani
satio
n
. Other se
cu
rit
y
stand
ard
s
, su
ch
as BMIS from
ISACA, defin
e the p
eopl
e
element
of
inf
o
rmatio
n
se
curity man
age
ment con
s
isti
ng
of employee
s, contracto
r
s,
vendo
rs, a
n
d
se
rvice pro
v
iders [1]. Me
anwhile, they
also
define
that
prima
r
y peop
le within BMIS are those who a
r
e em
ployed or ot
herwise asso
ciated
with the
orga
nisation
[11]. Moreov
er, ISO2700
1
stated that peopl
e wh
o work u
nde
r a
n
org
anisatio
n
’s
rule
s sh
ould
be awa
r
e of informatio
n se
curity;
and all
employee
s of the organi
sation as well as
contracto
r
s should receive
appro
p
iate a
w
arene
ss
ed
ucatio
n and training an
d re
gular u
pdate
s
in
orga
nisationa
l policie
s and
pro
c
ed
ures
conne
cted to their job fun
c
ti
on [12].
In this pa
pe
r, con
s
um
ers
are i
n
volved
as the
peo
pl
e eleme
n
t in
informatio
n
se
curity
manag
eme
n
t. Con
s
u
m
ers
of som
e
orga
nisatio
n
s
also
have a
c
cess to com
m
uni
cation net
works
whi
c
h mea
n
s they can obtain som
e
org
anisational inf
o
rmatio
n. As Peltier said, “S
ys
tem ow
ner
s
have the
respon
sibility to
sha
r
e
app
ro
p
r
iate
kno
w
le
d
ge a
bout th
e
exi
s
ten
c
e
an
d ge
neral e
x
t
ent
of co
ntrol
m
easu
r
e
s
so
tha
t
other u
s
ers
can
be
confid
ent that th
e
system
i
s
a
d
e
quatel
y
se
cure
”
[13]. Furthe
rmore, a
s
stated in BS ISO 270
01, det
ection, p
r
eve
n
tion an
d re
covery co
ntrol
s
to
prote
c
t ag
ain
s
t mal
w
a
r
e
should
be
impl
emented
an
d
com
b
ine
d
wi
th app
ropi
ate
user
awaren
ess
[12]. Aroun
d
40% of
so
cial
network u
s
e
r
s a
r
e
a
ttacke
d
by m
a
lwa
r
e
;
and i
n
De
ce
mber 20
10, o
n
e
of the first an
droid
botn
e
ts (called
Gemi
ni)
wa
s di
sco
v
ered
and th
e co
de
wa
s
wra
ppe
d in
si
de a
legitimate an
droid a
ppli
c
at
ion who
s
e d
e
v
elopers di
d
not reali
s
e was spre
adin
g
malwa
r
e.Agai
n in
March 20
11,
Googl
e disco
v
ered a b
o
tn
et called
“dro
iddre
a
m” [10]
. “
It is essent
ial to keep th
e
publi
c
aware
of the se
curit
y
th
re
ats an
d
educate the
m
towards
using goo
d pra
c
tice
s in o
r
de
r to
get greate
r
se
curit
y
”
(Al-Shehri
)
[9].
Finally, this writ
ing i
s
propo
sing a
measurement
of
informatio
n secu
rity awa
r
ene
ss from
con
s
um
ers
o
f
telecommu
nicatio
n
prov
iders, espe
ci
ally
sma
r
tpho
ne
use
r
s. By
kn
owin
g the l
e
vel of
aware
ness from
consum
e
r
s, o
r
gani
sation
s
can
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
930
Measuring Information Securi
ty
Awarenes
s
of Indonesian
.... (Pus
pita Kenc
ana S
a
ri)
495
establi
s
h
ap
prop
riate
se
curity polici
e
s and p
r
o
c
e
d
ure
s
to p
r
ov
ide bette
r protection fo
r i
t
s
con
s
um
ers.
2. Proposed
Metho
d
This
re
se
arch
is
co
ndu
cted
by u
s
ing
the
Krug
er &
Ke
rney M
odel
[4]. It adapts
a soci
al
psycholo
g
y theory a
s
a t
ool that pro
p
o
se
s th
ree compon
ents t
o
mea
s
ure a
favourabl
e or
unfavourable
manne
r to a
particular o
b
j
ect; these
are cog
n
ition, a
ffect, and be
haviour [2]. T
h
e
comp
one
nts
were u
s
ed t
o
develop th
ree e
quivale
nt dimen
s
ion
s
known a
s
kno
w
le
dge
(what
doe
s a
pe
rso
n
kno
w
), attit
ude
(ho
w
do
they feel
a
b
o
u
t the topi
c),
and
beh
aviou
r
(wh
a
t do
th
e
y
do) [1]. Each
of these
di
mensi
o
n
s
wa
s then
su
bdi
vided into five focu
s a
r
ea
s: (a
) ad
heri
ng to
se
curity p
o
lici
e
s, (b)
prote
c
ting pe
rsonal
data, (c
) f
r
au
d/spam
SMS, (d) mobil
e
a
pplication
s
, a
n
d
(e) re
po
rting
se
curity in
cid
ents. Belo
w i
s
th
e
propo
sed meth
od
a
dopted
from
Kruge
r & Ke
rney’s
model.
Figure 1. Information Se
cu
rity Awaren
ess Mea
s
u
r
eme
n
t Frame
w
o
r
k
Five focus areas were
extracted
from
th
eorie
s,
fa
cts and phe
nom
ona abo
ut
inf
o
rmatio
n
se
curity in Indone
sia relat
ed to the telecomm
uni
cati
on se
ctor. Be
side
s that, areas
were defi
ned
by an informa
t
ion se
cu
rity expert in tele
comm
uni
cati
on provisio
n (ISO 2700
0 a
uditor). The
r
e
are
two p
r
oble
m
s me
ntioned
by the exp
e
rt: (a
) ad
he
ring to
se
cu
rity policie
s, and
(b)
re
po
rting
se
curity in
cid
ents.Th
e first
point of a
w
aren
ess i
n
ISO 270
01:20
13 state
s
th
a
t
“
perso
ns d
o
ing
work u
nde
r the organi
zati
on
’
s
control shall
be a
w
a
r
e
of inform
ation se
cu
rity pol
icy”
[12]. That is
the re
ason
why se
cu
rity policy a
s
a fu
ndame
n
tal a
s
pe
ct in info
rmation
se
curi
ty managem
ent
sho
u
ld be di
scu
s
sed a
s
on
e of the focus area
s.
The next focu
s area is
prot
ecting p
e
rso
n
a
l data.
No
wd
ays, as
writte
n in the introd
uction,
peopl
e save
a lot of information in the
i
r sma
r
tpho
n
e
, includin
g
p
e
rsonal a
nd
confid
ential d
a
ta
.
They u
s
e
sm
artpho
ne
s no
t only for texting an
d ma
kin
g
pho
ne
call
s, but also fo
r
doing
bu
sine
ss
and m
any ot
her
pu
rpo
s
e
s
. We
put a
r
e
a
s
of p
r
ote
c
ting p
e
rson
al
data to
be
a
nalyse
d
in
th
is
resea
r
ch. Th
e threat
s of p
r
emium SMS
or spammi
ng
and mo
bile a
pplication
s
are in acco
rda
n
c
e
with Symante
c
Se
cu
rity Re
ports 20
13, I
D
-CERT
an
d
also the YL
KI compl
a
int
repo
rt (as sta
t
ed
in the introd
u
c
tion). Syma
ntec me
ntion
ed that
one
of the topthree mobile
th
reats is p
r
emi
u
m
SMS or spa
mming (sen
di
ng conte
n
t); togethe
r with
YLKI which a
l
so re
porte
d that in 2010, the
most co
mplai
n
tswere a
b
o
u
t premium
SMS. Other
mobile thre
ats refe
rre
d to in the Symantec
Rep
o
rt are traditional thre
ats; su
ch a
s
backd
oor
, ma
liciou
s
code,
and so on, th
at can be
ca
u
s
ed
by a mo
bile
a
pplication in
st
allation in
the
sma
r
tph
one.
Although
so
me mo
bile o
p
erating
sy
ste
m
s
now have be
en
impl
ement
ing
the sa
ndb
ox
se
cu
rity
mech
ani
sm tha
t
could
sepa
rate/isolate
ea
ch
prog
ram
m
e,
su
ch
as iOS
and
Androi
d 4; in thi
s
rese
arch we
con
s
id
er
th
at
those kind
s
of
sma
r
tpho
ne a
r
e not the maj
o
rity of smart
phon
es u
s
e
d
in Indone
sia.
3. Rese
arch
Metho
d
This
re
sea
r
ch used th
e
quantative
me
thod
where
data
wa
s gath
e
re
d usi
ng
que
stionn
aire
s. Thirty que
stions were de
sign
ed to
test
the kno
w
led
ge, attitude a
nd beh
aviour
of
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 16
93-6
930
TELKOM
NIKA
Vol. 12, No. 2, June 20
14: 493 – 50
0
496
respon
dent
s
con
c
e
r
nin
g
th
e five main fo
cu
s a
r
ea
s. E
a
ch fo
cu
s
are
a
in e
a
ch dim
ensi
on h
a
s two
que
stion
s
. So
me of the
qu
estion
s
we
re
answe
re
d
on
a 3-point
scal
e-tru
e
, don’t
kno
w
a
nd fal
s
e
(attitude a
n
d
kno
w
le
dge
dimen
s
ion
s
), while
othe
rs only
need
ed a true
or false
re
spo
n
se
(beh
aviou
r
di
mensi
o
n
s
),
see exampl
e
que
stion
in T
able1. Th
e q
uestio
nnai
re
wa
s di
stribut
ed
online.
Table 1.Qu
estion Example
s
To T
est
Ques
tio
n
A
n
sw
er
Kno
w
ledge
For pr
otecting my smartphon
e fr
om malw
a
r
e/viru
s so I should
install antiv
ir
us
1. True
2. Dont
Kno
w
3. False
A
ttit
u
de
I aw
a
r
e for prote
c
ting my
smartp
hone from virus/malw
a
r
e so I
should install antivirus
1. True
2. Dont
Kno
w
3. False
Beha
v
i
our
I install antivir
us for p
r
otecting m
y
smartp
hone fr
om
virus/malw
are t
h
at can cause malfunction of m
y
s
m
artphone
1. True
2. False
Data an
alysi
s
is u
s
e
d
a
s
a descriptive method. T
h
is meth
od
descri
b
e
s
or gives an
overview of the obje
c
t und
er study thro
ugh the sa
m
p
le data or p
opulatio
n as i
t
is, without doing
analysi
s
, and
makin
g
conclusio
n
s a
ppli
c
able to t
he g
e
neral [1
4]. The popul
ation
of this re
se
arch
is peo
ple
who u
s
e
smartph
one
s and tele
communi
catio
n
se
rvice
s
from Indo
nesi
an
telecom
m
uni
cation
p
r
ovid
ers.
To
defin
e the
samp
le,
this re
se
arch
uses
no
n-probability
sam
p
ling
with purpo
sive sampl
e
techniqu
es.
Operational v
a
riabl
es i
n
thi
s
research
co
nsi
s
t of thre
e
dimen
s
ion
s
, i
.
e. kno
w
led
g
e
(what
do they kno
w
ab
out the
topic?
),
attitude (how do t
hey feel a
b
o
u
t the topic?), and be
havi
our
(wh
a
t do
th
ey do?
). Ea
ch
dimen
s
io
n ha
s five
f
o
cu
s are
a
s; adhe
ring
to se
curity
p
o
licies,
prote
c
ting p
e
rsonal
data
,
fraud/sp
am
SMS, mob
ile appli
c
atio
ns, an
d re
p
o
rting
se
cu
rity
incid
ents. Ev
ery focus area ha
s i
ndi
cators, fo
r in
stan
ce in
protecting
pe
rsonal d
a
ta, the
indicators are usin
g pa
ssword
s in
smartph
one
s
and log
g
ing
out from the
i
r acco
unt after
finis
h
ing
.
To
test the validi
t
y of every item in the
qu
estion
naire,
we u
s
e
d
the
Pearson P
r
o
duct
Moment co
rrelation whe
r
e
every
item which ha
s
a
co
rrel
a
tion
coeff
i
cient e
qual
o
r
mo
re tha
n
0
,
3
is valid.
For reliability testi
ng
we
used the Alpha
Cro
nbach method,
where
the coeffici
ent should
be equ
al or m
o
re than 0,5.
The scale of
awarene
ss wa
s determi
n
ed usin
g the
analytic hierarchy pro
c
e
s
s (AHP
).
The A
H
P ap
proa
ch
ma
ke
s u
s
e
of p
a
irwise
comp
ar
i
s
on
s to
provide a
subje
c
tive evaluation
o
f
factors ba
se
d on mana
g
e
ment’s p
r
of
ession
al
judg
ment and op
inion [3]. The score fo
r each
focu
s area p
e
r
dime
nsio
n i
s
compute
d
a
nd then n
o
rm
alise
d
to the
sum of o
ne. T
he total sco
r
e
,
v
(a), was d
e
termined by usi
ng the formul
a belo
w
[4].
Each dimensi
on and fo
cus
area has weight
t
hat
will
be used in to
tal awareness
score
comp
utation. Those wei
ght
s are d
e
fined
in Table 2 an
d Table 3 a
s
follows.
Table 2. Weight score fo
r dimen
s
ion
s
Table 3. Weight score fo
r focu
s area
.
Dime
nsio
ns
W
e
ighti
ngs
Focu
s
A
r
eas
W
e
ighti
ngs
Kno
w
ledge
30
Adhere to securit
y
policies
20
A
ttif
u
de
20
Protect
personal data
20
Beha
v
i
our
50
Fraud /spam SM
S
20
Mobile Applicatio
ns
20
Report fo
r Securi
t
y
Incidents
20
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
9
30
Measuring Information Securi
ty
Awarenes
s
of Indonesian
.... (Pus
pita Kenc
ana S
a
ri)
497
4. Results a
nd Discu
ssi
on
The
su
rvey
wa
s d
one
for around
thre
e wee
ks, f
r
o
m
the
23th
Decem
b
e
r
2
0
1
3
throug
h
13th
Jan
uary
201
4. Th
e t
o
tal num
be
r
of re
spo
nde
n
t
s was 10
6
use
r
s fro
m
several
citie
s
in
Indone
sia; B
andu
ng (64%
), Ja
ka
rt
a (1
7%), Sura
ba
ya (6%), Pal
e
mban
g (3%
)
and
other
cities
(10%).
Fema
les
wh
o u
s
e
sm
artph
one
in thi
s
su
rvey are
43%
and m
a
le
s a
r
e 5
7
% (Fig
ure
2a).Ba
s
ed o
n
the age ran
g
e
(2b
)
, the majority of resp
onde
nts (5
7
%
) are from t
he age g
r
ou
p
o
f
20-3
0
yea
r
s
o
f
age the
n
foll
owe
d
by the
age g
r
o
up of
unde
r 2
0
yea
r
s
old
(18%
), 41-5
0 yea
r
s
old
(11%), 31
-4
0 (8%) an
d ove
r
50 years old
(6%).
Figure 2. Re
spond
en
s’ ch
a
r
acte
ri
stic ba
sed o
n
gen
de
r (2a
)
and a
g
e
rang
e (2
b)
Reg
a
rdi
ng th
e u
s
ag
e of
smartph
one
s
by the
repo
n
d
ents, mo
st of
the re
spon
dents
u
s
e
their sm
artp
hone fo
r bro
w
si
ng (80%), social
m
e
d
i
a (79%
),SMS (75%) a
n
d
email (6
2
%
).
Ho
wever only
a fe
w
users
use
r
th
eir
sm
artpoh
e fo
r p
hone
calls (5
5%), playin
g
game
s
(44%
) and
others
(5%).
Othe
rs i
n
cl
ude
navi
gati
on, note
s
f
o
r le
ctu
r
e,
e-ba
nki
n
g, a
n
d p
r
od
uctiv
i
ty
appli
c
ation
s
. This u
s
ag
e is suitable with
the trend t
hat the use of internet o
r
da
ta is increa
si
ng
and the u
s
e o
f
phone calls i
s
de
cre
a
si
ng.
This can be
see
n
in the graph in Figu
re
3.
Figure 3. Smartpho
ne u
s
a
g
e
Con
c
e
r
nin
g
informatio
n secu
rity brea
ch ex
perie
nce
base
d on the survey, mo
st of the
respon
dent
s have experi
e
nce,
aroun
d8
2% and those who have
no se
cu
rity experien
c
e a
r
e
about 18%. The details of this num
ber e
x
perien
c
in
g
a
security brea
ch are as foll
ows; fraud SMS
(71%), spam
SMS (53%), fraud
call (1
7
%
), virus
(13
%
) and others (8%). The g
r
aph i
s
as sh
own
in Figure 4 an
d Figure 5.
Male
57%
Female
43%
18%
57%
8%
11%
6%
<20
20
‐
30
31
‐
40
41
‐
50
>50
0
20
40
60
80
100
(2a)
(2b)
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 16
93-6
9
30
TELKOM
NIKA
Vol. 12, No. 2, June 20
14: 493 – 50
0
498
Figure 4. Information Se
cu
rity Breach E
x
perien
c
e
Figure 5. Information Sec
u
rity
T
h
reats
The result
score of ea
ch f
o
cu
s a
r
ea a
n
d
dimen
s
io
ns wa
s then g
r
oupe
d
as
awaren
ess
crite
r
ia in T
a
ble 4. The i
n
terval value f
r
om that
crit
eria i
s
ba
se
d
on the
conti
nuum lin
e va
lu
e
whe
r
e the
maximum score i
s
100%
and the m
i
nimum sco
r
e is 33.3
3
%. Each crite
r
ia
alsoi
ndi
cates
wheth
e
r an a
c
tion pla
n
for improvem
ent is req
u
ired or
not.
Table 4. Awa
r
ene
ss Criteri
a
Criteria / L
e
v
e
l
Value (
%
)
A
c
tio
n
Plan
Go
od
77,78 - 10
0
No need to
action
A
v
e
r
age/Sa
t
isfa
c
tor
y
55,56 - 77,
77
Action potentially required
Poor
33,33 - 55,
55
Action required
An awa
r
ene
ss level (see figure 6
)
wa
s
use
d
to pre
s
ent the results and the fin
d
ing
s
of
the proj
ect. T
he colou
r
co
de can give i
mmediate i
n
formatio
n on
whi
c
h a
r
ea
s
are
safisfa
c
to
ry,
sho
u
ld be m
o
nitored, o
r
wh
ere a
c
tion
sh
ould be ta
ke
n
for improve
m
ent (un
s
ati
s
factory). So
with
the colo
ur
co
de, we can condu
ct whi
c
h
dimensi
on o
r
focu
s area
sho
u
ld be ta
ken for a
c
tion
for
improvem
ent in orde
r to increa
se the in
fo
rmation
se
curity awaren
ess level.
From the info
rmation
se
curity awaren
ess level, we can
see that:
The ove
r
all
a
w
arene
ss lev
e
l wa
s
mea
s
u
r
ed
as 80%.
This i
ndi
cate
s that the a
w
a
r
ene
ss l
e
vel is
good
.
The a
w
a
r
en
e
ss l
e
vel for the dim
e
n
s
ion
of kn
owl
edg
e and
attitud
e
is
g
ood
, but
satis
fac
t
o
r
y
for behavio
ur.
The total awa
r
ene
ss level for the focus
a
r
ea
s ad
hering to s
e
curity polic
ie
s, protecting perso
nal
data an
d frau
d/spam SMS
are
go
od
. Howeve
r the t
o
tal aware
n
e
ss l
e
vel for t
he area
s ofth
e
mobile ap
plication and rep
o
rting securit
y
incident
s are
av
erage
.
The re
sult su
mmari
sed fro
m
the inform
ation se
cu
rity awarene
ss level sug
g
e
s
ts that the
followin
g
focu
s are
a
wo
uld
requi
re p
o
ten
t
ial action (av
e
rag
e
/sati
s
fa
ctory level):
Adher
e
to s
e
c
urit
y
policies
Behaviou
r
di
mensi
on is
still at the satisfacto
ry level (75%). Base
d on the que
s
tion
s aske
d,
some
of the
re
spo
nde
nts may seldo
m
rea
d
info
rm
ation o
n
se
curity poli
c
y
while
they a
r
e
installin
g appl
ication
s
an
d they also
seld
om obey
info
rmation on
se
curity poli
cy. This may ta
ke
a long time
if they read
all the item
s in
a security
policy whil
e
they are i
n
stalling new
appli
c
ation
s
or creatin
g a
n
accou
n
t for services in
social me
dia, for insta
n
ce faceb
o
o
k
, emai
l,
twitter and
so
on.
Mobile aplication
w
i
th care
Both kn
owl
e
d
ge (76%)
an
d beh
aviou
r
(61%) di
me
n
s
i
o
ns
sh
ould
receive
attention in te
rm
s o
f
kno
w
le
dge a
nd behavio
ur. Based on the que
stion
s
aske
d,users don’t install an antiviru
s
for
prote
c
ting th
e
i
r smartp
hon
es from viruses
or
m
a
lware that can
da
mage th
eir
smartph
one
s
as
explained in
the introdu
cti
on. Mo
reove
r
they don’t u
pdate re
gula
rl
y antivirus application
s
. In
addition, the low level of behaviou
r
may be cau
s
ed b
y
a lack of kn
owle
dge ab
o
u
t the antivirus
itself.
Yes
82%
No
18%
Fraud
SMS
Spam
SMS
Fraud
Call
Virus
O
thers
71
53
17
13
8
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
930
Measuring Information Securi
ty
Awarenes
s
of Indonesian
.... (Pus
pita Kenc
ana S
a
ri)
499
Repor
ting se
curit
y
incide
nts
In orde
r to reach high le
vels of awa
r
ene
ss,
the b
ehaviou
r
dim
ensi
on shoul
d receive mo
re
attention. In terms
of rep
o
rting a
se
curity in
cid
ent
, they seldo
m
repo
rt to a call
centre
or
compl
a
in if theirp
hon
e nu
mbers or a
ccountsof
so
cia
l
media (twitter, faceb
o
o
k
, gmail, yahoo
etc.) have ex
perie
nced a
se
curity brea
ch. In additi
o
n
, they seldo
m
repo
rt to the call
centre
o
f
the telecom
m
unication op
e
r
ator
con
c
e
r
ni
ng fraud o
r
spamSMS.
Figure 6. Information
se
curity awaren
ess level
Based
o
n
th
e explai
natio
n ab
ove, it i
s
re
alised th
at kn
owl
edg
e
and
attitude
exist in
a
good level of
information
se
curity awarene
ss. Ho
we
ver, the beh
aviour dime
n
s
ion i
s
still at a
satisfa
c
to
ry level. This m
ean
s that ev
en thou
gh
th
ey kn
ow
abo
ut adhe
rin
g
t
o
a
se
cu
rity policy
and repo
rting
se
curity in
cid
ents,
they do
n’t do a
s
they
kno
w
in th
e
usa
ge of
sma
r
tphon
es. T
h
ere
are
som
e
rea
s
on
s
why this happ
en
s, for instan
ce it
ta
ke
s a lo
ng ti
me if they rea
d
all the item
s in
a security po
licy or re
po
rting a
se
cu
rity incid
ent; ma
ybe, they do
n’t have time
to re
port th
ei
r
probl
em
s o
r
they re
solve
their
pro
b
le
ms.In t
he
ca
se
of a mo
b
ile appli
c
atio
n area, attitu
de
dimen
s
ion
is good but kno
w
led
ge
a
nd behavio
ur di
mensi
on
are
a
t sati
sfacto
ry levels. It mea
n
s
that beca
u
se of the lack of
kno
w
le
dge,
they don’t act
as the poli
c
y requi
re
s.
Comp
ari
ng o
u
r re
sea
r
c
h
with
oth
e
r re
sea
r
c
h
(Kru
g
e
r’s
)
[4]
the f
o
cu
s
are
a
s a
r
e
slightly
different. Th
e
are
a
s that
should
be
ad
ressed
are
su
itable with
th
e obje
c
t of th
e survey. In t
h
is
journ
a
l, the
obje
c
t su
rve
y
is sm
artp
h
one u
s
e
r
s b
u
t in Kru
ger’
s
jou
r
n
a
l, the obje
c
t i
s
the
employee
of
an inte
rn
atio
nal g
o
ld
mini
ng
com
pany.
Ho
weve
r, di
mensi
on, th
e
wei
ghting
s
,
and
crite
r
ia in this journal a
r
e th
e same a
s
in
Kruge
r’s jo
urnal.
Reg
a
rdi
ng informatio
n se
curity threats (Figure
5) and
the result
s of information se
curit
y
awa
r
en
ess le
vels (Fi
gure
6), it seem
s that t
here i
s
a contradi
ction betwe
en
an inform
ation
se
curity thre
at experi
e
n
c
e with th
e re
sult of
a
w
a
r
e
ness level
th
at the frau
d/spam SMS threat
experie
nce is high but the se
cu
rity awa
r
en
es
s l
e
vel is goo
d. This may
be cau
s
ed
by
misun
d
e
r
sta
n
d
ing a
bout f
r
aud/
spa
m
SMS whe
r
e t
he qu
estio
n
is that if users re
ceive
an
anno
un
ceme
nt about bei
n
g
the win
n
e
r
of the pri
z
e f
r
om o
ne p
r
ov
ider o
r
some
one el
se, he
or
she shoul
d conta
c
t the legal call ce
ntre of
the provider to
check the
validity of
the
anno
un
ceme
nt. Furtherm
o
re, from the SMS there
is information
about the URL of one of
the
providers (actually this is the fa
ke URL
)
so sen
s
itive informatio
n of the use
r
s
can b
e
leaked.
In terms of th
e focu
s area
of mobile ap
plicatio
ns it is clea
rly unde
rstoo
d
that there i
s
a
positive rel
a
tionship betwe
en an inform
ation se
cu
rity
threat experi
ence (Figu
r
e
5) with the re
sult
of the a
w
are
ness level
(F
igure
6) that
the vi
ru
s th
reat exp
e
rie
n
c
e i
s
hi
gh a
nd the
se
cu
rity
awa
r
en
ess le
vel is averag
e (nee
ds
pot
ential im
provement). Thi
s
may be cau
s
ed by u
s
ing
or
installin
g ne
w appli
c
ation
s
whi
c
h a
r
e a
c
t
ually viru
ses
so thi
s
can d
a
mage
(malf
unctio
n
) a
user’s
sma
r
tpho
ne.
Focu
s
Ar
ea
(w
e
i
ght
)
D
i
me
nsi
o
ns
(w
e
i
g
h
t
)
Kn
o
w
l
e
d
g
e
(30
)
Attitu
d
e
(2
0)
Beh
a
v
i
o
r
(5
0
)
To
t
a
l
A
w
a
r
en
e
ss/
f
o
c
u
s
ar
e
a
92
8
6
75
82
91
9
6
82
88
92
8
8
84
87
76
8
2
61
70
81
8
9
64
74
86
8
8
73
80
A
dhere
to
sec
u
r
i
ty
policie
s
(20
)
Pr
o
t
ec
t
pers
onal
dat
a
(20
)
Pr
emi
u
m/
s
p
am
SMS
(20)
Mo
b
i
l
e
Applica
t
ions
(2
0)
Re
por
t
for
Secu
r
i
ty
I
n
cide
nt
s
(20)
Tot
a
l
A
w
arene
s
s
/
dim
e
ns
ions
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 16
93-6
930
TELKOM
NIKA
Vol. 12, No. 2, June 20
14: 493 – 50
0
500
5. Conclusio
n
Based o
n
ou
r research, it is stated that
t
he level of secu
rity awa
r
e
ness for Ind
o
nesi
an
sma
r
tpho
ne
use
r
s i
s
still at agood lev
e
l. This is
in
dicate
d by the numbe
r of total awaren
ess
whi
c
h i
s
abo
ut 80%
altho
ugh th
ere a
r
e
so
me
fo
cu
s
area
s that sh
ould be add
ressed in orde
r to
have p
o
tentia
l improvemen
t. In the b
eha
viour
dime
n
s
i
on,
they are
mobile appli
c
ation,
repo
rting
a se
cu
rity incident and
ad
herin
g to se
curity polic
y.
While in th
e kno
w
le
dge di
mensi
on, the
r
e is
the mobile
a
pplication a
r
e
a
that sh
ould
be imp
r
ove
d
. Ho
wever i
n
the attitud
e
dimen
s
io
n, all
focu
s are
a
s a
r
e at a good l
e
vel.
By implementing an inform
ation se
cu
rity aw
arene
ss p
r
og
ramm
e for smartp
hon
e use
r
s,
hopefully the
y
understand
about securit
y
and safeg
u
a
rd
in
g their in
formation in t
he usage of t
heir
sma
r
tpho
ne
whi
c
h they u
s
ually u
s
e for email, se
rvic
es in
so
cial
media, SMS, chatting et
c. This
se
curity a
w
a
r
ene
ss
pro
g
ra
mmeis im
po
rtant be
ca
u
s
e
the numb
e
r
of sma
r
tpho
n
e
users al
wa
ys
increa
se
s every year an
d they
use it for
many purpo
ses.
If user
aware
ness i
s
go
od
and the i
n
formation
securi
ty threat is
still high, mayb
e there
are
other fact
ors that
cau
s
e i
t. Therefore, for the
nex
t resea
r
ch, it can
be
devel
oped to
an
alyse
thosefa
c
tors su
ch
a
s
why informatio
n
secu
rity
bre
a
ches
to sma
r
t
phon
e
u
s
ers are still
relati
vely
high, espe
cial
ly fraud/spa
m
SMS.
Referen
ces
[1]
Sari
PK.
A
Conc
ept of In
formati
on
Sec
u
rity Man
a
g
e
m
e
n
t for H
i
g
her Ed
ucati
o
n
. International
Confer
ence on
T
e
chnol
og
y
a
nd Operati
on
Mana
geme
n
t, 3rd.
Band
un
g. 201
2: 469-
477.
[2]
Kruger
H, an
d
et al.
A v
o
ca
bul
ary T
e
st to
Assess Infor
m
ati
on S
e
cur
i
ty Aw
areness
. South
Afric
a
n
Information Se
curit
y
Mu
lti-co
n
f
erence i
n
Port Eliza
beth, Sout
h Africa. 201
0.
[3]
Z
hao J, Z
h
o
u
Y, Shuo
L. A
Situatio
n A
w
a
r
ene
ss M
o
d
e
l
o
f
S
y
stem S
aur
vivabi
lit
y Bas
e
d on
Vari
abl
e
Fuzzy
Set.
TELKOMNIKA.
2012; 10(
8): 223
9-22
46.
[4]
Kruger HA, Ke
arne
y W
D
. A Proto
y
pe for Ass
e
ssin
g
Informa
tion Sec
u
rit
y
A
w
a
r
e
ness.
Else
vier Jour
na
l
:
Co
mp
uters & Security
. 200
6; 25: 289-
29
6.
[5]
Sy
mantec.
Informati
on Sec
u
rit
y
T
h
reat Repor
ts
. Sy
ma
ntec C
o
rpor
ation. 2
0
1
3
; 18.
[6]
IDCERT
.
Laporan Dw
i Bula
n II 2013
. Indo
ne
sia Com
puter
Emerge
nc
y
Re
spons
e T
eam.
201
3.
[7]
IDCERT
.
ID-CERT
Annua
l R
eport 20
12
. Ind
ones
ia Com
put
er Emerge
nc
y
Resp
onse T
e
a
m
. 2012.
[8]
Shab
ech H, Je
yanth
i
N, Iye
ngar N.Ch.S
.N
. A stud
y
o
n
securit
y
T
h
rea
t
s in Cloud.
International
Jouar
nal of Cl
o
ud Co
mputin
g
and
Serv
ices S
c
ienc
e (IJ-CLOSER).
2012; 1(
3): 84-88.
[9]
Al-Sehri Y. Informatio
n
Secu
rit
y
A
w
ar
en
ess
and Cu
lture.
British Jour
nal
of Arts and Social Sc
ienc
es
.
201
2; 6(1): 61-
69
[10] Lau
do
n
KC, T
r
aver CG.
E-Commer
ce 20
12: Bus
i
ness, T
e
chn
o
l
ogy, Soci
ety
. Engl
and. P
ear
son
Educati
on L
i
mi
ted. 201
2.
[11]
ISACA.
Busine
ss Model for In
formati
on Sec
u
rity
. USA. 2010
.
[12] British
Stan
d
a
r
d Institution.
ISO/IEC 27001:2
0
1
3
Informati
on T
e
cn
olo
g
y-Secur
i
ty T
e
chniq
ues-
Information Se
curity Mana
ge
me
nt Systems-
Req
u
ire
m
ents
.
S
w
itz
e
rla
nd. B
S
I Standard L
i
mited. 201
3.
[13]
Peltier, T
homa
s
R.
Informati
on Sec
u
rity F
und
a
m
ent
als,
Secon
d
Ed
itio
n
. Boca
Rato
n
.
CRC Press.
201
4.
[14] Sugi
yo
no.
Stati
s
tik Untuk Pen
e
litia
n
. Ban
dun
g. Alfa Beta. 2009.
Evaluation Warning : The document was created with Spire.PDF for Python.