<p>Technology evolves at such a rapid pace nowadays, keeping up with education on cyber security tends to fall. Even with the rising threats, people put their personal information in their computers without knowing who could access the information. Many people keep their personal information online when they do shopping, banking, or on social media. These online activities attract adversaries that may have malicious attentions. The lack of cyber security practices is evident as we often hear the news of large-scale cyberattack incidents against financial institutions that leads to breach of personal information of their users. Cyber-attacks can have long term damaging effects. Cybersecurity awareness is necessary to start at an early age. If this subject is delivered to young users as an interactive tutorial, using game-based principles, then it is more likely to be learned in an entertaining manner. Hence, this thesis project focuses on a framework development for interactive and engaging cybersecurity education and its evaluation. </p> <p>The framework is developed to educate the users various cybersecurity related topics, such as malware, web security, and network security. It consists four stages for each topic: information, interaction, explanation, and assessment. In the information module, the user is presented details related to the topic. To maintain users’ interest, interaction module allows users to interrelate with common hacking attacks from real life situations. Explanation module provides the discussion of interaction module and introduces defense techniques. The users are tested in the Assessment module to measure their learning to be able to advance to next levels within the same topic. The developed framework is customizable since more modules can be integrated and existing modules can be swiftly modified. In addition, multiple surveys were conducted to analyze whether this framework explains the cybersecurity topics easily. </p>

Organizations are embracing technological solutions to improve efficiency; however, this also opens organizations to new threats. The rapid development of new technology, such as AI, combined with a changing threat landscape, puts organizations under pressure to adapt. Simultaneously, the EU has proposed a new directive that forces organizations to adopt stricter cybersecurity measures. This raises the question of how organizations can create sustainable cybersecurity practices that will ensure safety over time despite rapid changes in the environment. This has resulted in the following research question: What are the barriers to establishing sustainable cybersecurity practices? To answer this question, ten semi-structured interviews with experts in the cybersecurity field were conducted. Five barriers were identified: (1) barriers in cybersecurity activities, (2) barriers of existing resources, (3) barriers in the human factor, (4) technical barriers, and (5) external barriers, which contribute to bridging the gap between best practices established in research and issues that practitioners are facing. Further, it contributes to an understanding of the importance of a more holistic approach to cybersecurity measures contributing to previous research within the field of IS.