# Cybersecurity Knowledge Requirements for a Water Sector Employee

R. Thomani, A. Marnewick, Suné Von von Solms, M. Malatji

► To cite this version:

R. Thomani, A. Marnewick, Suné Von von Solms, M. Malatji. Cybersecurity Knowledge Requirements for a Water Sector Employee. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.91-105, 10.1007/978-3-031-12172-2_8 . hal-05324926

HAL Id: hal-05324926

https://inria.hal.science/hal-05324926v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# Cybersecurity Knowledge Requirements for a Water Sector Employee

R. Thomani<fnref n="1" />, A. Marnewick<fnref n="1" />, S. von Solms<fnref n="2" />✉, and M. Malatji<fnref n="1" />

**Abstract.** Critical infrastructure in South Africa remains highly vulnerable to cybercrime threats due to a poor cyber-crime fighting capacity and a lack of a strong cybersecurity policy. South Africa appears to have fallen behind in securing and protecting cyberspace, considering the country's dependability as well as the interconnectedness to the internet. Globally, the water and wastewater sector were ranked number four in the global security incidents. This study presents the findings of a systematic literature review conducted to assess the cybersecurity knowledge necessary for a general employee in the water sector. The study proposes a framework for determining the minimum knowledge that a general employee in the water sector should have. The frameworks start by defining the eight different types of cybersecurity challenges, then move on to mitigation strategies for dealing with such attacks. Several approaches and strategies were provided for mitigating various cybersecurity challenges. To deal with such risks, mitigations such as cybersecurity knowledge and skills, cybersecurity awareness, and cybersecurity training were proposed. The strategies for developing knowledge to deal with various sorts of dangers were provided at both the individual and organizational levels.

**Keywords:** Awareness · Critical infrastructure · Cybersecurity knowledge · Water sector employee

## 1 Introduction

Globally, the water and wastewater sector was ranked number 4 in the global security incidents based on the Repository of Industrial Security Incidents [1]. South Africa, in particular, has fallen behind in securing and protecting cyberspace, especially in state organisations which are facing an increasing amount of cybersecurity attacks and cybercrime [1, 2]. The critical infrastructure in South Africa remains highly vulnerable to cybercrime threats due to lack of a strong cybersecurity policy and poor cybercrime-fighting capacity [1].

<footnote n="1">¹ School of Engineering Management, University of Johannesburg, Gauteng 2094, South Africa
{amarewick,masikem}@uj.ac.za</footnote>

<footnote n="2">² Department of Electrical and Electronic Engineering, University of Johannesburg, Gauteng 2094, South Africa
svonsolms@uj.ac.za</footnote>
Water management is South Africa is the responsibility of a range of organisations, from national departments to local municipalities. A wide range of corporate information technologies (IT) and operational technologies (OT) are deployed in the water and sanitation sector as utilities are increasingly using smart or connected industrial control systems. These connected technologies are vulnerable to cybersecurity threats, which includes sabotage or even damage by means of contamination injection, cyberattacks or physical destruction. South African organisations continuously invest in technological resources to reinforce their connectivity, automation and security dispositions, but regularly fall victim to unwanted intrusions to their information systems due to vulnerabilities caused by human activity on these systems. A shortage in cybersecurity professionals and general organisational cybersecurity awareness leads to a lack of safeguarding of these organizations from cybercrime and other cyber-related threats [3]. To date, systems that can protect themselves without involving the human element have not been realised, and consequently systems are prone to be threatened by human action (both intentionally and unintentionally. Therefore, there is a need to examine internal procedures and protection mechanisms to prevent cyberattacks related to the human aspects of these systems [4]. Building a cybersecurity culture has been argued by researchers to be essential in changing attitudes and perceptions as well as instilling good security behaviour in individuals [5].

The creation of a cybersecurity culture within an organisation is not an easy task, where a layered approach is required which includes aspects such as organisational and management support, policy, awareness and training, monitoring and auditing. It also requires aspects such as employee involvement and communication, learning from experience, shared responsibility, continuous learning and empowerment of employees [6]. One fundamental aspect to create such a culture is that employees must be empowered to understand cybersecurity vulnerabilities and the important role that they play in securing themselves and their organisation. This empowerment requires employees to have a certain level of cybersecurity awareness (CSA), be engaged in continuous training and communication. This paper aims to determine what knowledge employees are required to have to promote cybersecurity culture and awareness in the water sector.

To determine the answer, a systematic literature review was conducted with the objective to determine approaches to build the cybersecurity knowledge and awareness of a typical employee to support the creation of a cybersecurity culture within organisations in the water sector. The focus of this research was on water infrastructure and the sector-specific cybersecurity attacks but can be utilised in other critical infrastructure sectors as the results prove to be overarching and applicable to the wider critical infrastructure sector. This paper's arrangement begins with an introduction section stating the research goal. Section 2 describes the research approach, and Sect. 3 describes how the approach was carried out. Section 4 discusses the findings of the literature review. Section 5 of the paper concludes with recommendations for future research.

## 2 Research Methodology

The following procedure was developed by combining approaches from Xiao and Watson [7] and Shaffril [8] and is illustrated and summarized in Fig. 1 below.
* Planning the review: consist of two stages, the first step will be the identification of the need for a review followed by the development of the review protocol.

* Conducting the review: consist of five stages. The first stage will be the identification of research followed by selection of primary studies, study quality assessment, data extraction and data synthesis.

* Reporting the review: Reporting findings and data demonstration.

<figure><img src="image_4.png" /><figcaption>**Fig. 1.** Systematic literature review process [7, 9] the planning review stage of the systematic literature review is discussed in the subsection below.</figcaption></figure>
# 3 Planning the Review

## 3.1 Identifying the Need for a Review

The objective of the systematic review in this research is to enable the answering of the research question as to *what knowledge is essential for typical employees in the water sector to support the creation of a cybersecurity culture within the organization.* The necessity for this systematic literature review comes as a result of the need to gather and summarize all the existing literature that will present evidence on existing and anticipated sector-specific cybersecurity awareness, where subsequently the knowledge and capabilities required to curb these cybersecurity related attacks will be outlined with the overall goal to create cybersecurity awareness and support the creation of a cybersecurity culture in organizations within the water sector.

## 3.2 Development of a Review Protocol

The review protocol development step defines the methods to be used for undertaking the systematic literature review. This focused on the rationale for the review, research question, search strategy including search terms, resources to be searched and the databases, selection criteria for inclusion and exclusion, quality assessment checklist and procedures, data extraction strategy and the synthesis of the extracted data [10]. The research question was structured and framed in terms of a modified PICO model to formulate a combination of keywords that were used in the electronic databases. Table 1 below is the key search phrases utilized;

<table><caption>**Table 1.** Key search phrases</caption><thead><tr><th>Population</th><th>Intervention</th><th>Outcome</th></tr></thead><tbody><tr><td rowspan="2">Employees</td><td>Support cybersecurity culture</td><td>Identify cybersecurity knowledge</td></tr><tr><td>Support cybersecurity awareness</td><td>Identify cybersecurity education and training</td></tr></tbody></table>

The search strategy for the research made use of a Boolean operations to build up controlled vocabulary terms for acquiring articles through joining together the key search phrases with the Boolean “AND” operator. Following the Boolean operation, search strings were formulated as follows:

**String 1:** Employees AND Cybersecurity culture challenges AND Cybersecurity knowledge requirement AND Critical Infrastructure

**String 2:** Employees AND Cybersecurity awareness AND Cybersecurity education and training AND Critical Infrastructure

The results after the execution of the protocol are summarized in the next section.
# 4 Conducting the Review

## 4.1 Searching the Literature

The study put a limit on the search for review papers to peer-reviewed studies. The studies were acquired from a pre-selected list of databases that include ProQuest, IEEE, Emerald, Engineering Village, Wiley, and ScienceDirect were utilized.

## 4.2 Screening for Inclusion and Exclusion

To reduce the possibility of bias, the selection criteria were used to find studies that will provide evidence for the research question. The inclusion and exclusion criteria were defined for including studies and further selecting the most related studies. The inclusion criteria are prepared for identifying studies that are related to research questions [11]. Table 2 and Table 3 below illustrate the detailed inclusion and exclusion criteria.

<table><caption>**Table 2.** Inclusion criteria [11]</caption><tr><td>Language in article</td><td>To prevent compromising output quality, articles delivered in English will be used</td></tr><tr><td>Article is peer-reviewed</td><td>Only peer-reviewed papers will be used to ensure the study's quality</td></tr><tr><td>Article is in full text</td><td>To allow extensive reading, only full-text articles will be included</td></tr><tr><td>Type of article</td><td>The article can be comparative, action research, case study, survey, emphatical study</td></tr><tr><td>Article relation</td><td>The article is related to cybersecurity knowledge and awareness in the water sector</td></tr><tr><td>Article discussion</td><td>Articles explore the prerequisites for cybersecurity knowledge in order to raise awareness</td></tr><tr><td>Article Evaluation and analysis</td><td>The article evaluates and analyses existing cybersecurity knowledge of employees in the water sector</td></tr></table>

<table><caption>**Table 3.** Exclusion criteria [11]</caption><tr><td>Articles not matching criteria</td><td>Articles that do not comply with the inclusion criteria will be excluded</td></tr><tr><td>Articles not in English</td><td>Articles not written in English will be excluded, this may affect the accuracy of the research</td></tr></table>

(continued)
<table><caption>**Table 3.** (continued)</caption><tr><td>Unverified articles</td><td>To avoid misleading information, articles that are not peer-reviewed will be excluded</td></tr><tr><td>Duplicated articles</td><td>DOI numbers will be used to identify repeating articles from different databases</td></tr><tr><td>Unreliable sources</td><td>Unreliable sources such as Wikipedia, Ask.com, Encarta.msn.com, Answers.com will not be used</td></tr></table>

## 4.3 Data Extraction

Data extraction is referred to as the most challenging aspect of the systematic literature review given that the process involves going back to primary articles and highlighting the relevant information that will eventually answer the research question [12]. To ensure a transparent and complete reporting of the systematic review and meta-analysis [13], The Preferred Reporting Items for Systematic Reviews and Meta-analysis (PRISMA) approach was used for summarising aggregate data from the identified databases. Table 4 below shows the results.

<table><caption>**Table 4.** Summary of total reviewed document titles.</caption><thead><tr><td>Database name</td><td>Initial search results</td><td>Retained articles after removing duplicates</td><td>Retained articles after screening using codes</td><td>Retained articles after 2<sup>nd</sup> screening</td></tr></thead><tbody><tr><td>ProQuest</td><td>662</td><td>494</td><td>41</td><td>5</td></tr><tr><td>IEEE</td><td>309</td><td>206</td><td>28</td><td>8</td></tr><tr><td>Emerald</td><td>230</td><td>148</td><td>20</td><td>2</td></tr><tr><td>Engineering Village</td><td>445</td><td>266</td><td>59</td><td>11</td></tr><tr><td>Wiley Online</td><td>106</td><td>74</td><td>4</td><td>0</td></tr><tr><td>ScienceDirect</td><td>261</td><td>192</td><td>13</td><td>4</td></tr><tr><td><strong>Total</strong></td><td><strong>2013</strong></td><td><strong>1380</strong></td><td><strong>165</strong></td><td><strong>30</strong></td></tr></tbody></table>

Six databases were used in the identification phase to search for literature using the search strategy. The search strategy returned 2013 literature documents, 633 of which were identified duplicates as a result of searching multiple databases. The remaining 1380 literature documents were subjected to screening. The first screening procedure involved the use of codes to identify literature that will help answer the research question. The codes screening process resulted in the retention of 165 pieces of literature, which then went through the second screening process, which involved reading abstracts. The second screening process resulted in the retention of 30 pieces of literature for full-text
assessment, where eligibility was checked based on the inclusion and exclusion criteria.
The qualitative synthesis and analysis will be carried out in next section.

## 4.4 Screening for Eligibility

Screening articles for eligibility was done through full-text screening through the application of the inclusion criteria and the exclusion criteria. After downloading and reading the full text of the 30 articles, seven articles were found to be irrelevant and/or not applicable for this research. In the end, the seven articles were excluded and 23 studies from the literature were chosen for qualitative synthesis and analysis that will be covered in the next section.

## 4.5 Quality Assessment

The study quality assessment was used to assist in investigating whether quality differences explain differences in the study results. This was achieved through formulating questions to model the study quality assessment. The quality assessment model was adopted from Kitchenham [14]. Study quality appraisal was conducted in two stages. The first stage was, reading the article's summary or abstracts and conclusion in each study to assess relevancy. The second stage was quality appraisal through the 10 Critical Appraisal Skills Program (CASP) checklist of questioning, this provided for distinguishing issues in a systematic manner [15].

# 5 Data Analysis and Synthesis

The process of data synthesis involved the collating and summarising the results of the included primary studies to create a new understanding through comparing and analysing concepts and findings from the different sources that focused on the same topic of interest. Data synthesis requires transparency in the formulation process and requires authors to identify and extract evidence from the studies included to develop combined synthesized findings [16].

The thematic analysis process involved a constant back and forth movement between the data set, the coded extract and the analysis of the data being produced. The first step is familiarisation with the data, this step is necessary for the researcher to note initial ideas and transcribing the data from reading. The second step is generating initial codes where the author code interesting features in the data and collate relevant data before searching for themes, searching for themes is the third step where codes are then collated into potential themes. Themes are reviewed in the fourth stage by verifying if the theme works with the coded extract. Analysing and refining the specifics of each of them becomes the fifth stage before reporting on the analysis of selected extracts relating to the research question [17]. The five stages by Braun and Clarke [17] were followed and the outcome of each stage will be discussed in the sections below.
## 5.1 Familiarisation with the Data

The studies were read repeatedly for familiarisation. The studies consisted of 10 journal articles and 13 conference papers. The aim of grouping these studies is to assist in a better understanding of the data by grouping the studies.

## 5.2 Generating Initial Codes

At this stage, codes were developed through the process of forming categories based on elements shared within the data. The coding was developed with the consideration of the research question.

## 5.3 Searching for Themes

At this stage, themes for identifying the cybersecurity challenges and the corresponding themes for building cybersecurity knowledge emerged through the use of codes. Codes with common features were allocated to the appropriate and relevant themes. The theme aims to capture important details in the data with the research question to present patterned response or meaning in the data set [17].

**Themes for Cybersecurity Challenges.** Eight themes were identified for cybersecurity challenges. These themes assisted in identifying the blocks of knowledge that general employees should have to protect the critical infrastructure. The themes below were developed based on the codes retrieved from the 23 studies. The common types of cybersecurity threats indicated in each study were highlighted and allocated a single digit per study. Figure 2 below is the summary of different types of cyberattacks that are prevalent in critical infrastructure.

**Themes for Methods of Mitigating Cybersecurity Threats.** Four themes were identified for mitigating cyber threats. These themes assisted in identifying methods for mitigating cybersecurity threats as identified from the 23 collected studies from which a systematic literature review conducted. The common methods of building cybersecurity knowledge were allocated a single digit per study. Figure 3 below is the summary of different types of methods that can be used to build the cybersecurity knowledge of employees.

## 5.4 Reviewing the Themes

*Internal Homogeneity:* This criterion is concerned with the degree to which data belonging to a specific category or code holds together in a meaningful way [18]. In evaluating the internal homogeneity for cybersecurity challenges, the summary of themes and frequency of codes presented in the research were assessed.

*External Heterogeneity:* This criterion concerns for determining the degree to which differences between categories are clear and bold [18]. In evaluating the external heterogeneity, the chosen themes were found to be consistent with the supporting codes creating a unified pattern. The theme “cybersecurity culture” appeared less coherent as compared to the other themes.
<figure><img src="image_5.png" /><figcaption>Fig. 2. Types of cybersecurity threats per study</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>Fig. 3. Methods of mitigating cybersecurity threats per study</figcaption></figure>

## 5.5 Reporting on Findings

Responding to security threats necessitates cybersecurity skill and knowledge training. It is critical to teach all employees and organizational leaders in cybersecurity skills so that they can better guard against and respond to cyber threats [19]. The detection and reaction to critical circumstances is a crucial component that companies should prioritize. These measures have the potential to dramatically decrease losses associated
with cyber security breaches [20]. Employees' understanding of information security is seen as a protective element whereas a probable lack of awareness regarding security threats to which they may be exposed if not properly identified or detected in advance is regarded as a risk factor [21].

## 5.6 Framework for Defining the Cybersecurity Knowledge

A high-level approach leading towards building and identifying the cybersecurity knowledge required for a general employee is depicted in Fig. 4, where the basic Input Process Output (IPO) model was followed in building the framework illustrated in Fig. 5.

<figure><img src="image_7.png" /><figcaption>Fig. 4. IPO model for building cybersecurity knowledge</figcaption></figure>

The study was approached from the angle of firstly determining the main threats which an organisation and its employees are generally faced with, marked at the input section of the model. The process section of the model relates to the various mitigation methods that can be employed by an organization in order to mitigate the threats listed in the input section. The output section relates to the actions stemming from the determined threats and various mitigation methodologies. As mentioned earlier in the document, the establishment of a cybersecurity culture within an organization must follow a layered approach which includes building cybersecurity knowledge at an individual level as well as an organizational level. These three sections were expanded to create the framework for identifying cybersecurity knowledge required for a general employee in the water sector, shown in Fig. 5 below.

The cyber threats identified in the input section of the model is considered the minimal knowledge that a typical general employee in the water sector should have. Data breaches, employee negligence, social engineering (phishing attacks), denial of service attacks, malicious insiders, malware/ransomware, stolen credentials and unauthorised access were recognized as eight risks that every general employee should be aware of as depicted in Fig. 5. It is acknowledged that there exist many other threats which can be included in employee training. The focus of this study was to determine the most general of these topics, limiting it to eight.

The literature studied listed four mitigation methods which can be employed both the individual and organizational levels to mitigate the vulnerabilities and hazards indicated as the minimal knowledge or capabilities. These methods are, cybersecurity skills and knowledge, cybersecurity awareness, cybersecurity training and cybersecurity culture.
The organisational level and individual levels depicted in the framework below ties back to the need for a layered approach to creating a cyber aware organisation.

At an organisational level, management support, inter-organisational knowledge sharing, awareness and training, policy, and monitoring is required. At the individual level, employees need to be supported and engage in continuous learning, knowledge sharing and must share the responsibility of cybersecurity in the organisation. It is imperative that employees must be supported by the organisation to improve their cybersecurity knowledge and skills through contextualisation, knowledge sharing and empowering of employees. These goals toward a cybersecurity culture in an organisation is frequently reflected in the knowledge and skills of its personnel [22]. A lack of cybersecurity knowledge and awareness can be one of the major causes of cyber-incidents, thus cybersecurity awareness in a company is important [23].

The literature studies gathered agree that a general employee in the water sector should be knowledgeable in at least the eight types of cybersecurity threats identified in the framework in Fig. 5. The protection of critical infrastructure can be assisted by building the knowledge of employees by employing mitigations methods by the organisations.

Building cybersecurity knowledge and skills at individual level requires employees to develop the capacity understand the context of cyberattacks and have the ability to recognise potential security threats, foreseeing the impact and initiating suitable responses. It is important that employees are knowledgeable on the different types of attackers, their motivation, resources and skills, which would further assist in gasping possible loopholes and risks. In an organisational setting, the cybersecurity knowledge and skills involve a joint organisational cybersecurity capability of the staff which include the ability to detect and respond in critical situations, sharing of knowledge amongst employees, and the development of policies aimed at making employees knowledgeable. The effort made by the organisation is critical in the support of individual knowledge and skills development.

Cybersecurity awareness requires employees to develop situational awareness that will enable them to be aware of potential cyberthreats. It is good practice to create awareness about topics such as the creation of strong passwords and keeping passwords safe. Employees can develop critical awareness based on experiences of co-workers, therefor information sharing is critical and must be supported by the organisation. Organisations should design and develop CSA for compliant behaviour to enable employees to identify cyber-risks in their specific work context. The security behaviour of employees must be in line with the organisation's security procedures and policies.

Cybersecurity training requires employees to build skills through developing abilities to manage incidents and reduce successful attacks. Through training, individuals can develop abilities to recognise threats and take appropriate action. The capability of spotting cyberthreats and the preparedness to respond in an adequate manner can be achieved through different training methods with the more hands-on skills training deemed crucial. Hands-on skills training includes methods such as gamification and cyber-ranges which must be conducted or supported by the organisation. Cybersecurity training entails building the team's capacity to detect and respond to attacks and the training must be such that it is tailored to meet the security policies of an organisation.
<figure><img src="image_8.png" /><figcaption>Fig. 5. Framework for identifying cybersecurity knowledge</figcaption></figure>
The creation of a cybersecurity culture within the organisation should be an end goal. Cybersecurity culture should be embedded within organisations to reduce the occurrence of security breaches. This can be achieved by ensuring that a culture of CSA is created and maintained within the organisation, fostering excellent security practices through ongoing training and awareness. Regular communication is important to maintain the culture of safe practices; this can be achieved through several initiatives, including education and awareness, management support, policy, and information sharing.

# 6 Conclusion

The aim of this research was to develop approaches to follow in building the cybersecurity knowledge and awareness for a typical employee, to assist in the creation of a cybersecurity culture within organisations in the water sector. It is acknowledged that organisational resilience can only be achieved through a layered approach with a combination of technical, formal, and informal mitigation strategies and that cybersecurity knowledge alone will not be sufficient. The focus of this paper was to determine the general cybersecurity knowledge requirements which must be considered by organisations looking into promoting a cybersecurity culture.

The finding of the study was the identification of the different cyber threats that employees in the water sector must be aware of as well as the approaches that can be followed to build employees cybersecurity knowledge. Employees that are aware of the vulnerabilities are likely to distinguish possible security risks, predict their impact, and take appropriate action if the organisational structures are put in place to facilitate such actions.

## 6.1 Limitations and Future Research

This was limited to peer reviewed publications and was limited to six databases that include; ProQuest, IEEE, Emerald, Engineering Village, Wiley Online and ScienceDirect. This review has specifically targeted as an initial literature review relating to the critical infrastructure context. The findings of this initial study proved to mostly include general cybersecurity skills and knowledge which can be utilised in various sectors, not only limited to the water sector or the critical infrastructure sector. This paper will be extended in the future to include additional literature outside of the critical infrastructure context that could be applied in the water sector context which will assist in understanding the problem more thoroughly.

The study will serve as the foundation for future work, which will involve the expansion of the literature review and the development of the theoretical framework through feedback from water industry specialists. The finalized framework will guide the creation of instructional materials that will educate personnel in the industry on how to better safeguard infrastructure and foster a cybersecurity culture in the sector.

**Acknowledgements.** This research study was supported by the Water Research Commission (WRC) of South Africa, grant number 2021/2023-00354.
References

1. Panguluri, S., Phillips, W., Cusimano, J.: Protecting water and wastewater infrastructure from cyber attacks. Front. Earth Sci. 5(4), 406–413 (2011)

2. Von Solms, R., Von Solms, B.: National cyber security in South Africa: a letter to the minister of cyber security. In: Proceedings of the 10th International Conference on Cyber Warfare and Security, ICCWS 2015, pp. 369–374 (2015)

3. Parker, A., Brown, I.: Skills requirements for cyber security professionals: a content analysis of job descriptions in South Africa. In: Venter, H., Loock, M., Coetzee, M., Eloff, M., Eloff, J. (eds.) ISSA 2018. CCIS, vol. 973, pp. 176–192. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-11407-7_13

4. Burghouwt, P., Maris, M., Peski, S., Luiijf, E., Voorde, I., Spruit, M.: Cyber targets water management. In: Havarneanu, G., Setola, R., Nassopoulos, H., Wolthusen, S. (eds.) CRITIS 2016. LNCS, vol. 10242, pp. 38–49. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-71368-7_4

5. Alshaikh, M.: Computers & security developing cybersecurity culture to influence employee behavior : a practice perspective. 98 (2020). https://doi.org/10.1016/j.cose.2020.102003

6. Reegård, K., Blackett, C., Katta, V.: The concept of cybersecurity culture. In: Proceedings of the 29th European Safety and Reliability Conference, pp. 4036–4043 (2019). https://doi.org/10.3850/978-981-11-2724-3_0761-cd

7. Xiao, Y., Watson, M.: Guidance on conducting a systematic literature review. J. Plan. Educ. Res. 39(1), 93–112 (2019)

8. Mohamed Shaffril, H.A., Samsuddin, S.F., Abu Samah, A.: The ABC of systematic literature review: the basic methodological guidance for beginners. Qual. Quant. 55(4), 1319–1346 (2020). https://doi.org/10.1007/s11135-020-01059-6

9. Kraus, S., Breier, M., Dasí-Rodríguez, S.: The art of crafting a systematic literature review in entrepreneurship research. Int. Entrepreneurship Manag. J. 16(3), 1023–1042 (2020). https://doi.org/10.1007/s11365-020-00635-4

10. Tawfik, G.M., et al.: A step by step guide for conducting a systematic review and meta-analysis with simulation data. Trop. Med. Health 47(1), 1–9 (2019)

11. Svahnberg, M., Gorschek, T., Feldt, R., Torkar, R., Saleem, S.B., Shafique, M.U.: A systematic review on strategic release planning models. Inf. Softw. Technol. 52(3), 237–248 (2010)

12. Bettany-Saltikov, J.: How to do a systematic literature review in nursing. A step-by-step guide. Nurse Educ. Pract. 13(3) (2012)

13. Liberati, A., et al.: The PRISMA statement for reporting systematic reviews and meta-analyses of studies that evaluate health care interventions: explanation and elaboration. J. Clin. Epidemiol. 62(10), e1–e34 (2009). https://doi.org/10.1016/j.jclinepi.2009.06.006

14. Kitchenham, B.: A rare case of Erdheim-Chester disease in the breast. Proced. Perform. Syst. Rev. 37(1), 79–83 (2004)

15. Panchal, K., Damodaran, M.: Computation of the flowfield in the vicinity of an electric vehicle platform. In: Saha, A.K., Das, D., Rajesh Srivastava, P.K., Panigrahi, K.M. (eds.) Fluid Mechanics and Fluid Power – Contemporary Research, pp. 333–341. Springer, New Delhi (2017). https://doi.org/10.1007/978-81-322-2743-4_32

16. Noyes, J., Popay, J., Pearson, A., Hannes, K., Booth, A.: Qualitative research and Cochrane reviews. In: Cochrane Handbook for Systematic Reviews of Interventions: Cochrane Book Series, October 2017, pp. 571–591 (2008)

17. Braun, V., Clarke, V.: Qualitative research in psychology using thematic analysis in psychology using thematic analysis in psychology (2006)

18. Patton, M.: Qualitative Research and Evaluation Methods, 4th edn., vol. 148 (2015)
19. Adams, M., Makramalla, M.: Paget's disease: another paramyxovirus in the archaeological record. cybersecurity skills training: an attacker-centric gamified approach. Technol. Innov. Manag. Rev. 5(1) (2015). https://doi.org/10.15173/nexus.v12i1.150

20. Mishra, S., et al.: A modular approach to teaching critical infrastructure protection concepts to engineering, technology and computing students. In: Proceedings - Frontiers in Education Conference, FIE, 2016-Novem (2016). https://doi.org/10.1109/FIE.2016.7757367

21. Nagarajan, A., Allbeck, J.M., Sood, A., Janssen, T.L.: Exploring game design for cybersecurity training. In: Proceedings - 2012 IEEE International Conference on Cyber Technology in Automation, Control, and Intelligent Systems, CYBER 2012, pp. 256-262 (2012)

22. Daniel Ani, U.P., He, H.M., Tiwari, A.: Human capability evaluation approach for cyber security in critical industrial infrastructure. In: Nicholson, D. (ed.) Advances in Human Factors in Cybersecurity Advances in Intelligent Systems and Computing, vol. 501, pp. 267-277. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-41932-9_14

23. Prins, S., Marnewick, A., von Solms, S.: Cybersecurity awareness in an industrial control systems company. In: European Conference on Information Warfare and Security, ECCWS, 2020-June, pp. 314-323 (2020)