Information security awareness of personnel working in public institutions in it department: Bilecik province example

Today, the rapid development of information and communication technologies has increased the dependency of individuals and institutions on digital systems, making the provision of information security critical. Public institutions, in particular, should adopt more meticulous approaches to information security due to their responsibility to protect sensitive and critical data. Information processing units play a critical role in managing the digital infrastructure of public institutions and carry important responsibilities in tasks such as protecting sensitive data and ensuring system security. This research aims to examine the information security awareness of information processing employees working in public institutions. In the quantitative part of the research, information security awareness and its sub-dimensions, attack-threats and protection of personal data were evaluated in terms of variables such as gender, education received in the last 12 months, professional experience and job title. While the information security awareness and attack-threat levels of men were found to be significantly higher than women in terms of gender, no significant difference was found in the protection of personal data sub-dimension. It was observed that those who received information security training in the last 12 months had higher scores in information security awareness and both sub-dimensions compared to those who did not, and this difference was statistically significant. As the professional experience period increases, a significant increase was found in both information security awareness and the sub-dimensions of attacks-threats and protection of personal data. It was found that as the information security awareness of the personnel increases, levels of attack-threats and protection of personal data and their sub-dimensions also increase significantly, and there is a significant relationship between these two sub-dimensions. It was observed that the levels of protection of personal data increase in parallel with the increase in the attack-threat levels. These findings show that information security awareness is effective on its sub-dimensions along with demographic and occupational factors. It was determined that the information security awareness and awareness of attacks and threats of IT technical personnel are significantly higher compared to office and support personnel. However, the fact that there is no significant difference between the job titles regarding the protection of personal data indicates that all personnel groups have similar awareness on this issue. Three main themes were discovered in the qualitative part of the research: risk management, data and information management, and information security awareness. It has been revealed that the factors that directly affect the efficiency of risk management processes in public institutions are budget insufficiency, lack of human resources, sanction uncertainties in legislation and regulations, and the centralized institutional structure have a direct impact on information security management.