Towards Cultivating a Global Cybersecurity Culture: A Multivocal Literature Review of Challenges and Practices

Global Cybersecurity Culture: Challenges and Practices

Abstract

Cybersecurity is a critical global concern that transcends national borders and requires coordinated responses. Cyber threats are becoming more frequent, sophisticated, and impactful. Existing research highlights that solutions that focus on technical, organizational, or individual aspects are insufficient to effectively secure cyberspace. In response, the development of Global Cybersecurity Culture (GCSC) has been recognized as a collective and long-term approach for mitigating the real-world impact of these cyber threats. However, limited studies have focused on how a GCSC can be developed and operationalized. In this study, we conducted a Multivocal Literature Review (MLR) to identify critical challenges and their associated practices that hinder the development of GCSC. This MLR was conducted following the established guidelines for MLR in Software Engineering research. A total of 39 primary studies, including both peer-reviewed and Grey Literature (GL) sources, were selected from an initial search of 3,549 literature sources. It identified 13 Critical Challenges, such as Lack of political consensus, the absence of international cyber law, digital sovereignty disputes, disputes over digital human rights, and lack of national cybersecurity capabilities. It also identified 41 associated practices to address these challenges. Furthermore, the identified challenges were clustered into four cultural layers including Knowledge, Tacit Assumptions, Espoused Values, and Artefacts, to provide a structured understanding of how they influence the development of GCSC. This research provides a basis for the development and operationalization of a GCSC by identifying its critical challenges and their associated practices. It also provides a foundation for future research and may inform the future development of maturity assessment models for GCSC.