Developing a Cyber Trust Model for Strengthening Cybersecurity in Malaysia's Digital Economy: A Qualitative Theory-Building Study
DOI:
https://doi.org/10.24191/140tsf68Keywords:
Digital Trust; Cybersecurity; Digital Economy; Qualitative Research; Thematic Analysis; Cyber Trust ModelAbstract
Malaysia's digital economy is booming, and with it the number and severity of cyber threats facing organizations are increasing and becoming more complex. However, much of the current literature still predominantly views cybersecurity in a technological fashion, largely by considering individual tools and controls, rather than the institutional context in which resilience is developed. Yet little is known about digital trust as a structural enabler of digital resilience, as opposed to simply a consequence of sound security practices, and as a component that influences the design and maintenance of digital resilience. This study aims to fill this gap by creating a Cybersecurity Trust Model that identifies the factors that influence the cybersecurity resilience and digital trust level of the digital business ecosystem in Malaysia. This research is done in a qualitative manner, using semi-structured interviews to collect data from ten cyber security practitioners, who were purposively selected from three areas: public sector governance, Critical National Information Infrastructure (CNII) and private industry. The analysis of interview data focused on a thematic approach to identify the dimensions of institutional trust. The above analysis led to the identification of four interrelated socio-technical dimensions: Emerging cybersecurity challenges, Governance and organizational capability, Technological protection mechanisms, and Antecedents of digital trust. The results show that, as a whole, systemic resilience is dependent on the combined effect of a number of factors: adaptive leadership, continuous risk modelling, regulatory compliance, capability development of the workforce and transparency towards stakeholders, and not just on a single intervention. This work builds on the above and proposes a Cybersecurity Trust Model that merges the technical security safeguards with the behavioral and governance mechanisms that enable them, providing a more comprehensive picture of what enables digital trust in practice. The study provides an empirical basis for cybersecurity resilience at a system-wide level in Malaysia and provides a tangible point of reference for cybersecurity policy makers, CISOs and digital entrepreneurs to assist in supporting long-term Malaysian digital transformation.
References
Alshaikh, M., Maynard, S. B., Ahmad, A., & Chang, S. (2022). Understanding cybersecurity culture and governance: A systematic literature review. Computers & Security, 113, 102551. https://doi.org/10.1016/j.cose.2021.102551
Bada, M., Sasse, A. M., & Nurse, J. R. C. (2019). Cyber security awareness campaigns: Why do they fail to change behaviour? arXiv. https://doi.org/10.48550/arXiv.1901.02672
Bostrom, R. P., & Heinen, J. S. (1977). MIS problems and failures: A socio-technical perspective. MIS Quarterly, 1(3), 17–32. https://doi.org/10.2307/248710
Braun, V., & Clarke, V. (2022). Thematic analysis: A practical guide. SAGE Publications.
Casino, F., Dasaklis, T. K., & Patsakis, C. (2019). A systematic literature review of blockchain-based applications: Current status, classification and open issues. Telematics and Informatics, 36, 55–81.
https://doi.org/10.1016/j.tele.2018.11.006
Confente, I., Siciliano, G. G., Gaudenzi, B., & Eickhoff, M. (2023). Digital trust and consumer behavior in the digital economy: A systematic literature review. Journal of Business Research, 157, 113584. https://doi.org/10.1016/j.jbusres.2022.113584
Creswell, J. W., & Poth, C. N. (2018). Qualitative inquiry and research design: Choosing among five approaches (4th ed.). SAGE Publications.
CyberSecurity Malaysia. (2024). Cyber security outlook 2024. CyberSecurity Malaysia.
Deloitte. (2023). Digital trust: The foundation of customer relationships. Deloitte Insights.
Dhillon, G., Syed, R., & de Sá-Soares, F. (2021). Information security concerns in information systems research: An agenda for future research. Information Systems Journal, 31(3), 513–552. https://doi.org/10.1111/isj.12367
Economic Planning Unit. (2021). Twelfth Malaysia Plan, 2021–2025. Prime Minister's Department, Malaysia.
Eisenhardt, K. M., & Graebner, M. E. (2007). Theory building from cases: Opportunities and challenges. Academy of Management Journal, 50(1), 25–32. https://doi.org/10.5465/amj.2007.24160888
Friese, S. (2023). Qualitative data analysis with ATLAS.ti (5th ed.). SAGE Publications.
Gefen, D., Karahanna, E., & Straub, D. W. (2003). Trust and TAM in online shopping: An integrated model. MIS Quarterly, 27(1), 51–90. https://doi.org/10.2307/30036519
IBM Security. (2024). Cost of a data breach report 2024. IBM Corporation.
International Organization for Standardization. (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection—Information security management systems—Requirements. ISO.
Kallio, H., Pietilä, A.-M., Johnson, M., & Kangasniemi, M. (2016). Systematic methodological review: Developing a framework for a qualitative semi-structured interview guide. Journal of Advanced Nursing, 72(12), 2954–2965. https://doi.org/10.1111/jan.13031
Lincoln, Y. S., & Guba, E. G. (1985). Naturalistic inquiry. SAGE Publications.
Malaysia Digital Economy Corporation. (2021). Malaysia Digital Economy Blueprint (MyDIGITAL).
Mayer, R. C., Davis, J. H., & Schoorman, F. D. (1995). An integrative model of organizational trust. Academy of Management Review, 20(3), 709–734. https://doi.org/10.2307/258792
McKnight, D. H., Choudhury, V., & Kacmar, C. (2002). Developing and validating trust measures for e-commerce: An integrative typology. Information Systems Research, 13(3), 334–359. https://doi.org/10.1287/isre.13.3.334.81
Myers, M. D. (2020). Qualitative research in business and management (3rd ed.). SAGE Publications.
National Institute of Standards and Technology. (2020). Zero Trust Architecture (Special Publication 800-207). U.S. Department of Commerce.
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0. U.S. Department of Commerce.
Organisation for Economic Co-operation and Development. (2024). Building digital trust for a resilient digital economy. OECD Publishing.
Patton, M. Q. (2015). Qualitative research & evaluation methods (4th ed.). SAGE Publications.
Polit, D. F., & Beck, C. T. (2006). The Content Validity Index: Are you sure you know what's being reported? Critique and recommendations. Research in
Nursing & Health, 29(5), 489–497. https://doi.org/10.1002/nur.20147
Ponemon Institute. (2024). Cost of cyber crime study 2024. Ponemon Institute.
Rahim, N. A., et al. (2022). AI-based chatbots adoption model for higher-education institutions: A hybrid PLS-SEM-neural network modelling approach. Sustainability, 14(19), 12726.
Saunders, B., Sim, J., Kingstone, T., Baker, S., Waterfield, J., Bartlam, B.,
Burroughs, H., & Jinks, C. (2018). Saturation in qualitative research: Exploring its conceptualization and operationalization. Quality & Quantity, 52(4), 1893–1907. https://doi.org/10.1007/s11135-017-0574-8
Siponen, M., & Vance, A. (2010). Neutralization: New insights into the problem of employee information systems security policy violations. MIS Quarterly, 34(3), 487–502.
Taherdoost, H. (2022). Understanding cybersecurity frameworks and information security standards: A review. Information, 13(9), 430. https://doi.org/10.3390/info13090430
United Nations. (2024). United Nations E-Government Survey 2024: Accelerating digital transformation for sustainable development. United Nations.
Venkatesh, V., Morris, M. G., Davis, G. B., & Davis, F. D. (2003). User acceptance of information technology: Toward a unified view. MIS Quarterly, 27(3), 425–478. https://doi.org/10.2307/30036540
Verhoef, P. C., Broekhuizen, T., Bart, Y., Bhattacharya, A., Dong, J. Q., Fabian, N., & Haenlein, M. (2021). Digital transformation: A multidisciplinary reflection and research agenda. Journal of Business Research, 122, 889–901. https://doi.org/10.1016/j.jbusres.2019.09.022
Vial, G. (2019). Understanding digital transformation: A review and a research agenda. The Journal of Strategic Information Systems, 28(2), 118–144. https://doi.org/10.1016/j.jsis.2019.01.003
von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97–102. https://doi.org/10.1016/j.cose.2013.04.004
Whetten, D. A. (1989). What constitutes a theoretical contribution? Academy of Management Review, 14(4), 490–495. https://doi.org/10.5465/amr.1989.4308371
World Bank. (2021). World Development Report 2021: Data for better lives. World Bank. https://doi.org/10.1596/978-1-4648-1600-0
World Economic Forum. (2024). Global Cybersecurity Outlook 2024. World Economic Forum.
Yusoff, M. S. B. (2019). ABC of Content Validation and Content Validity Index calculation. Education in Medicine Journal, 11(2), 49–54. https://doi.org/10.21315/eimj2019.11.2.6
Zheng, Z., Xie, S., Dai, H., Chen, X., & Wang, H. (2018). Blockchain challenges and opportunities: A survey. International Journal of Web and Grid Services, 14(4), 352–375. https://doi.org/10.1504/IJWGS.2018.095647
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Aumuhaimi Yusuf, Muhammad Khairul Nizam Zaini, Irni Eliana Khairuddin
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
Copyright of articles that appear in the journal belongs exclusively to Faculty of Information Science, Universiti Teknologi MARA (Publisher). This copyright covers the rights to reproduce the article, including reprints, electronic reproductions or any other reproductions of similar nature.
