Review Reports - Factors Affecting Information Security and the Implementation of Bring Your Own Device (BYOD) Programmes in the Kingdom of Saudi Arabia (KSA)

Round 1

Reviewer 1 Report (Previous Reviewer 1)

my all comments are addressed in updated version. I would recommend to accept in its present form.

Author Response

Dear Reviewer,

Thank you very much for giving us the opportunity to revise the manuscript. We would like to thank the editor and all the reviewers for their valuable comments and suggestions. Based on the feedback, we have revised our manuscript and updated the new version of our manuscript as well as responded to each point of the reviewers.

Regards,

Ahmed

Author Response File: Author Response.pdf

Reviewer 2 Report (Previous Reviewer 2)

Line numbering is in Arabic.

Using abbreviations in the title is a terrible practice.

Abbreviations are given in the text of the article several times (for example, "PT-Bs").

In some cases, the use of abbreviations is unnecessary (for example, AI) since the abbreviation is used only once in the following.

Figure 1 is titled before the figure. Figure 1 has unreadable inscriptions and text wrapping.

The first mention of Table 2 and its text are far from each other (the situation is similar for Table 3).

The titles of the fields in Table 3 require revision.

Table 5 can be aligned with the text block.

The accuracy of the values in Table 5 is different (for example, 50.3% and 49.71%). The percent sign should be placed in the column heading.

The data given in Table 5 is very doubtful since the sum of the percentages for each of the pairs exceeds 100%

86.94 + 13.07 = 100.01%

50.3 + 49.71 = 100.01%

38.98 + 61.06 = 100.04%

67.57 + 32.45 = 100.02%

It could be assumed that the sum may be less than 100% if the table did not indicate non-binary personalities or subjects for whom such parameters are difficult to determine.

The style of Table 6 differs from the rest, including the font size used.

The discussion section contains references to the authors' previous work, although such references are expected to be seen in the introduction.

The conclusions do not contain quantitative confirmation.

Author Response

Dear Reviewer,

Regards,

Ahmed

Author Response File: Author Response.pdf

Reviewer 3 Report (Previous Reviewer 4)

Almost all the comments that were made on the previous version of the article have been corrected.

The only note that remains uncorrected concerns Figure 5. In this figure, the vertical text inside the “Perceived Threats” block is hard to read. Also, the capture of the picture must be below the picture, not above the picture.

Author Response

Dear Reviewer,

Regards,

Ahmed

Author Response File: Author Response.pdf

Reviewer 4 Report (New Reviewer)

To deal the information security breaches and concerns, the authors has present study used quantitative measures to assess user acceptance of bring your device (BYOD) programmes and identifies the main factors affecting its adoption using the unified theory of acceptance and use of technology (UTAUT) model. Although paper is well written, presented and suitable for publication.

Authors should consider following technological development and include into manuscript.

- Deployment of IPv6, 5G communication technologies, and development of Multihoming devices based infrastructure which causes many security issues like DoS attacks, reconnaissance attacks, security monitoring etc. refer following manuscript.

1- G. Kumar & P. Tomar (2020) IPv6 Addressing Scheme with a Secured Duplicate Address Detection, IETE Journal of Research, DOI: 10.1080/03772063.2020.1756938 2- Shubair A. Abdullah, SEUI-64, bits an IPv6 addressing strategy to mitigate reconnaissance attacks, Engineering Science and Technology, an International Journal, Volume 22, Issue 2,2019, Pages 667-672. 3-Peng, M.; Li, Y.; Zhao, Z.; Wang, C. System architecture and key technologies for 5G heterogeneous cloud radio access networks. IEEE Netw. 2015, 29, 6–14. 4- Tomar, P.; Kumar, G.; Verma, L.P.; Sharma, V.K.; Kanellopoulos, D.; Rawat, S.S.; Alotaibi, Y. CMT-SCTP and MPTCP Multipath Transport Protocols: A Comprehensive Review. Electronics 2022, 11, 2384. https://doi.org/10.3390/electronics11152384 - In the introduction section authors should include organization of manuscript to make it easy readable. - clearly mention contributions of this study.

Author Response

Dear Reviewer,

Regards,

Ahmed

Author Response File: Author Response.pdf

Reviewer 5 Report (New Reviewer)

This paper employs quantitative measures to assess user acceptance of "Bring Your Device" (BYOD) programs and uses the Unified Theory of Technology Acceptance and Use (UTAUT) model to identify the main factors affecting their adoption. In order to provide the public, private and non-profit sectors with an acceptable method of adopting BYOD programs, the authors extend the UTAUT model by incorporating constructions like perceived business (PT-Bs), private threats (PT-Ps), and employer attractiveness (EA). As a tangible and representative case study, the factors affecting the adoption of BYOD programs in the public sector of the Kingdom of Saudi Arabia (KSA) are derived from the responses of 857 participants.

The research topic is very current, and the material is well-presented, easy to follow, and interesting. The theoretical framework and the methodology are described in detail and in a very systematic and structured way. The results are reported clearly and are sufficiently analyzed and interpreted. However, in my opinion, the authors should provide more information regarding how the sampling frame/target population and the potential respondents were identified and selected. In that way, complemented with the demographic data and the response rate, the readers can better assess if the sample of potential respondents was representative of the population. Moreover, the questionnaire should be provided in its entirety, either in an appendix or as a link to an external repository. The authors should elaborate more on how the items were generated and ultimately reduced to the questionnaire's final form, as well as comment on how the questionnaire was administered and the impact on the response and non-response bias. Finally, it might be meaningful to align specific questions with reported results.

Author Response

Dear Reviewer,

Regards,

Ahmed

Author Response File: Author Response.pdf

Round 2

Reviewer 2 Report (Previous Reviewer 2)

In Table 3, the data are repeated. Values should be aligned to the decimal point.

The footnotes in Tables 4 and 6 are oddly used (eg missing "*").

Author Response

Dear Reviewer,

Regards,

Ahmed

Author Response File: Author Response.pdf

This manuscript is a resubmission of an earlier submission. The following is a list of the peer review reports and author responses from that submission.

Round 1

Reviewer 1 Report

The authors outlined the study to assess users' acceptance in adopting a Bring Your Device (BYOD) strategy, and incorporated qualitative research together with the Unified Theory of Acceptance and Use of Technology (UTAUT) as the basis for aligning interview questions. I have some comments as well as questions related to the proposed study as follows:

1. What are the real gains from spreading the BYOD approach to the corporate sector that are related to spending efficiency? Do we consider the main objective of BYOD approach to be only rationalization of spending and flexibility, or are there more advantages? Please take this aspect into consideration as one of the main objectives of this study.

2. The basic criteria for building policies for the use of the BYOD approach as an important aspect in the development and advancement of companies were not addressed... Are there challenges faced by this aspect that it is preferable to mention and focus on in the discussion.

3. Table 1 is not cited in the regular text.

4. Despite the importance of safety-related factors in the BYOD approach, they were not addressed as a separate topic. It is preferable to work on including a separate topic within the manuscript.

5. Mention the author's contribution explicitly at the end of the introduction or in a separate section.

6. Authors need to proofread the paper as there are many grammatical mistakes in the manuscript.

Reviewer 2 Report

The article is interesting to read, but lacks coherence. The purpose and conclusions are not comparable. The hypotheses put forward in Table 1 were not further developed. The conclusions are abstract, the obtained numerical results are not reflected in any way.

In Figure 1, part of the text is cut off. The number of fonts is redundant.

The fields "Hypothesis" and "No. of Items" in Table 1 are not informative.

The numbering is very strange ("Table No. 2").

Torn headings from the main text interfere with the perception of the material.

The text of the publication requires additional revision (for example, commas before "and", dots in tables, section titles, for example, ".5.6. Exploratory Factor Analysis (EFA)"). The dash is used in different lengths.

Table 4 has footnotes, but they are missing from the text.

In Table 5, the rounding accuracy suffers, and therefore the sum of the groups exceeds 100%.

In Table 6, different column widths make it difficult to perceive information. And the note to the table is torn off to the next page.

Abbreviations are used inconsistently, such as "Bring Your Own Device" in the conclusions.

Reviewer 3 Report

My recommendation is to reject the submitted paper. The first reason is structural. The presentation should clarify at the very beginning (both in the Abstract and in the Introduction, maybe also in the title) that the paper is a report on a statistical survey which aims to explain user intentions to use a particular information system as well as subsequent usage behavior.

Stating the goal of the paper clearly helps the managing editor, who has to find a knowledgeable reviewer, the reviewer, who will know whether she can judge the merits of the paper or not, and the reader, who does not want to read five pages to find out that the relevant content is about something completely different.

Sections 1 (Introduction) and 2 (Literature Review) is almost exclusively about what BYOD is (in my opinion a single short paragraph suffices, see, e.g., the wikipedia article on BYOD). After a long and unnecessary discussion the applied model is presented in Section 3. It is also a mess. Very probably the word "defecation" in Table 1 is in error. The elements of the conceptual framework are depicted on Figure 1, the definition of notions, however, appear later in Table 1. How these concepts are measured should be spelled out explicitly, which is not done here. The seven hypotheses to be checked are also depicted in Table 1. Definitions and hypotheses are different things and should not be mixed. Each hypothesis should be spelled out independently and commented on, why is it important, what is it expected to explain, etc.

Section 4 should also refer to the English version of the final questionnaire (it is fine to put it in an Appendix). The authors should explicitly tell the statistical package used (I assume it was SPSS). Without these data the paper is not publishable.

All conclusions discussed in the paper must be supported by the best practice in statistics. Estimating the sample size in line 452 the authors should not refer to the working population as it is clearly bigger than 20,000. A more important question not touched in the paper is what the respondents represent? From the gender distribution it is clear that it is not representative. Why do the authors expect that, e.g., the answers to the PE questions are representative for the whole working force? In Table 2 the CR values should be bigger than 0.7 to justify the reliability scale.

Statistical results are presented in subsequent sections without stating how the conducted survey justified or contradicted the hypotheses. The paper should also contain a list of abbreviations, in particular CR, AVE, KSA appear without definitions.

For an acceptable structure the authors are encouraged to consult the MDPI paper:

Shi, Y.; Siddik, A.B.; Masukujjaman, M.; Zheng, G.; Hamayun, M.; Ibrahim, A.M. The Antecedents of Willingness to Adopt and Pay for the IoT in the Agricultural Industry: An Application of the UTAUT 2 Theory. Sustainability 2022, 14, 6640. https://doi.org/10.3390/su14116640

My second reason to reject the paper is its English usage. The paper should be completely rewritten to make it comprehensible. A typical example is in line 59: "The most important agenda item of G20 is to emphasize on digitalization, which aims to transform information into a computer-readable digital presentation, requiring the arrangement of data into bits." Or another sentence in lines 93-95: "Hence, it remains evident that BYOD guidelines have the capacity to present additional threats, thereby complicating the security governance for the information technology divisions that spearhead the current complex networks."

Let me finally remark that using USB drives at work is not considered to be part of BYOD.

Reviewer 4 Report

The article presents the results of a study conducted by the authors to analyze the possibility of implementing a BYOD approach in Saudi Arabia and to identify factors that affect the information security of this approach. The justification of the factors is made on the basis of statistical processing of a sufficiently large amount of data obtained through a questionnaire survey of different categories of employees of public, private and non-profit organizations.

The article is well readable. It contains a sufficient number of illustrations. The number of references is 73, among which more than 30 references were written in 2018 and later.

The work will undoubtedly be of interest to readers who deal with applied issues of information security and informatization of society (using Saudi Arabia as an example).

The disadvantages of the article should include the following points:

1. It is necessary to emphasize more clearly and set forth both in the Introduction and in the final sections of the article the conclusions and implications arising from the results of processing the collected data using the methods of mathematical statistics. Thus, in the Introduction there is no mention of the need to use methods of mathematical statistics. There is no mention of this in the Conclusion. This would allow the reader to better understand the scientific contribution of the article.

2. In Figure 1, add the text "Perceived Business" and make "Perceived Business Threats". You also need to make the vertical text in the adjacent rectangle readable. I think it says "Perceived threats."

3. There is no reference to Table 1 in the text. In addition, it should be clarified if there is an error in the title of the column "Defecation".

4. In Table 4, the last column "p-value" has "***" in all cells. It is not clear what this means. If it means "no data", then this column should be removed from the table, because all the values in the cells are the same. If this is a formatting error, it should be corrected and the cells should be filled with numerical values. Similar comments are true for Table 6.

5. The conclusion should end with the formulation of further research directions.

6. References in the reference list are formatted differently. They must conform to MDPI format requirements.

7. Professional editing of the text is needed. There are many typos and minor errors in the text. Here are some of them identified during the review:

- page 2: “Additionally is allows people in rural areas …” -> “In addition, it allows people in rural areas …”

- page 4: “The study have been implemented …” -> “The study has been implemented …”

- page 5: “The study concentrate for how to use …” -> “The study concentrates for how to use …”

- page 8: “… there are some example which are losing business data …” -> ““… there are some examples which are losing business data …”

- page 8: “It appears another important factors which related to company's perspective …” -> “Another important factor appears, which is related to the company's perspective”

- page 9: “… if the firm offers a BYOD services” -> ““… if the firm offers BYOD services”

- page 9: “… as well as it propos criteria …” -> “...as well as it proposes criteria …”

- page 10: “These questions is a personal device …” -> “These question is a personal device …”

- page 12: “.5.6. Exploratory Factor Analysis (EFA)” -> “5.6. Exploratory Factor Analysis (EFA)”

- page 15: “All of previous relationships are were significant” -> “All of previous relationships are very significant”

- page 17: “… one of the major challenge …” -> “… one of the major challenges …”

- page 18: “One of the main limitation …”- > “One of the main limitations …”

Reviewer 5 Report

I am sorry, but the current state of the presentation doesn't allow a real comprehension of the work.

The manuscript is full of half-baked sentences which require multiple passes to conjecture a meaning. Furthermore is highly redundant, at least in the introductory part. There are a lot of syntactic errors and semantic weirdness which make it unreadable.

A very deep rearrangement of the sections, complete rewording, and triple check of matching between text and lists/figures is needed.