Cybersecurity Risk Analysis on WhatsApp Application Using ISO/IEC 27001 Framework

Authors

  • Nining Ariati Program Studi Sistem Informasi, Universitas Indo Global Mandiri, Palembang, Sumatera Selatan, Indonesia https://orcid.org/0009-0001-4819-5906
  • Khalil Fikri Program Studi Sistem Informasi, Universitas Indo Global Mandiri, Palembang, Sumatera Selatan, Indonesia
  • Gathan Albani Program Studi Sistem Informasi, Universitas Indo Global Mandiri, Palembang, Sumatera Selatan, Indonesia
  • M. Erbi Agustian Program Studi Sistem Informasi, Universitas Indo Global Mandiri, Palembang, Sumatera Selatan, Indonesia
  • Mgs Andi Gantara Program Studi Sistem Informasi, Universitas Indo Global Mandiri, Palembang, Sumatera Selatan, Indonesia
  • Yovi Prayoga Program Studi Sistem Informasi, Universitas Indo Global Mandiri, Palembang, Sumatera Selatan, Indonesia

DOI:

https://doi.org/10.51903/qdy0wx11

Keywords:

Cybersecurity, WhatsApp, ISO/IEC27001, Information Security Awareness, Risk Analysis

Abstract

Cybersecurity threats continue to increase alongside the widespread use of digital communication applications such as WhatsApp in daily activities. This study aims to analyze cybersecurity risks associated with WhatsApp usage based on the ISO/IEC 27001 framework and to identify users’ security awareness regarding various threats that may affect information security. The research employed a descriptive quantitative method by collecting data through a Likert-scale questionnaire distributed to 70 active WhatsApp users. The collected data were analyzed using validity testing, reliability testing, and descriptive statistical analysis to evaluate users’ perceptions and security behaviors. The results indicate that the majority of respondents demonstrate a good level of cybersecurity awareness, particularly in protecting one-time password (OTP) codes, recognizing suspicious messages or links, and understanding the importance of personal data protection. The risk analysis identified several major threats that may compromise information security, including phishing attacks, OTP misuse, account hijacking, and personal data leakage. In addition, some users have not fully utilized additional security features such as two-step verification and privacy settings. Based on the security control principles of ISO/IEC 27001, improving cybersecurity literacy, optimizing the use of security features, and providing continuous user education can help reduce information security risks associated with WhatsApp usage. This study contributes to understanding user security awareness and provides recommendations for strengthening information protection against evolving cyber threats.

References

[1] A. C. Pamungkas, W. S. Hulu, and R. Samihardjo, “Information Security Risk Management Web-Based Final Semester Summative Assessment Application Using ISO,” vol. 6, no. 1, pp. 349–362, 2024, doi: 10.51519/journalisi.v6i1.668.

[2] A. Ramadhan and R. Pasla, “Pentingnya Keamanan Data Pribadi di Era Digital bagi Mahasiswa,” Pijarwiyata: Jurnal Pendidikan, vol. 1, no. 1, pp. 1–5, Jul. 2026, doi: 10.31004/JIRA.V1I1.1.

[3] E. Susanto and N. Legowo, “Hasil Penilaian Risiko Keamanan Informasi pada Laboratorium Klinik Berdasarkan Kriteria Kendali Dalam Penerapan ISO 27001,” vol. 12, no. 2, pp. 155–164, 2023.

[4] D. Nirwana, E. Nurjannah, C. Renta, A. Marpaung, and H. A. Wijaya, “Analisis Kebijakan Keamanan Cyber: Study Kasus Implementasi Perlindungan Data Pribadi Dalam Era Digital,” JIIP - Jurnal Ilmiah Ilmu Pendidikan, vol. 7, no. 7, pp. 7364–7373, Jul. 2024, doi: 10.54371/JIIP.V7I7.4790.

[5] A. Ferdinand, K. Naristi, R. Abdillah, S. D. Walujo, and L. Dica, “Pengukuran Manajemen Risiko Keamanan Aset Teknologi Informasi Menggunakan Metode FMEA dan Framework ISO 27001 : 2013 pada PT . ABC,” vol. 9, no. 1, pp. 23–33, 2024, doi: 10.33633/joins.v9i1.9059.

[6] A. I. Wijaya, D. I. Lestiani, Y. R. Damayanti, A. Ayu, P. Sugiono, and S. C. Huanggino, “Maturity Level Risk Assessment in Media Companies with ISO 27001 Framework,” vol. 3, no. 1, pp. 1–18, 2024, doi: 10.26740/jdbim.v3i1.59169.

[7] I. Fadilla, N. Sartika, and R. Bisma, “Perancangan Sistem Informasi Manajemen Risiko berdasarkan ISO 27001 : 2013 ( Sistem Manajemen Keamanan Informasi ),” vol. 02, no. 03, pp. 81–86, 2021.

[8] S. Aprianti, R. P. Sari, and I. Rusi, “Manajemen Risiko Keamanan Simbada Menggunakan Metode NIST SP 800-30 Revisi 1 dan Kontrol ISO / IEC 27001 : 2013,” vol. 14, no. April, pp. 50–59, 2023.

[9] H. Syahrial, “Prototype Information Security Risk Assessment Tool Berbasis Lotus Notes dalam Rangka Penerapan Sistem Manajemen Keamanan Informasi ISO 27001,” vol. 2014, no. November, pp. 8–14, 2014.

[10] H. Susanto, M. N. Almunawar, and Y. C. Tuan, “A Novel Method on ISO 27001 Reviews : ISMS Compliance Readiness Level Measurement,” vol. 2, no. 1, pp. 1–12, 2012.

[11] N. O. F. The and C. For, “Analysis of the user Acceptance for Implementing ISO/IEC 27001: 2005 In T Urkish,” pp. 1–12, 2005.

[12] G. D. Alencar, H. P. De Moura, I. Honório, and D. F. Júnior, “An Adaptable Maturity Strategy for Information Security,” vol. 13, pp. 1–12, 2018.

[13] B. S. Wibowo and R. F. Aji, “The Indonesian Journal of Computer Science,” vol. 13, no. 4, pp. 6398–6410, 2024.

[14] R. Ali, “Operationalising Information Security Management : A Procedural Framework Analysis of ISO / IEC Implementation in a Financial-Technology Organisation,” pp. 1–9, 2022.

[15] B. Cheung, “standard The ISO 27001 : 2022 certification process How KPMG can help Contact us,” 2025.

[16] A. C. Pamungkas, W. S. Hulu, and R. Samihardjo, “Information Security Risk Management Web-Based Final Semester Summative Assessment Application Using ISO,” vol. 6, no. 1, pp. 349–362, 2024, doi: 10.51519/journalisi.v6i1.668.

[17] H. Susanto, M. N. Almunawar, and Y. C. Tuan, “A Novel Method on ISO 27001 Reviews : ISMS Compliance Readiness Level Measurement,” vol. 2, no. 1, pp. 1–12, 2012.

[18] I. Fadilla, N. Sartika, and R. Bisma, “Perancangan Sistem Informasi Manajemen Risiko berdasarkan ISO 27001 : 2013 ( Sistem Manajemen Keamanan Informasi ),” vol. 02, no. 03, pp. 81–86, 2021.

[19] H. Susanto, M. N. Almunawar, and Y. C. Tuan, “A Novel Method on ISO 27001 Reviews : ISMS Compliance Readiness Level Measurement,” vol. 2, no. 1, pp. 1–12, 2012.

[20] R. Ali, “Operationalising Information Security Management : A Procedural Framework Analysis of ISO / IEC Implementation in a Financial-Technology Organisation,” pp. 1–9, 2022.

[21] A. C. Pamungkas, W. S. Hulu, and R. Samihardjo, “Information Security Risk Management Web-Based Final Semester Summative Assessment Application Using ISO,” vol. 6, no. 1, pp. 349–362, 2024, doi: 10.51519/journalisi.v6i1.668.

[22] E. Susanto and N. Legowo, “Hasil Penilaian Risiko Keamanan Informasi pada Laboratorium Klinik Berdasarkan Kriteria Kendali Dalam Penerapan ISO 27001,” vol. 12, no. 2, pp. 155–164, 2023.

[23] A. I. Wijaya, D. I. Lestiani, Y. R. Damayanti, A. Ayu, P. Sugiono, and S. C. Huanggino, “Maturity Level Risk Assessment in Media Companies with ISO 27001 Framework,” vol. 3, no. 1, pp. 1–18, 2024, doi: 10.26740/jdbim.v3i1.59169.

[24] B. Cheung, “standard The ISO 27001 : 2022 certification process How KPMG can help Contact us,” 2025.

[25] G. F. Michelle, N. Modami, E. E. R. Manopo, M. R. Kurniawan, D. R. Enditama, and A. T. Ayunda, “Information Security Evaluation Based on KAMI Index 5.0 (2023) at PT X,” Jurnal Ilmiah Sistem Informasi, vol. 5, no. 2, pp. 68–77, Jan. 2026, doi: 10.51903/ETG50932.

[26] M. Izzani, N. Nellatul, A. Ismatul, and A. Hamdani, “Evaluasi penerapan Kemanan Informasi Pada SIAKAD Universitas Ibrahimy Berbasis ISO/IEC 27001:2022,” Jurnal Ilmiah Sistem Informasi, vol. 5, no. 1, pp. 175–185, Jan. 2026, doi: 10.51903/D3BKTM29.

[27] D. A. Pratama, I. H. Santi, and F. Febrinita, “Android-Based Tourism Geographic Information System For Blitar Raya Utilizing Google Maps API and Kotlin,” Jurnal Ilmiah Sistem Informasi, vol. 5, no. 2, pp. 284–305, Apr. 2026, doi: 10.51903/CWE5DE68.

Downloads

Published

2026-10-28

Issue

Vol. 5 No. 3 (2026): November

Section

Information Systems Security and Information Retrieval

License

Copyright (c) 2026 Nining Ariati, Khalil Fikri, Gathan Albani, M. Erbi Agustian, Mgs Andi Gantara, Yovi Prayoga

Creative Commons License

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

All articles published in this journal are open access and licensed under the terms of the Creative Commons Attribution-ShareAlike 4.0 International License (CC BY-SA 4.0).

Under this license:

  • Authors retain copyright of their work.

  • Others are free to:

    • Share — copy and redistribute the material in any medium or format;

    • Adapt — remix, transform, and build upon the material for any purpose, even commercially;

  • As long as they:

    • Give appropriate credit to the original author(s) and the source;

    • Provide a link to the license;

    • Indicate if changes were made;

    • Distribute their contributions under the same license as the original.

This ensures that derivative works will also remain free and open under the same terms.