A longitudinal study on improving employee information protective knowledge and behaviors

Abstract

Research shows it is challenging to ensure that individuals use information protective behaviors (e.g., secure passwords, turning off tracking features), especially on smartphones. Concurrently, employees increasingly use their own devices for work (BYOD), but with limited compliance with BYOD policies. This research studies the role of knowledge in increasing employees’ use of information protective settings, and explores how exposure to security and privacy news can increase such knowledge. A 10-month field intervention with 826 corporate trainees who received daily newspapers covering privacy and security articles. Our findings show that it is possible to increase employee knowledge of security and privacy, and in turn positively affect their usage of information protective settings over time through repeated, perceived-to-be-mandatory information exposure. The study contributes to a better understanding of the importance of measuring actual knowledge in studies of employee behavioral actions towards protection of organizational information. The results suggest organizations need holistic employee compliance programs, where in addition to developing policies, as well as compliance testing and sanctions, they provide repeated information exposure.