Cybersecurity Behavior Research Articles

Exploring the influence of government social media on cybersecurity compliance: employee attitudes, motivation and behaviors

PurposeThis study aims to investigate the impact of employees’ engagement in government social media (GSM) on their cybersecurity compliance attitude, protection motivation and protective behavior, thereby contributing to effective cybersecurity practices at organizations.Design/methodology/approachA quantitative cross-sectional field survey was conducted to collect primary data in big cities and large provinces in Vietnam. The final data set of 323 responses was analyzed using the partial least squares-structural equation modeling approach to interpret the results and test research hypotheses.FindingsEngagement in GSM positively influences employees’ cybersecurity compliance attitude (ATT). Perceived threat vulnerability and response efficacy also contribute to a positive compliance attitude, although self-efficacy has a negative impact. Moreover, the cybersecurity compliance ATT significantly explains the information protection motivation, which in turn influences employee protective behaviors. However, the relationship between compliance attitude and protective behaviors is weak, unlike previous studies that found a strong correlation.Originality/valueAlthough recent studies have explored specific information security practices in corporate and home contexts, the influence of GSM on individuals’ cybersecurity behaviors has received limited attention because of its novelty. This study contributes to the existing body of knowledge by investigating the impact of GSM on cybersecurity behaviors. This study provides significant contributions to understanding social media’s effects of social media on individuals’ cultivation processes, by expanding upon the protective motivation theory and cultivation theory. The results lead to practical suggestions for organizational managers and policymakers so that they can enhance their understanding of the importance of cybersecurity, encourage the implementation of self-defense strategies and highlight the significance of threat and coping evaluations in influencing attitudes and motivations.

A systematic review of current cybersecurity training methods

Cybersecurity continues to be a growing issue, with cyberattacks causing financial losses and loss of productivity and reputation. Especially in an organisational setting, end-user behaviour plays an essential role in achieving a high level of cybersecurity. One way to improve end-user cybersecurity behaviour is through comprehensive training programmes.There are many contradictory statements and findings with regard to the optimal way to conduct a behavioural cybersecurity training. We conducted a systematic review to create a comprehensive overview of the methods used in cybersecurity training and their effectiveness in improving organisational cybersecurity behaviours. Web of Science, ACM Digital Library, ProQuest, PubMed and PsycINFO were searched and 16,771 papers were identified. After title, abstract and full text screenings were conducted, 142 relevant papers were included in our analysis.The analysis shows that the majority of studies report positive effects of training, regardless of the cybersecurity topic that was addressed or the training method that was employed. Game-based training methods were used most often. Most studies used a non-experimental design to test effectiveness, with pretest-posttest designs being the most frequent. Sample sizes were often small and many interventions were not tested on employees but other populations. Further findings with regard to intervention design, characteristics and evaluation are discussed.

Design of a conceptual framework for cybersecurity culture amongst online banking users in Nigeria

This study aims to construct a comprehensive conceptual framework that elucidates the critical human factors influencing cybersecurity culture among online banking users in Nigeria. The research methodology is grounded in a meticulous examination of existing literature in the cybersecurity culture domain, serving as the foundation for this framework. The literature review reveals a conspicuous absence of academic research on cybersecurity culture within Nigeria and underscores the importance of comprehending its unique nuances. Key findings from the literature review highlight the prominence of “cybersecurity awareness,” “cybersecurity policy,” and “cybersecurity education” as influential factors. “Cybersecurity awareness” emerges as the most pivotal factor due to its recurrent emphasis and recognized centrality. “Cybersecurity policy” and “cybersecurity education” secure the second and third positions, respectively, due to their acknowledged significance in cultivating a security-conscious mindset among online banking users. Furthermore, the literature review exposes a research gap concerning the requisite “cybersecurity knowledge” that should permeate organizations and individuals to augment cybersecurity culture. Additionally, it reveals the underexplored influence of “social norms” and “interpersonal trust” in molding cybersecurity culture. This research accentuates the dearth of cybersecurity culture research within Nigeria and underscores the importance of understanding its unique facets. The proposed conceptual framework provides a valuable resource for designing tailored cybersecurity strategies and programs in Nigeria’s online banking sector. It advocates for prioritizing cybersecurity awareness, education, and policy, empowering users with the knowledge and skills needed to safeguard themselves against cyber threats. The model also highlights the relevance of recognizing the role played by social dynamics, interpersonal trust, and social norms in shaping cybersecurity behaviours.

Personality Types and Ransomware Victimisation

Ransomware remains one of the most prevalent cyberthreats to individuals and businesses alike. Psychological techniques are often employed by attackers when infecting victims’ devices with ransomware in an attempt to increase the likelihood of the victims paying the ransom demand. At the same time, cybersecurity researchers are continually putting in effort to find new ways to prevent ransomware infections and victimisation from happening. Since employees and contractors are often considered to be the most frequent and well-known attack vectors, it makes sense to focus on them. Identifying factors to predict the most vulnerable population to cyberattacks can be useful in preventing or mitigating the impact of ransomware attacks. Additionally, understanding victims’ psychological traits can help us devise better solutions to recover from the attack more effectively, while at the same time, encouraging victims not to pay the ransom demand to cybercriminals. In this article, we investigated the relationship between personality types and ransomware victimisation to understand whether people with certain personality types would be more prone to becoming a ransomware victim. We also studied the behavioural and psychological effects of becoming a ransomware victim in an attempt to see whether such an experience can be used to reinforce positive cybersecurity behaviours in the future. We carried out a survey involving 880 participants, recruited through the Prolific online survey platform. First, these participants were asked to answer a set of standard questions to determine their personality type, using the Big-Five personality trait indicators. They were then asked to answer several follow-up questions regarding victimisation, as well as their feelings and views post-victimisation. We found that 9.55% ( n = 84) of the participants had been a victim of ransomware. Of these, 2.38% ( n = 2) were found to have paid the ransom. We found no compelling evidence to suggest that personality traits would influence ransomware victimisation. In other words, there are no discernible differences regarding potential ransomware victimisation based on people’s personality types alone. Therefore, we should not blame victims for falling prey—in particular, we should not apportion the blame to their personality type. These findings can be used to improve positive cybersecurity behaviours, for example, by encouraging victims to invest more in cybersecurity products and tools. Additionally, our results showed that the aftermath of a ransomware attack could be quite devastating and hard to deal with for many victims. Finally, our research shows that properly dealing with ransomware is a complex socio-technical challenge that requires both technical and psychological support.

The need for game-based learning methods to address cyber threats

Cyber security threats are increasingly a serious concern to organisations, with an annual worldwide cost of a trillion dollars in 2021. Potentially the most significant contributor to cyber security threats is the human element, yet this has typically been insufficiently addressed in proposed solutions. Significant resources have been allocated to software, training and other solutions designed to tackle this threat, yet existing methods to improve cyber security have failed to deliver the desired results. Commonly cited issues include the lack of engagement in training, leading to disinterest and a ‘one size fits all’ approach, meaning some groups benefit from training more than others. This study will examine the need for game-based training methods in addressing cyber security threats caused by human error. Game-based training methods have previously been proposed to improve engagement in training and this study will discuss other potential benefits of game-based training. The aim of this work is to justify the use of game-based training methods in cyber security and begin to determine which aspects of games may be most effective at causing long-term positive behaviour change. Following an extensive literature review, a pilot study was run in which a survey was presented to 37 individuals who have taken cyber security training in the past, to query opinions and perceptions regarding cyber security training participants had previously taken, and how they feel they would behave when faced with certain cyber security threats. Upon analysis in SPSS, the results of this work indicate that factors such as training frequency and exposure to cyber security attacks have a significant impact on cyber security behaviour. A correlation between engaging training and impact of training on behaviour also serves to justify the development of such training methods. When combined with previous results on cyber security training this highlights the need for training to be engaging, regular, and relevant, and shows that the realistic simulation of cyber security threats (such as in game-based training) is of significant benefit. These results will help inform future development of effective game-based training methods and encourage their use more widely.

Computer Games as a Pedagogical Tool for Creating Cyber Security Awareness

Cyberattacks are increasing world-wide, both on corporate networks and public institutions network. During 2022 hackers were widening their aim to target business collaboration tools such as Slack, Teams, OneDrive, and Google Drive with phishing exploits, making for a rich harvest of sensitive data given that most organizations’ employees continued to work remotely. In the later years we have also seen academic institutions becoming more frequent targets for both cybercriminals and state sponsored hackers. In 2022 the education/research sector was most attacked industry globally, seeing a 43% increase compared to 2021, with an average of 2,314 attacks per organisation every week. Schools and universities have the unique challenge of dealing with children or young adults, many of which use their own devices, work from shared locations, and often connect to public Wi-Fi without thinking of the security concerns. Additionally, Russia’s war on Ukraine has led to an increase in spear-phishing activity targeting educational institutions in NATO countries. This situation calls attention to the need for awareness raising about personal cyber security. In Norway, Nord University is one of a few universities with specific focus on security and preparedness, including cyber security awareness. The university has two information security courses: one belonging to furthering education and one within the MBA-study program in Security and Preparedness Management. This paper examines the question whether serious games and online quizzes can create heighten cyber security awareness and motivate individual students to change their cyber security behaviour. The paper reports on the findings based on written reflection notes from students belonging to both courses. The technique of examination and interpretation applied to the data was qualitative thematic content analysis supported by computer-assisted qualitative data analysis software NVivo. Theoretical analysis was guided by social constructionist perspective on knowledge creation. While many advantages of the use of online quizzes and computer games were specified by students, challenges were identified as well. However, the findings show that the use of serious games and online quizzes can be an efficient approach to raising security awareness among participating students.

First Steps to Improve Cybersecurity Behaviour – a Virtual Reality Experience

Internet is completely integrated and absorbed in our life. Facilitating transfer of files across the world or wiring money from the couch, we could not imagine a world without it anymore. With these benefits, as with any new technology, there is also the introduction of risks and threats, for internet primarily in the form of cybercrime and online fraud. To reduce victimisation of this cybercrime, interventions are used to teach people to not perform risky behaviour. To overcome criticisms of current training materials, such as being tedious and boring, we created an Immersive Virtual Reality experience. By using a 4-step design process (i.e. ideation, specification, realisation, and evaluation), we designed a playful VR environment with simplistic non player characters to train the user to perform basic cybersecurity tasks in the right way. In the simulation, the participants are exposed to the challenge of creating a new password and a potential ransomware attack using USB storage device. The program allows for monitoring the user’s cybersecurity knowledge and behaviour and provides feedback. An evaluation of the VR environment among 16 respondents using a pretest-posttest evaluation with the Human Aspect Information Security Questionnaire (HAIS-Q) showed a statistically significant increase in scores after exposure to the VR environment. The system showed an above average SUS score. These initial findings indicate that a VR environment can be an alternative to consider for future development of cybersecurity interventions. Future research could expand our social VR environment with additional cybersecurity challenges, real-time actors, and running simulations among a broader audience to also investigate the retention of knowledge and skills.

Mitigating the Impact of Work Overload on Cybersecurity Behavior: The Moderating Influence of Corporate Ethics—A Mediated Moderation Analysis

This present study examines how work overload affects cybersecurity behavior, considering job stress as a mediator and corporate ethics as a moderator. Using a time-lagged survey design, 377 South Korean employees were surveyed. The results of SEM analysis (structural equation model) show that work overload leads to higher job stress, which in turn worsens cybersecurity behavior. High levels of corporate ethics buffer this negative relationship. This research fill gaps in the existing literature by linking work overload, job stress, and corporate ethics to cybersecurity behavior, offering valuable insights for both theory and practice. Future research directions are also discussed.

Working conditions and cybersecurity: Time pressure, autonomy and threat appraisal shaping employees’ security behavior

With the increasing importance of cybersecurity in organizations, it becomes crucial that employees behave securely. In the present article, we investigate the interplay of antecedents on this behavior. We conceptualize cybersecurity behavior through the components of compliance and participation and investigate the relationship between security knowledge, threat appraisal (i.e., severity and susceptibility), and working conditions (i.e., time pressure, decision-making autonomy). We conducted an online survey in four public organizations, collecting quantitative cross-sectional data from 214 employees. The survey captured subjective perceptions of the concepts. Findings showed a positive effect of security knowledge on security compliance and security participation. The perception of severity and susceptibility strengthened both effects. Additionally, the presence of time pressure reduced the effect of security knowledge on security compliance, while having decision-making autonomy increased the effect of security knowledge on security participation. Our study demonstrates the interplay between antecedents and highlights the role of working conditions in employees’ cybersecurity behavior. Implications for practice in terms of training approaches considering work design are discussed.

Understanding Cybersecurity Behavior in the Banking Industry Using Protection Motivation Theory

The widespread adoption of digital technology has brought about significant transformations in various industries, including banking, where internet-based applications are used extensively for customer transactions. However, along with these advancements, there has been a parallel increase in cybercrime incidents, posing serious challenges for individuals and organizations. In Indonesia, this issue is particularly pronounced, with the country ranking as the eighth globally and the highest in Southeast Asia for the number of data breaches in 2022 (Dihni, 2022). Among the various forms of cybercrime, online fraud, such as phishing scams targeting banking customers, has become increasingly prevalent, leading to substantial financial losses (CNN Indonesia, 2022). In response to this alarming trend, regulatory bodies in Indonesia, including the Financial Services Authority and the Indonesian Central Bank, have devised a roadmap to strengthen IT security systems and mitigate cyber risks in the banking sector. While measures have been implemented to counter cybercrime risks, the perception of users regarding these threats often goes unnoticed. Previous research has primarily focused on individual awareness of cybercrime threats, overlooking the influence of perceived knowledge and protection habits on cybersecurity behavior (Shappie et al., 2019; Kimpe et al., 2021; Zwilling et al., 2022). Keywords: Cybersecurity behaviour, Mobile banking, Perceived knowledge, Protection habit, Protection Motivation Theory (PMT)

The Role of Decision-Making Styles in Shaping Cybersecurity Compliance Behavior

The growing number of attacks on crucial cyber networks is one of humanity’s most significant security threats. Combining technological solutions with the convenient cybersecurity behavior of the human factor is necessary to reduce the effects of these attacks. In this study, the impact of individual decision-making styles on cybersecurity compliance behavior was examined. A conceptual framework was developed based on the protective motivation theory, and it was tested with a data set representing the survey results of 668 employees and students with work experience. Regression analyses were performed to evaluate the impacts of individuals’ decision-making styles on cybersecurity compliance behaviors. Results showed that the decision-making styles of individuals affected their cybersecurity compliance behaviors, and these effects showed significant differences according to their decision-making styles. The study also confirmed that security awareness was another important indicator of cybersecurity compliance behavior. Our research provided new insight into the effects of individual decision-making styles on cybersecurity compliance behavior.

Citizen-centric cybersecurity model for promoting good cybersecurity behaviour

ABSTRACT The ultimate success of cybersecurity partly depends on good behaviours by Internet users. However, good cybersecurity behaviour is a major challenge among citizens because they lack cybersecurity knowledge in the use of the Internet and digital devices and generally, there is a misalignment between attitudes and behaviour of people which creates bristly tension in cyberspace. In an endeavour to promote cybersecurity behaviour, attitudes and behaviour of Internet users should be combined with knowledge. This study builds from the Protection Motivation Theory (PMT) to feed into the development of a citizen-centric cybersecurity model for promoting good cybersecurity behaviour. The theory assumes that threat appraisals and coping appraisals are the two foundational mechanisms underlying behavioural actions when individuals are faced with threatening events; hence, it provided a solid foundation for the conceptual model of the study. The model was tested on data collected from 464 participants. Each of the three independent latent variables (Attitude, Behavioral Intention and Cybersecurity Knowledge) has a P-value less than 0.05 in our situation, indicating that each of the independent latent factors affects Behavior. The findings of this study make a significant contribution both to theory and practice to implement a citizen-centric cybersecurity model.

Smart home cybersecurity awareness and behavioral incentives

PurposeSmart-home security involves multilayered security challenges related to smart-home devices, networks, mobile applications, cloud servers and users. However, very few studies focus on smart-home users. This paper aims to fill this gap by investigating the potential interests of adult smart-home users in cybersecurity awareness training and nonfinancial rewards that may encourage them to adopt sound cybersecurity practices.Design/methodology/approachA total of 423 smart-home users between the ages of 25 and 64 completed a survey questionnaire for this study, with 224 participants from Japan and 199 from the UK.FindingsCultural factors considerably influence adult smart-home users’ attitudes toward cybersecurity. Specifically, cultural differences impact their willingness to participate in cybersecurity awareness training, their views on the importance of cybersecurity training for children and senior citizens and their preference for nonfinancial rewards as an incentive for good cybersecurity behavior. These results highlight the need to consider cultural differences and their potential impact when developing and implementing cybersecurity programs that target smart-home users.Practical implicationsThis research has two main implications. First, it provides insights for information security professionals on the importance of designing cost-effective and time-efficient cybersecurity awareness training programs for smart-home users. Second, the findings may assist governments in establishing nonfinancial incentives to encourage greater uptake of cybersecurity practices among smart-home users.Originality/valueThe paper investigates whether adult smart-home users are willing to spend time and money to engage in cybersecurity awareness training and to encourage their children and elderly parents to participate in training, as well. In addition, the paper examines incentives, especially nonfinancial rewards, that may motivate adult smart-home users to adopt cybersecurity behaviors at home. Furthermore, the paper analyses demographic differences among smart-home users in Japan and the UK.

A Quadruple “E” Approach for Effective Cyber-Hygiene Behaviour and Attitude toward Online Learning among Higher-Education Students in Saudi Arabia amid COVID-19 Pandemic

The spread of SARS-CoV-2 (COVID-19) has made online learning more common worldwide than ever before. However, recent research showed that higher-education students in the Kingdom of Saudi Arabia (KSA) were exposed to cyber threats and attacks during online learning that affected their attitudes toward online learning, despite a high level of cybersecurity infrastructure and digital capabilities in KSA universities. There were several calls for enhancing higher-education students’ cyber-hygiene awareness to improve their cybersecurity behaviours, develop healthy cyber-hygiene habits, and ensure positive attitudes toward online learning amid COVID-19. The current research developed an integrated cyber-hygiene model for improving this behaviour entitled the quadruple “E” approach (QEA), which includes four stages: educate (E1), explore (E2), execute (E3), and evaluate (E4). The research compares students’ cyber-hygiene behaviour and attitude toward online learning pre- and post-implementation of QEA. A sample of 446 bachelor students distributed between females and males in four public KSA universities was adopted during the academic year 2021. The results showed statistically significant differences in students’ cyber-hygiene behaviour and attitude toward online learning pre- and post-adoption of the QEA. Students showed more positive cyber-hygiene behaviour and attitudes toward online learning post-QEA adoption than pre-QEA implementation. In addition, female students have more positive behaviour and attitudes than their male counterparts post the adoption of QEA. The current research stimulates positive cyber-hygiene behaviour and enhances attitudes toward online learning in universities, which have implications for the sustainability of KSA higher education, particularly in relation to SDGs 4 and 10.

Exploring the Frontiers of Cybersecurity Behavior: A Systematic Review of Studies and Theories

Cybersecurity procedures and policies are prevalent countermeasures for protecting organizations from cybercrimes and security incidents. Without considering human behaviors, implementing these countermeasures will remain useless. Cybersecurity behavior has gained much attention in recent years. However, a systematic review that provides extensive insights into cybersecurity behavior through different technologies and services and covers various directions in large-scale research remains lacking. Therefore, this study retrieved and analyzed 2210 articles published on cybersecurity behavior. The retrieved articles were then thoroughly examined to meet the inclusion and exclusion criteria, in which 39 studies published between 2012 and 2021 were ultimately picked for further in-depth analysis. The main findings showed that the protection motivation theory (PMT) dominated the list of theories and models examining cybersecurity behavior. Cybersecurity behavior and intention behavior counted for the highest purpose for most studies, with fewer studies focusing on cybersecurity awareness and compliance behavior. Most examined studies were conducted in individualistic contexts with limited exposure to collectivistic societies. A total of 56% of the analyzed studies focused on the organizational level, indicating that the individual level is still in its infancy stage. To address the research gaps in cybersecurity behavior at the individual level, this review proposes a number of research agendas that can be considered in future research. This review is believed to improve our understanding by revealing the full potential of cybersecurity behavior and opening the door for further research opportunities.

A systematic review of multi perspectives on human cybersecurity behavior

Although the cornerstones of cybersecurity are technical and data-driven solutions, the human element cannot be disregarded. Understanding users’ behavior is essential to spot security incidents and data breaches. Although previous studies reviewed different angles on cybersecurity behavior, there is still a lack of an overview of the topic through the lenses of cybersecurity theories/models. This systematic review aims to provide multi perspectives on human cybersecurity behavior by evaluating and synthesizing cybersecurity theories/models, independent variables, target variables, moderators, methodologies, participants, units of analysis, technologies/services, countries, and domains. Of 2936 articles collected, 93 studies met the inclusion criteria and were thoroughly analyzed. The main results revealed that the protection motivation theory (PMT) and theory of planned behavior (TPB) were the most common theories in the analyzed literature. 76% of the analyzed studies did not involve a moderator to examine the relationships between predictors and target variables. Most of the studies were conducted at the individual level, mainly involving students and end-users. Social media and mobile devices were the most common tools examined for human cybersecurity behavior. Most of the studies were conducted in the education sector, with a limited number of studies examining the healthcare sector. Behavioral intention and cybersecurity behavior were the primary target/outcome variables in the analyzed studies. The review offers several theoretical contributions and practical implications and provides several research agendas that can be examined in future research.

The evolution of global cybersecurity norms in the digital age: A longitudinal study of the cybersecurity norm development process

ABSTRACT Developing cybersecurity norms and global normative cybersecurity behaviors play an increasingly critical role in global cybersecurity governance. This paper takes a longitudinal approach to analyze cybersecurity norms development activities during the period 1997–2020. A total of 206 individual cases were collected, and 233 individual cybersecurity norms were identified and compiled into 25 subject categories. Categorizing the norm subjects alongside the frequency of cases and norms identified each year allowed for a longitudinal view of cyber norm activities and the evolution in developments over these years. This examination enables us to categorize cybersecurity norms, including their dynamic focus and evolution patterns. By studying those viewed as “successful,” we gain guidance regarding the construction of global cybersecurity governance in the digital age.

The Importance of Conceptualising the Human-Centric Approach in Maintaining and Promoting Cybersecurity-Hygiene in Healthcare 4.0

The cyberspace depicts an increasing number of difficulties related to security, especially in healthcare. This is evident from how vulnerable critical infrastructures are to cyberattacks and are unprotected against cybercrime. Users, ideally, should maintain a good level of cyber hygiene, via regular software updates and the development of unique passwords, as an effective way to become resilient to cyberattacks. Cyber security breaches are a top priority, and most users are aware that their behaviours may put them at risk; however, they are not educated to follow best practices, such as protecting their passwords. Mass cyber education may serve as a means to offset poor cyber security behaviours; however, mandatory education becomes a questionable point if the content is not focused on human factors, using human-centric approaches and taking into account end users’ behaviours, which is currently the case. The nature of the present paper is largely exploratory, and the purpose is two-fold: To present and explore the cyber hygiene definition, context and habits of end users in order to strengthen our understanding of users. Our paper reports the best practices that should be used by healthcare organisations and healthcare professionals to maintain good cyber hygiene and how these can be applied via a healthcare use case scenario to increase awareness related to data privacy and cybersecurity. This is an issue of great importance and urgency considering the rapid increase of cyberattacks in healthcare organisations, mainly due to human errors. Further to that, based on human-centric approaches, our long-term vision and future work involves facilitating the development of efficient practices and education associated with cybersecurity hygiene via a flexible, adaptable and practical framework.

The Cybersecurity Awareness INventory (CAIN): Early Phases of Development of a Tool for Assessing Cybersecurity Knowledge Based on the ISO/IEC 27032

Knowledge of possible cyber threats as well as awareness of appropriate security measures plays a crucial role in the ability of individuals to not only discriminate between an innocuous versus a dangerous cyber event, but more importantly to initiate appropriate cybersecurity behaviors. The purpose of this study was to construct a Cybersecurity Awareness INventory (CAIN) to be used as an instrument to assess users’ cybersecurity knowledge by providing a proficiency score that could be correlated with cyber security behaviors. A scale consisting of 46 items was derived from ISO/IEC 27032. The questionnaire was administered to a sample of college students (N = 277). Based on cybersecurity behaviors reported to the research team by the college’s IT department, each participant was divided into three groups according to the risk reports they received in the past nine months (no risk, low risk, and medium risk). The ANOVA results showed a statistically significant difference in CAIN scores between those in the no risk and medium-risk groups; as expected, CAIN scores were lower in the medium-risk group. The CAIN has the potential to be a useful assessment tool for cyber training programs as well as future studies investigating individuals’ vulnerability to cyberthreats.

Is cybersecurity research missing a trick? Integrating insights from the psychology of habit into research and practice

The idea that people should form positive security habits is gaining increasing attention amongst security practitioners. Habit is a well-studied concept in psychology, but the extent to which the richness of that literature has been fully utilised for security is currently unclear. In order to address this gap, we compared usage of the term “habit”—and connected constructs —in the cybersecurity and habit fields using a co-occurrence networks-based analysis. We aimed to answer three research questions: 1. What is the context within which habit has been discussed in the habit literature and the cybersecurity literature; 2. How does the discussion in these two fields compare; and 3. What are the implications of the outcomes of this analysis for the future research agenda for cybersecurity behaviour? The analysis showed that the habit construct tended to be discussed primarily in the context of other models, rather than on its own. The depth of discussion was therefore limited; resulting gaps in knowledge have important implications for security, like the idea that habits moderate the relationship between intention and behaviour. Given the popularity of the theory of planned behaviour in security research, this represents a key omission. Furthermore, the cybersecurity literature we surveyed contained very little discussion surrounding methods for formation and changing of habits, nor of the role of cues in triggering habitual behaviours. Habits require a different behaviour change approach than intentional behaviours, and many day-to-day security behaviours may in fact be habits. For that reason, these topics represents a potentially productive avenue of research for both security and privacy behaviour.