Influence Information Security Research Articles

Factors Influencing Information Security Culture in Organizations Dealing With Economic Crime in Kenya

Information security culture is very important for any organization, especially in the public sector, where sensitive information is regularly processed and stored. This importance has become more pronounced in recent years because the frequency and sophistication of cyber-attacks have increased, highlighting the need for effective information security measures such as control policies including access controls, password regulations. However, the success of these measures depends on the development of a strong information security culture within the organization. This study thus aimed to establish the organizational factors influencing information security culture in the organization dealing with economic crime in Kenya. The study focused on information security control, organization structure and organizational culture and how they influence information security culture. The study was underpinned on Security Culture Framework, CIA triad model, structural contingency theory and organizational culture theory. Descriptive research design was adopted. The study targeted 5729 employees in the Economic crimes investigative organizations in Kenya. Stratified random sampling approach was used to classify the sample frame. Simple random sampling technique was utilized to select respondents from each stratum to come up with a sample size of 361 respondents. Data was gathered from the five organizations located in Nairobi County, using self-administered questionnaires. The questionnaires were distributed through a drop and pick-up method, wherein the researcher personally delivered them to the respondents at their workplace. The study produced quantitative data that was coded and entered into Statistical Packages for Social Scientists (SPSS Version 26) for analysis, using both descriptive and inferential statistics. The quantitative data was presented using tables and graphs, with accompanying explanations in prose. The study concludes that information security control has a positive and significant effect on information security culture in five selected state-owned organizations dealing with economic crime in Kenya. In addition, the study concludes that organization structure has a positive and significant effect on information security culture in five-selected state-owned organization dealing with economic crime in Kenya. Further, the study concludes that organizational culture has a positive and significant effect on information security culture in five-selected state-owned organization dealing with economic crime in Kenya. Based on the study findings, the study recommends that the management of state-owned organization dealing with economic crime in Kenya should establish a dedicated and well-defined information security governance structure. This involves creating a specialized information security department or team that reports directly to top management, ensuring that information security is prioritized at the highest organizational level.

How About Enhancing Organizational Security

Despite its importance, there is little research on how organizations perceive information security management. This study classified critical success factors in information security management at the organizational level. A performance model was designed to empirically test the validity of these factors. Data were collected through an online questionnaire from prominent information technology managers and specialists who worked in Saudi organizations and contributed to decision making about information security. The data were analyzed using structural equation modeling. The selected constructs—business alignment, top management support, information security awareness, and security controls—appeared to significantly influence information security management, with the balanced scorecard shown as an effective way of measuring performance.

Factors Influencing Information Security Policy Compliance Behavior “A Case – Study Healthcare Workers in a Private Hospital in Mogadishu – Somalia”

Information security policy compliance is crucial for safeguarding sensitive data in healthcare settings. This study investigates the factors influencing information security policy compliance behavior among healthcare workers at a private hospital in Mogadishu, Somalia. Findings reveal that beliefs in the importance of information security, effectiveness of communication and training programs, usability of security tools, and socio- cultural factors significantly impact compliance behavior. The study provides insights for healthcare administrators and policymakers to enhance compliance strategies in healthcare organizations.

Exploring the factors influencing information security policy compliance and violations: A systematic literature review

Despite advancements in security technology, the prevalence of insider threats has been on the rise in recent years. Organizations implement Information Security Policies (ISPs) that outline the expected security-related behavior and compliance standards for employees. Ensuring and enhancing ISP compliance and reducing violations is crucial for organizations to maintain their security posture. This Systematic Literature Review (SLR) aims to synthesize the existing research on ISP compliance and violations to identify the underlying factors behind employee policy violations and delve into the factors that promote compliance with ISPs. In order to provide a theoretical foundation for understanding these behaviors, this SLR identifies the prominent theories used to explain ISP compliance and violation. A comprehensive search is conducted across different academic databases, applying defined inclusion and exclusion criteria to select the relevant studies between 2012 and 2023. To understand intentional violations, we categorize and analyze studies on ISP violations based on Moral Disengagement, Neutralization and Deterrence, Stress, and Monitoring mechanisms. For ISP compliance, we categorize and analyze studies based on individual-level decision-making and organizational-level factors. We identified forty-seven factors that influence compliance behavior and forty-one factors that determine non-compliance behavior. Fourteen common factors were identified from prior literature, which were determinants of both compliance and violation behaviors, with opposite directions of influence. By considering both compliance and noncompliance simultaneously, organizations can develop more effective strategies for enhancing compliance and mitigating noncompliance.

Factors Influencing Information Security Policy Compliance Behavior in High Education Institutions: Systematic Literature Review

Information security policies and behaviors play a crucial role in organizations, particularly in higher education institutions. These policies outline guidelines and best practices to protect sensitive data, safeguard privacy, and prevent unauthorized access or misuse of information. In higher education institutions, they help secure research findings, intellectual property, and student records. By fostering a culture of security awareness and encouraging responsible behavior, organizations can safeguard their reputation, instill trust, and meet legal and regulatory requirements. This literature review has revealed challenges and highlighted the current trends of information security policy compliance, as well as the theories used for information security compliance from 2013 to 2023. Out of 50 research papers published on the topic of information security policy compliance, three influencing factors were identified through filtration: behavioral intention, awareness and culture, and human with organizational management. The findings show that there is a lack of information security policies in the higher education sector. This review contributes to the information security literature by providing a fully organized systematic review of conducted research in the last decade.

Organizational Factors that Influence Information Security in Smes: A Case Study of Mogadishu, Somalia

Many organizations and businesses are currently dependent on information systems to conduct their business process and transactions. The security of the information being handled by systems has become a challenge in the corporate world today, as organizations strive to take measures to safeguard their information and maintain confidentiality. The study aimed to investigate the factors that influence information security in Small and medium-sized enterprises (SMEs) in Mogadishu Somalia. The study was guided by the following research objectives: such as organizational characteristics, data management practices, and employee characteristics in organizations that affect information security in SMEs in Mogadishu Somalia. A quantitative descriptive research design was used in this study, whereby the population consisted of 150 respondents which was focused on Owners, Managers, and Information Security Engineers of Small and Medium-sized enterprises (SMEs) in Mogadishu. Out of which a sample size of 140 respondents was obtained, spread out across three categories. The researchesr applied the probability method to select Owners, Managers, and Information Security Engineers from the Small and Medium Enterprises in Mogadishu Somalia. The elements selected from the population interacted with information security and were well-qualified to respond to the research objectives. The researches used self-administered structured questionnaires, whereby the respondents were required to point out the measure of appropriateness of the three main factors that influence information security in SMEs in Mogadishu. The questionnaire used a five-point Likert-type scale ranging from strongly disagree (1) to strongly agree (5). The respondents were also asked to indicate demographic information that comprised of Sex, age, level of education, years of experience, job position, and marital status, based on their perception and understanding. The study was a quantitative research design, whereby a total of one hundred and fifty (150) questionnaires were distributed and one hundred and fourty (140) were returned from the respondents, indicating a response rate of 99%. The analysis of the data was performed in a quantitative nature so as to obtain numerical data made use of descriptive and correlation statistics and was analyzed using SPSS software. The data was structured according to the research objectives and displayed in the form of tables.

Reducing fraud in organizations through information security policy compliance: An information security controls perspective

As more business processes and information assets are digitized, computer resources are increasingly being misused to perpetrate fraudulent activities. Research shows that fraud committed by (or with) trusted insiders (called occupational fraud or internal organizational fraud) is responsible for significantly more damage than that committed by external actors (for example, cyber fraud). Current fraud research has primarily focused on the person perpetuating the fraud instead of the internal mechanisms organizations can employ in reducing fraud. The study examines the relationship between compliance with organizations' technology controls (primarily focused on information security) and its impact on computer-based occupational fraud. Based on general deterrence and fraud triangle theories, the study proposes information security control proficiency (ISCP) modeled as an integration of the quality of information security policy and its enforcement as a key factor that influences information security policy compliance. We further postulate that compliance with information security policy mediates the relationship between information security control proficiency and computer-based-occupational fraud. Empirical assessment supports the structure of the information security control proficiency construct. Model testing shows that information security control proficiency positively impacts information security policy compliance, which further deters the use of a company's computer systems and resources to conduct fraudulent activities. Thus, if an organization establishes high-quality information security policies and supports the policies with effective enforcement, it correspondingly leads to better compliance. Furthermore, less fraud is committed when compliance with information security controls is high. We offer various managerial implications and future research extension ideas.

An Investigation of the Factors That Influence Information Security Culture in Government Organizations in Bhutan

ABSTRACT Organizations make large investments to secure data and networks, but information security breaches as a result of insiders continue to rise. One possible contributor to this is poor information security culture. This study investigated the key factors that contribute to effective information security culture in government organizations in Bhutan and how information security culture influences employee security behavior. A research model was developed for the study based on an analysis of the information security literature. Data was collected using an online survey of 181 government employees. Senior management support, information security policy, training and awareness campaigns, interpersonal trust, and job- versus employee-oriented organizational culture were all found to influence information security culture, and information security culture contributed to information security behavior. The study extends understanding of the roles of trust and different dimensions of organizational culture in improving information security culture and behavior. The findings should help government policy makers and information security practitioners when developing information security strategies and programs.

The impact of information security management guide utilization on technological and institutional information security measures in university libraries in Türkiye

The study examined whether the levels of technological and institutional information security measures implemented in university libraries in Türkiye differ based on the usage of a corporate information security management guide. The study was conducted through a literature review and survey method in a total of 199 university libraries in Turkey actively operating in 2023, comprising 124 state universities and 75 private universities. To ensure the contributions of all university libraries population was obtained in a homogeneous manner, a purposive sampling method was used, collecting data from one staff member from each university library.The findings reveal that there are significant differences (p < 0.05) in the levels of both technological and institutional information security measures, depending on the presence and utilization of a corporate information security management guide in university libraries. These findings demonstrated that an enterprise information security management tool is effective in influencing information security practices in university libraries. This result confirmed the hypothesis that there are significant differences in the implementation levels of technological and institutional information security measures based on the presence and usage of an enterprise information security management tool in university libraries in Turkey.Considering the lack of comprehensive studies on information security management in university libraries in Turkey, this research demonstrates its uniqueness by approaching the topic with a holistic approach.

Nurse Information Security Policy Compliance, Information Competence, and Information Security Attitudes Predict Information Security Behavior.

Nurses' attitudes toward information security can influence the hospital's information resources management and development. This study investigated the relationships between nurses' information security policy compliance, information competence, and information security attitudes, which are factors that influence information security behavior. Data were collected during September 2020. The participants were 200 clinical nurses from a general hospital in Korea. The self-reported questionnaire included questions on nurses' general characteristics, information security policy compliance, information competence, and information security attitudes. Information security policy compliance (r = 0.554, P < .001) and information competence (r = 0.614, P < .001) were positively associated with information security attitudes. Predictors of nurses' information security attitudes were information competence (β = .439), information security policy compliance (β = .343), prior information security-related education (β = .113), and job position (nurse manager; β = .101). Implications for practice include the need for strategies to develop information security policy compliance and information competence to improve information security behavior, including different approaches tailored to nurses' job positions and previous information security education.

Social-legal foundations of information security of the state, society and individual in Ukraine

Ukraine is experiencing military aggression due to the full-scale invasion of Russia, which uses information weapons. Therefore, the problem of ensuring a sufficiently high level of information security in Ukraine is relevant. The purpose of the research – to highlight the essence and features of the concept of "information security", and related terms, and to perform a comprehensive analysis of the current regulatory framework on ensuring a reliable level of information security as the basis of national security. To achieve this purpose, the author uses empirical, theoretical and comprehensive methods of scientific research, namely: observation, comparison, abstraction, analysis and synthesis, and comparative-legal, Aristotelian, analogy and deduction methods. The author proves the significance of ensuring information security at the level of each entity as the foundation for the existence of the Ukrainian information society and a means of counteracting the aggressive actions of the Russian Federation. The factors influencing information security are identified, in the context of which the significant role of the culture of protection of society is demonstrated. The significance of ensuring an appropriate level of cybersecurity as a defining element of information defence, the provision of which should be as consistent as possible with the State information policy, is substantiated. The author outlines the potential consequences of failure to maintain a reliable level of information and cybersecurity against the background of a full-scale invasion, namely: the overthrow of the government, collapse of Ukraine’s reputation in the international arena, chaotic processes in society and growing discontent, economic crisis and human casualties. The author describes the current state of information security in the country and suggests ways to improve it, in particular by reforming the existing legal regulation, considering the political experience of other countries and scientific achievements, transforming the State information policy with a focus on preventing information offences, international cooperation in the global information space and developing the information culture of the population. These recommendations can be used to eliminate shortcomings in the legal regulation of information security issues and to develop proposals for reforming the national information policy

Information security ignorance: An exploration of the concept and its antecedents

In this study, we propose and examine the concept of information security ignorance, which is an individual's chosen state of remaining underinformed about information security. Ignorance may be a rational choice for individuals when feeling overwhelmed by the available information. The findings of this study, based on the analysis of 319 survey responses, suggest that media and interpersonal communication influence information security ignorance. However, personal traits, including locus of control, intellectual curiosity, and computer anxiety, play a stronger role in shaping ignorance. Security ignorance was found to be positively related to the perception that the Internet is a safe place.

Security is Local: The Influence of the Immediate Workgroup on Information Security

Information security is a multilevel phenomenon with employee security decisions being influenced by macrolevel factors (e.g., organizational policies), mesolevel factors (e.g., one’s immediate workgroup—IW), and microlevel factors (e.g., individual personalities). We argue that an employee’s local IW (i.e., immediate supervisor and coworkers) has a strong effect on security. This paper focuses on the effects of these mesolevel factors in the presence of macro- and microlevel factors. Drawing on the social structure and social learning framework as well as workgroup research, we hypothesize that the security behavior of an employee’s IW supervisor and coworkers moderated by the nature of these relationships influences information security decisions. Our research, based on a sample of 217 full-time employees, reveals that the IW significantly affects security decisions, over and above the micro- and macrolevel factors. These effects are moderated by the nature of the relationship between employees and their IW supervisor (leader-member exchange) and coworkers (team-member exchange). A post hoc analysis shows that the mesolevel factors alone had the same explanatory power as the micro- and macrolevels combined. Our research suggests that future theory and research should include the IW and that organizations should share security responsibilities with line managers and help them understand their substantial impact on information security. Security training programs should ask employees about the behaviors of their IW supervisor and coworkers and, where needed, deliver anti-neutralization training to mitigate the effects of the IW’s noncompliance behaviors.

A multi-theory model to evaluate new factors influencing information security compliance

Many organisations recognise that their employees, who are often considered the weakest link in information security, can also be great assets in the effort to reduce risk related to information security. This research identifies the antecedents of employee compliance with the information security policy (ISP) of an organisation. A survey among computer users of organisations in Mauritius which have established information security policy was carried out. A novel multi-theory model is derived from theory of reasoned action, cognitive evaluation theory and hanoo, and that model is presented to evaluate the data gathered through the survey. The results show that an employee's intention to comply is influenced by attitude, security awareness programs and rewards. Intention to comply in turn influences actual compliance to ISP.

The valued coexistence of protection motivation and stewardship in information security behaviors

Organizations need to consider different managerial approaches to motivate security compliance behavior as more employees work outside of the office. This study examines two approaches for motivating security compliance behaviors in a changing work environment. We examine protection motivation and stewardship-based strategic approaches to determine their effectiveness towards influencing information security behaviors. Independently, each approach has received demonstrable evidence of contributing to organizational behaviors. However, as the nature of work changes (e.g., hoteling, traveling, working from home), it also changes the security risk landscape for organizations, rendering the effectiveness of previous security controls debatable. This study contends there is value to management in integrating both protection motivation and stewardship approaches in this context. A research model is developed that integrates both approaches; protection motivation and stewardship concepts. We find that constructs consistent with protection motivation theory are more likely to explain decreases in security policy violations than stewardship theory. Further, by combining protection motivation and stewardship perspectives, this study's results supplement our understanding of security policy violations in a changing work environment. We show that the two together account for 51 percent of the variance, and thus both have value. Our findings suggest that a PMT-based strategy is a stronger approach for influencing compliance behavior. Therefore, it is important for organizations to continue focusing their efforts on threat communications as well as enhancing employees’ abilities to respond. However, we also show that organizations should build a sense of belonging with their employees such that their employees become stewards of the organization's resources.

THE EFFECTS OF PERSUASIVE TECHNOLOGY FOR INFLUENCING END-USERS’ INFORMATION SECURITY AWARENESS

In today’s digital world, information assets have grown in importance, demanding measures to ensure their protection. Ubiquitously, end-users are having trouble ensuring the security of their personal information. The human factor is a major source of vulnerability in the field of information security. Traditional techniques that can be used to influence information security awareness (ISA) remain prohibitively expensive, time-consuming, and repetitive. In light of these challenges, this study proposes persuasive technology to influence end-users security awareness and behaviour intention. Based on our research, persuasive technology is effective in changing end-users attitudes and behaviours. In this context, this study assesses the effectiveness of persuasive technology use for influencing end-users’ ISA. In addition, this research establishes an integrated model for improving end-users’ ISA by incorporating relevant literature and multiple empirically verified theories, including Fogg Behaviour Model (FBM), Protection Motivation Theory (PMT), Theory of Planned Behaviour (TPB), and Technology Acceptance Model (TAM). The integrated model has been proposed based on the main categories of FBM (motivation, ability, and trigger) to identify the effects of key factors in the persuasive technology context for influencing end-user ISA and behaviour intention. The prototype was developed by implementing the persuasive factors of the proposed model to measure the effectiveness of persuasive technology. Quantitative data from an experiment were gathered from 100 participants to validate the proposed research model using the paired sample T-test and partial least squares (PLS) to assess security awareness in the context of persuasive technology. The research findings show that using persuasive technology has a positive influence on ISA. The results also indicate the research model significantly predicts the key factors affecting security awareness and behaviour intention with respect to persuasive technology. Thus, this study suggests a model for the creation and development of a proactive and customised security awareness system. Therefore, persuasive technology, in general, has a positive effect on users’ security awareness and the intention of security behaviour

Mobile Device Users’ Susceptibility to Phishing Attacks

The mobile device is one of the fasted growing technologies that is widely used in a diversifying sector. Mobile devices are used for everyday life, such as personal information exchange – chatting, email, shopping, and mobile banking, contributing to information security threats. Users' behavior can influence information security threats. More research is needed to understand users' threat avoidance behavior and motivation. Using Technology threat avoidance theory (TTAT), this study assessed factors that influenced mobile device users' threat avoidance motivations and behaviors as it relates to phishing attacks. From the data collected from 137 mobile device users using a questionnaire, the findings indicate that (1) mobile device users' perceived susceptibility and severity of phishing attacks have a significant correlation with a users' perception of the threat; (2) mobile device users' motivation to avoid a threat is correlated to a users' behavior in avoiding threat; and (3) a mobile device user's susceptibility to phishing attacks can be reduced by their perception of the threat. These findings reveal that a user's perception of threat increases if they perceive that the consequence of such threat to their mobile devices will be severe, thereby increasing a user's motivation and behavior to avoid phishing attack threats. This study is beneficial to mobile device users in personal and organizational settings.

AWARENESS OF ICT SECURITY POLICY TO ENSURE DATA PROTECTION IN FORESTRY DEPARTMENT PENINSULAR MALAYSIA

The Forestry Department Peninsular Malaysia's (FDPM) ICT Security Policy was developed and implemented in 2012 and reviewed in 2015. This policy aims to take the lead in managing data, hardware, software, network, and ICT security under legal regulations. Amongst the department's responsibilities are to implement data confidentiality, integrity, and availability policies to ensure the continuity of activities and services while mitigating the impact of security incidents. Accidentally, on September 16, 2016, a fire broke out in the FDPM building, causing property damage and document destruction with an estimated loss of RM30 million. Currently, in Malaysia, cybercrime and government data intrusion has become increasingly difficult to combat. Raising public awareness, particularly among officers who serve as service providers and department employees, is therefore critical to address those issues. Therefore, the objectives of this research are to determine the level of awareness of FDPM employees regarding FDPM ICT Security Policy as well as to investigate the factors that influence information security awareness. Inputs from this study were derived from both primary and secondary sources to meet the objectives. Primary data was gathered through surveys where 130 questionnaires were distributed to FDPM headquarters employees at the management, professional, and support team levels. Meanwhile, secondary data was gathered from FDPM annual and management reports, statistical data, journals, reference documents, and the Internet. The findings were analyzed statistically using SPSS. The level of awareness has been determined and an appropriate criterion to improve the level of information security awareness among FDPM employees was recommended which may help for a better understanding of department culture and increase a higher level of security awareness among FDPM employees.

Value conflicts and information security – a mixed-methods study in high-risk industry

PurposeThe purpose of this study is to investigate the influence of work-related value conflicts on information security in two organisations in nuclear power production and related industry.Design/methodology/approachA mixed-methods design was applied. Individual interviews were conducted with 24 employees of two organisations in Sweden and questionnaire data on information security climate were collected from 667 employees (62%) in the same two organisations.FindingsThe qualitative part of the study identified five different types of value conflicts influencing information security behaviour. The quantitative part of the study found that value conflicts relating to information security had a negative relationship with rule-compliant behaviour. The opposite was found for participative security behaviour where there was a positive relationship with value conflicts. A high climate of information security was positively related to both rule-compliant and participative information security behaviour. It also moderated the effect of value conflicts on compliant information security behaviour.Originality/valueThis paper highlights organisational contextual conditions that influence employees’ motivation and ability to manage value conflicts relating to information security in a high-risk industry. It also enables a better understanding of the influence of the information security climate on information security in the presence of value conflicts in this type of industry.

Predicting information security culture among employees of telecommunication companies in an emerging market

Purpose The purpose of this study is to examine factors, which influence information security culture among employees of telecommunications companies. The motivation for this study was the rise in the number of data breach incidents caused by the organizations’ own employees. Design/methodology/approach A total of 139 usable responses were collected via a Web-based questionnaire survey from employees of Malaysian telecommunications companies. Data were analysed by using SmartPLS 3. Findings Security education, training and awareness (SETA) programmes and information security awareness were found to have a positive and significant impact on Information Security Culture. Additionally, self-reported employees’ security behaviour was found to act as a partial mediator on the relationship between information security awareness and information security culture. Research limitations/implications The study was cross-sectional in nature. Therefore, it could not measure changes in population over time. Practical implications The empirical data provides a new perspective on significant elements that influence information security culture in an emerging market. Organizations in the telecommunications industry can now recognize that SETA programmes and information security awareness have a significant impact on information security culture. Employees’ security behaviour also mediates the relationship between information security awareness and information security culture. Originality/value This is the first study to analyse the mediating effect of employees’ security behaviour on the relationship between information security awareness and information security culture in the Malaysian telecommunications context.