Information Security Behavior Research Articles

Access to user data stored by organizations—divides surrounding information security professionals in Chinese IT organizations

With the rapid development of computer-based information systems in China, securing organizational systems as information assets is central to achieving a strategic advantage. Because information security (IS) experts with database access are the weakest link in the IS chain, scholarly contributions are needed in this important area. The interpretations of widespread data breaches committed by organizations’ information security experts have significant grounding. Drawing on social control theory, we propose a research framework to examine formal control, informal control, and self-control systems that can affect IS professionals’ perceptions and IS behaviors in Chinese IT organizations. We use in-depth interviews with IS professionals in Wuhan, Beijing, and Shenzhen to answer research questions relating to the research framework. The study’s primary contribution is to go beyond the extant IS research, which concentrates on sanction-based deterrence, and identify multiple dimensions rooted in social control perspectives. Based on interviews with practitioners and researchers, this study further advances our understanding of IS control deviance using information management and communication-related approaches.

How protection motivation and social bond factors influence information security behavior

Les technologies numériques sont omniprésentes, avec pour corollaire la prolifération des attaques contre les actifs informationnels. Ainsi, la sécurité de l’information (IS) semble être une question cruciale pour les individus et les gestionnaires. Si les tentatives d’identification des facteurs qui guident le comportement des acteurs en matière de sécurité de l’information (ISB) ne sont pas nouvelles, cette identification reste plus nécessaire et actuelle que jamais. De ce point de vue, cette étude empirique contribue à une meilleure compréhension des facteurs cognitifs et de socialisation qui influencent les comportements en matière de sécurité de l’information. En utilisant un modèle hiérarchique de second ordre avec modélisation partielle par équations structurelles des moindres carrés (PLS-SEM), nous testons pour la première fois l’applicabilité de la théorie de la motivation de protection (PMT) et de la théorie du lien social (SBT) à la sensibilisation aux technologies de la sécurité de l’information (ISTA) et au comportement de protection contre les logiciels malveillants (MPB) de 430 étudiants. Premièrement, nos résultats démontrent que la combinaison de la PMT et de la SBT produit un modèle plus robuste pour l’analyse de l’ISTA et de la MPB que si l’on considère chacune de ces théories séparément. Deuxièmement, l’ISTA agit en partie comme médiateur des liens sociaux et de la motivation de protection et pourrait donc être un comportement de sécurité fondamental. Si nous soulignons le rôle prépondérant de l’implication, la différence significative observée dans les ISB des deux sexes est liée à la plus forte influence pour les femmes, des liens sociaux sur l’ISTA. Ce résultat s’explique notamment par des effets plus homogènes des facteurs de socialisation chez les femmes que chez les hommes. Nous suggérons que la conception des programmes et de l’enseignement de l’ISTA soit mieux adaptée aux différents facteurs cognitifs et de socialisation des individus, notamment en mettant l’accent sur les liens sociaux et, plus spécifiquement, sur l’implication. Nous fournissons également des recommandations détaillées sur la manière dont les praticiens peuvent améliorer les ISB des individus.

Exploring potential gender differences in information security and privacy

Purpose Information technology users often fail to adopt necessary security and privacy measures, leading to increased risk of cybercrimes. There has been limited research on how demographic differences influence information security behaviour and understanding this could be important in identifying users who may be more likely to have poor information security behaviour. This study aims to investigate whether there are any gender differences in security and privacy behaviours and perceptions, to identify potential differences that may have implications for protecting users’ privacy and securing their devices, software and data. Design/methodology/approach This paper addresses this research gap by investigating security behaviours and perceptions in the following two studies: one focussing on information security and one on information privacy. Data was collected in both studies using anonymous online surveys. Findings This study finds significant differences between men and women in over 40% of the security and privacy behaviours considered, suggesting that overall levels of both are significantly lower for women than for men, with behaviours that require more technical skill being adopted less by female users. Furthermore, individual perceptions exhibited some gender differences. Originality/value This research suggests that potential gender differences in some security and privacy behaviours and perceptions should be taken into account when designing information security education, training and awareness initiatives for both organisations and the broader community. This study also provides a strong foundation to explore information security individual differences more deeply.

Sustainable Information Security Behavior Management: An Empirical Approach for the Causes of Employees’ Voice Behavior

As organizations’ interest in information resources expands, their investments in information security (IS), such as the introduction of IS policies and new technologies, are also expanding. Nevertheless, IS incidents and threats within the organization have not decreased. This study aims to protect organizations’ information assets by maintaining the level of continuous IS behavior of the organization insiders. Moreover, this study suggests a method to induce continuous security behavior of individuals by confirming the relationship between IS-related voice behavior and IS-related organizational justice, which is an action concept that provides continuous opinions to achieve security goals. This study derives research models and hypotheses through previous studies and tests hypotheses through structural equation modeling. The target subjects are members of the organization who introduced the IS policy. A total of 325 samples were secured through the questionnaire method, and hypotheses were verified. Results reveal that voice behavior related to IS is negatively influenced by work impediment and positively influenced by organizational identification. In addition, procedural and information justice that influence prior actions related to IS affect the cause of personal security behavior (work impediment and organizational identification). Additionally, justice sensitivity adjusted the impact relationship between IS-related organizational justice and the cause of security behavior. The study presents the importance of voice behavior in maintaining the level of IS within the organization continuously. Moreover, it has practical implications in that efforts to improve organizational justice and voice behaviors vary according to the level of individual justice sensitivity.

Enhancing End-User Roles in Information Security: Exploring the Setting, Situation, and Identity

Managing employee behaviors is a continuous quest for management. The quest is even more intense in the information security space, where a seemingly unintentional activity could have a consequential effect on an organization's security. The information security literature has used many theoretical approaches to explain how to regulate employee security behaviors, including protection motivation and deterrence. However, a theoretical approach that has captured the focus in organizational literature for behavioral regulation and yet to be realized in the information security domain is work-related identities. Work-related identity regulation depends on settings and situations in which the individual is embedded. This study draws from the identity theory and information security literature to explore how factors in the information security setting (security threats, security policy, and organizational support) help foment work-related information security identity and security behaviors. Our findings show that these factors significantly increase the user's identification in their roles in information security, and in turn, security behaviors. This research has implications for research and practice.

Varieties of public–private co-governance on cybersecurity within the digital trade: implications from Huawei’s 5G

Cybersecurity is becoming an increasing hurdle for digital trade. The governance of cybersecurity in the global digital trade system is a bottom-up approach, where governments are implementing fragmental and inconsistent trade policies and forming different models of public–private co-governance. Based on network-governance theory, information security behavior theory, and international risk theory, we develop a conceptual model to investigate how various factors drive cybersecurity governance practices. Using Huawei’s 5G as an example, this study explores how different governments—the United States, the United Kingdom, Germany, Australia, and India—act on the cybersecurity concerns from Huawei’s 5G. The comparative analysis demonstrates how balancing different factors drive governments' actions and discuss what international corporations like Huawei can do to align their digital trade system strategies. This research guides international firms to participate in cybersecurity governance constructions within the digital trade system.

Protection Motivation Theory in Information Systems Security Research

Protection motivation theory (PMT) is one of the most commonly used theories to examine information security behaviors. Our systematic review of the application of PMT in information systems (IS) security and the comparison with its application for decades in psychology identified five categories of important issues that have not yet been examined in IS security research. Discussing these issues in terms of why they are relevant and important for IS security, and to what extent IS research has not considered them, offers new research opportunities associated with the study of PMT and IS security threats. We suggest how future studies can approach each of the open issues to provide a new road map for quantitative and qualitative IS scholars.

Enhancing employees information security awareness in private and public organisations: A systematic literature review

Preserving the confidentiality, integrity and availability (CIA) of an organisation's sensitive information systems assets against attacks and threats is a challenge in this digital age. Organisations worldwide make huge investments in information security technological countermeasures. Nonetheless, organisations in many cases fail to protect their information assets as they rely mainly on technical solutions which are not contextually compatible and sufficient. As a matter of fact, a significant number of organisational information security incidents are due to the exploitation of human elements that directly and/or indirectly cause the majority of security incidents. Therefore, employees’ information security awareness (ISA) becomes one of the critical aspects of protection against undesirable information security behaviours. However, to date, there is limited synthesised knowledge about methods for enhancing ISA and integrated insights on factors affecting employees’ ISA levels. This study, therefore, provides a systematic review of the literature on ISA and puts forward a state-of-the-art collection of ISA methods and factors for enhancing employees’ ISA within both private and public sector organisations. The results indicate that various methods and factors are used to enhance employees’ ISA in organisations. Theoretical models and gamification are the methods widely used in both private and public organisations, whereas the constructivist approach and violation detections are some of the methods used only in private organisations. Furthermore, this study offers some insights into the latest trends in ISA content development methods and factors, and fosters good ISA practice by disseminating information and knowledge amongst Information Security professionals to help them build an overarching ISA development programme in their organisations.

Information Security Behavior and Information Security Policy Compliance: A Systematic Literature Review for Identifying the Transformation Process from Noncompliance to Compliance

A grave concern to an organization’s information security is employees’ behavior when they do not value information security policy compliance (ISPC). Most ISPC studies evaluate compliance and noncompliance behaviors separately. However, the literature lacks a comprehensive understanding of the factors that transform the employees’ behavior from noncompliance to compliance. Therefore, we conducted a systematic literature review (SLR), highlighting the studies done concerning information security behavior (ISB) towards ISPC in multiple settings: research frameworks, research designs, and research methodologies over the last decade. We found that ISPC research focused more on compliance behaviors than noncompliance behaviors. Value conflicts, security-related stress, and neutralization, among many other factors, provided significant evidence towards noncompliance. At the same time, internal/external and protection motivations proved positively significant towards compliance behaviors. Employees perceive internal and external motivations from their social circle, management behaviors, and organizational culture to adopt security-aware behaviors. Deterrence techniques, management behaviors, culture, and information security awareness play a vital role in transforming employees’ noncompliance into compliance behaviors. This SLR’s motivation is to synthesize the literature on ISPC and ISB, identifying the behavioral transformation process from noncompliance to compliance. This SLR contributes to information system security literature by providing a behavior transformation process model based on the existing ISPC literature.

Analysis of the effects of Information Security Awareness, Response Efficacy, and Compliance Behavioral Intention on Information Security Behavior: Focursing on Availability and Culture

Analysis of the effects of Information Security Awareness, Response Efficacy, and Compliance Behavioral Intention on Information Security Behavior: Focursing on Availability and Culture

Intention to share: the relationship between cybersecurity behaviour and sharing specific content in Facebook

Introduction. Sharing information on Facebook is becoming increasingly popular. Sharing text, video, voice, and pictures with unique content of the language-specific and sacred text, is becoming a trend. Consequently, issues of secure and trustable content have become increasingly important to all netizens. This issue has its foundations in the intention to share behaviour where the emphasis is on user security behaviour when sharing specific content. Method. The proposed theory was adapted and modified from previous research to empirically evaluate survey data collected from 154 Facebook users. A snowball sampling method was used. Analysis. A quantitative analysis was carried out on the data, which related to 154 Facebook users. This analysis used SmartPLS software. Results. The experience of information sharing was found to be an important determinant of personal outcome expectation as it explained about 89.9 per cent of the total variance. The ability to create and share information, subjective norms, feedback, information sharing self-efficacy, personal outcome expectations, and information security behaviour have become most important factors when intending to share specific content on Facebook. Conclusions. There is a theoretical understanding of security behaviour as a factor that promotes specific-content sharing behaviour on Facebook.

Assessing information security behaviour: a self-determination theory perspective

PurposeThis paper outlines the development of a validated questionnaire for assessing information security behaviour. The purpose of this paper is to present data from the questionnaire validation process and the quantitative study results.Design/methodology/approachData obtained through a quantitative survey (N = 263) at a South African university were used to validate the questionnaire.FindingsExploratory factor analysis produced 11 factors. Cronbach’s alpha for the 11 factors were all above 0.7, suggesting that the questionnaire is valid and reliable. The responses show that autonomy questions received positive perception, followed by competence questions and lastly relatedness questions. The correlation analysis results show that there was a statistically significant relationship between competence factors and autonomy factors. There was a partial significant relationship between autonomy and relatedness factors, and between competence and relatedness factors. The study results suggest that competence and autonomy could be more important than relatedness in fostering information security behaviour among employees.Research limitations/implicationsThis study used a convenience sampling, a cross-sectional design, and was carried out in a single organisation. This could pose limitations when generalising the study results. Future studies could use random sampling and consider other universities for further validation.Practical implicationsUniversities can use the questionnaire to identify developmental areas to improve information security from a behaviour perspective.Originality/valueThis paper provides a research instrument for assessing information security behaviour from the perspective of the self-determination theory.

Structural Model of the Healthcare Information Security Behavior of Nurses Applying Protection Motivation Theory.

Background: Healthcare information includes sensitive data and, as such, must be secure; however, the risk of healthcare information leakage is increasing. Nurses manage healthcare information in hospitals; however, previous studies have either been conducted on medical workers from various other occupations or have not synthesized various factors. The purpose of this study was to create and prove a model of nurses’ healthcare information security (HIS). The hypothetical model used in this study was constructed on the basis of the protection motivation theory (PMT) proposed by Rogers. Methods: A total of 252 questionnaires scored using a five-point Likert scale were analyzed, incorporating data from nurses who had been working for more than one month in general hospitals with more than 300 beds in South Korea. The survey was conducted over a total of 30 days, from 1 to 30 September 2019. Results: The results showed that coping appraisal significantly influence HIS intentions (estimate = −1.477, p < 0.01), whereas HIS intentions significantly influence HIS behavior (estimate = 0.515, p < 0.001). A moderating effect on the association between coping appraisal and HIS intentions was found in the group of nurses who had been working for <5 years (estimate = −1.820, p < 0.05). Moreover, a moderating effect on the association between HIS intentions and HIS behavior was found in the group of nurses who had been working for <5 years (estimate = 0.600, p < 0.001). Conclusion: The results of this study can be used to develop a management plan to strengthen nurses’ HIS behavior and can be used by nursing managers as a basis for developing education programs.

Does government social media promote users' information security behavior towards COVID-19 scams? Cultivation effects and protective motivations

Cybercriminals are taking advantage of the COVID-19 outbreak and offering COVID-19-related scams to unsuspecting people. Currently, there is a lack of studies that focus on protecting people from COVID-19-related cybercrimes. Drawing upon Cultivation Theory and Protection Motivation Theory, we develop a research model to examine the cultivation effect of government social media on peoples' information security behavior towards COVID-19 scams. We employ structural equation modeling to analyze 240 survey responses collected from social media followers of government accounts. Our results suggest that government social media account followers' participation influences their information security behavior through perceived severity, perceived vulnerability, self-efficacy, and response efficacy. Our study highlights the importance of government social media for information security management during crises.

Toward a Unified View of Dynamic Information Security Behaviors

Extant information systems security research identified and examined a variety of individual as well as organizational factors influencing information security behaviors, but rarely offered sufficient theoretical insight into the interaction of the individual factors with the organizational context in impacting information security behaviors. To fill this gap, this study proposes a theoretical framework that builds on the concepts of organizational culture and sensemaking to show that: 1) information security behaviors are outcomes of sensemaking; and 2) sensemaking is enabled as well as constrained by organizational culture. This study further epitomizes that information security diagnosing, solving, and performing behaviors emerge as outcomes of sensemaking about information security during the organization's interactions with technology. Theoretical and pragmatic contributions of this framework and future research directions are also demonstrated.

Personality and Employees’ Information Security Behavior among Generational Cohorts

The Big Five Factors Model (FFM) of personality traits theory was tested for its ability to explain employee information security behavior (EISB), when age, measured by generational cohort (GCOHORT), moderated the relationship between the independent variables (IVs) extraversion, agreeableness, conscientiousness, emotional stability, intellect (EACESI) and the dependent variable (DV), employees&amp;rsquo; information security behavior (EISB) which is measured by file protection behavior (FPB). Three age groups defined GCOHORT: 52&amp;ndash;70 years old (1946&amp;ndash;1964, Baby Boomers), 36&amp;ndash;51 yrs old (1965&amp;ndash;1980, Generation X), and 18&amp;ndash; 35 yrs. Old (1981&amp;ndash;1998, Millennial). Results of hierarchical multiple regressions analyses revealed statistically significant relationships between overall personality traits, four individual factors of personality traits, and the DV (p &amp;lt; .05). However, contrary to expectations, GCOHORT did not moderate the relationship between any of the main IVs and the DV (p &amp;gt; .05). Recommendations for future research are offered.

Relationships among undergraduates' problematic information security behavior, compulsive internet use, and mindful awareness in Taiwan

This study aimed to investigate the relationships among undergraduates' problematic information security behavior (PISB), compulsive internet use (CIU), mindful awareness, and demographic factors in Taiwan. The convenience sampling was performed at three universities in southern Taiwan, and 514 undergraduates were selected as participants. A cross-sectional survey research design was used, and a hierarchical regression analysis was performed. Current results indicated that undergraduates with non-science majors had a higher level of PISB than undergraduates with science majors. Mindful awareness was negatively associated with undergraduates' PISB, whereas CIU was positively associated with undergraduates' PISB. Furthermore, the association between mindful awareness and PISB was moderated by the level of CIU, such that the relationship between mindful awareness and PISB was stronger in undergraduates with low CIU than in undergraduates with high CIU. In other words, a one standard deviation unit increase in mindful awareness predicted a greater reduction in PISB in undergraduates with low CIU relative to undergraduates with high CIU. The main implication of these findings is that although increasing mindfulness awareness may be related to reducing PISB in students in general, it appears that mindfulness awareness training may be more effective in improving PISB in students with low CIU relative to those with high CIU. Hence, if CIU is particularly problematic in certain students, then it may be helpful to specifically target CIU first with treatment (e.g., cognitive-behavioral therapy) not only to alleviate problems associated with CIU but also to allow mindfulness awareness training to better improve PISB.

The influence of hardiness and habit on security behaviour intention

ABSTRACT Small and medium-sized enterprises (SMEs) make up a large percentage of businesses; they employ over 50% of all employees, and account for most partnerships in supply chain networks. This makes SME employees a target for cybercriminals. This study examines the factors that influence the security behaviour intention of SME employees to better understand how SMEs can manage cybersecurity risk caused by employee security behaviour. In a survey of 294 employees, the research model developed from the theory of planned behaviour and protection motivation theory, including the habit and hardiness personality trait, is empirically validated to understand employee security behaviour intention. The results of the study show that hardiness and habit have a significant effect on employee security behaviour intention. The findings contribute to the literature on personality traits and habit in the context of information security behaviour. The study's implications for research and practice are also discussed.

Explaining the interactions of humans and artifacts in insider security behaviors: The mangle of practice perspective

Recent decades have seen numerous studies of individual information security behaviors and compliance within organizational contexts. One regular finding is that individuals continue to fail at compliance; however the explanations for why this occurs typically fail to consider the temporal, emergent and dynamic nature of security encounters between human users information security-related artifacts when they come together in the practice of security. In addition, existing research typically does not consider the inherent tension that exists between information systems (IS) use and security controls where the former is used to perform tasks and the latter may constrain the accomplishment of those tasks. This paper offers a new perspective that may better explain how the human and the security-related artifacts they create interact to both afford and constrain the enactment of information security. Our perspective builds on Pickering's mangle of practice metaphor to consider the constitutive entanglement of humans and artifacts and explain information security behaviors. This perspective is applied and discussed in the context of insider compliance with information security policies but could apply to a wide range of other information security and information systems behavioral contexts.

“Your money or your life!” – Ransomwares in healthcare information systems

In recent years, due to the value of health data and the specificities of health processes, data breaches have become increasingly important. In addition to the general data protection rules of the European Union, aspects of general information security, including technology and human behaviour, have been reassessed. In this article, we present the importance of blackmail (ransomware) virus attacks in the health sector. According to international data, especially in the US, one of the most important methods of institutional attacks will be the extortion attack in the coming years, and this is expected to increase in importance, especially in health care where sensitive and valuable data are truly life-giving. Because of the encryption of data and the blocking of core processes, blackmail viruses can also have a significant impact on the effectiveness of therapy and healthcare. In addition to presenting the current international situation, the article also outlines the most important steps that can be taken by those involved in daily patient's care to ensure continuity of patient care. Orv Hetil. 2020; 161(36): 1498-1505.