Context Of Information Security Research Articles

Understanding Shadow IT usage intention: a view of the dual-factor model

PurposeDespite the growing concern about security breaches and risks emerging from Shadow IT usage, a type of information security violation committed by organizational insiders, this phenomenon has received little scholarly attention. By integrating the dual-factor theory, unified theory of acceptance and use of technology (UTAUT) and social control theory, this research aims to examine facilitating and deterring factors of Shadow IT usage intention.Design/methodology/approachAn online survey was performed to obtain data. As this study aims at investigating the behavior of organizational insiders, LinkedIn, an employment-oriented network site, was chosen as the main site to reach the potential respondents.FindingsThe results show that while performance expectancy, effort expectancy and subjective norms considerably impact intention to use Shadow IT, personal norms and sanctions-related factors exert no influence. Besides, an organizational factor of ethical work climate is found to significantly increase individual perceptions of informal controls and formal controls.Originality/valueThis work is the first attempt to extend the generalizability of the dual-factor theory and UTAUT model, which primarily has been utilized in the context of system usage, to the new context of information security. This study is also one of few studies that simultaneously take both organizational and individual factors into consideration and identify its impacts on user's behaviors in the information security context.

One should really be more worried about too little physical activity than injuries while walking or cycling to school. Parents’ perception of risk concerning active school transportation.

IntroductionActive school transportation (AST) can be a powerful strategy to promote physical activity and improve children's health. Parents' perceptions of traffic risks are an important factor in their decision concerning their child's transport mode to school and addressing discordances between the percieved risks and actual incidents might contribute to promote children's AST. This study adopted a game originally designed for the context of information security to resonate with the context of Swedish AST and the aim of the study was to describe parent's experience of playing the game. MethodsA qualitative approach was chosen and data was collected using focus groups with 16 parents for totally 29 children aged 7–12. The collected data were analyzed using qualitative content analysis. ResultsThe results formed one main theme “Playing promotes parents' awareness and consideration of active school transportation” and three subthemes; “Fast, fun, and functional; Experiences from playing the game” showing that the parents perceived the game to be fun, easy, and time efficient to play. “Then and now. Own childhood experience vs being a parent” showing that parents' perception of risk can sometimes be barriers to their children's opportunity to use AST. “Personal perceptions vs statistical risk” showing that playing the game addressed the discordance between the parents' perceived risks and actual incidents, as well as promoted parents' awareness and consideration of AST. ConclusionsIncluding an intervention component such as a game for parents and using schools as the arena for implementing projects promoting AST to improve children's physical activity levels, might be a fruitful avenue.

Using machine learning algorithms to predict individuals’ tendency to be victim of social engineering attacks

In information security context, social engineering is defined as malicious activities caused by cybercriminals by means of human interactions. It is mainly a psychological manipulation technique which gets benefit of human error to reach private information. This study used machine learning algorithms to predict individuals’ susceptibility to be tricked by social engineering attacks. Simulated scenarios were presented to study participants, and they were asked to identify whether each scenario was a social engineering attack or not. Different kinds of attacks related to various industries were integrated to social engineering simulations. For each participant, different types of social engineering scores were calculated according to their responses. Besides simulations, questionnaires related to demographics, technology usage, and personality traits were filled out by the participants. All of these collected data were used in building predictive classification and regression machine learning models. Through regression and classification models, it was aimed to proactively predict individuals’ social engineering risk levels and classify them into different risk groups in terms of different attack types. This research revealed that it is possible to predetermine the social engineering risk levels of individuals. This important finding means that possible attacks can be prevented by raising awareness before the attack occurs. Within the scope of this study, a social engineering risk detection mobile application has also been developed to give practitioners and policy makers an idea of what kind of systems can be developed in order to determine the risk levels of individuals and then to educate them about various attacks. The ones who need to take action against social engineering attacks will get benefit from findings of this research.

Protecting Against Threats to Information Security: An Attitudinal Ambivalence Perspective

ABSTRACT A popular information security-related motivation theory is the Protection Motivation Theory (PMT) that has been studied extensively in many information security contexts with promising results. However, prior studies have found inconsistent findings regarding the relationships within PMT. To shed light on these inconsistent findings, we introduce the attitudinal ambivalence theory to open the black box within PMT. We tested our model on data collect ed from 1,383 individuals facing potential cyberattacks of their emails in a field experiment. The results of polynomial regression with response surface analysis showed that attitudinal ambivalence is generated from the opposition between an individual’s evaluations of maladaptive rewards and social norms (i.e., descriptive norm and subjective norm). This attitudinal ambivalence, in turn, affects individuals’ evaluations of their coping appraisal process and protection motivation, and ultimately protection behavior. We discuss the theoretical and managerial implications of identifying the determinants and outcomes of attitudinal ambivalence in the information security context. From a theoretical standpoint, our work contributes to the information security literature by incorporating attitudinal ambivalence, which arises from the intrapersonal and interpersonal appraisal processes, into PMT. From a practical standpoint, our work provides insights into designing effective fear appeals to avoid triggering attitudinal ambivalence and thus encouraging adoption of security protection behavior.

Local learning from municipal ransomware attacks: A geographically weighted analysis

The prevalence of security threats like ransomware continues to increase and victimize a wide range of targets, which includes municipal information systems. These attacks are commonly reported in media outlets available in attacked communities. This study seeks to understand how effective news reporting can be toward influencing the behavior of people who live within the proximity of the attack. The results suggest a geographic influence on individual behaviors that could well extend beyond the context of information security into other areas of behavioral IS research.

Technostress and its influence on employee information security policy compliance

PurposeThis study focuses on unintended negative consequences of IT, called technostress. Given that employees are recognized as a major information security threat, it makes sense to investigate how technostress resulting from employees' constant interaction with IT influences the likelihood of security incidents. Although past research studied the concept of security-related technostress, the effect of IT use itself on employees’ extra-role activities such as security-related behaviors is unanswered. Thus, this paper aims to provide an understanding of the negative impact of technostress on employee information security policy (ISP) compliance.Design/methodology/approachDrawing on technostress literature, this research develops a research model that investigates the effect of technostress on employee intention to violate ISPs. It also extends the dimensionality of technostress construct by adding a new dimension called “techno-unreliability” that shows promising results. The authors use online survey data from a sample of 356 employees who have technology-based professions. We apply the structural equation modeling technique to evaluate the proposed research model.FindingsFindings showed that IT use imposes high-level perceptions of a set of technostress creators, which makes users rationalize their ISP violations and engage in non-compliant behaviors. Further analysis of each dimension of technostress showed that techno-complexity, techno-invasion and techno-insecurity account for higher ISP non-compliant behaviors.Originality/valueThis study provides a new understanding of technostress to the context of information security and emphasizes on its negative impact on employee ISP compliance behaviors.

Toward a stage theory of the development of employees’ information security behavior

Existing behavioral information security research proposes continuum or non-stage models that focus on finding static determinants for information security behavior (ISB) that remains unchanged. Such models cannot explain a case where the reasons for ISB change. However, the underlying reasons and motives for users’ ISB are not static but may change over time. To understand the change in reasoning between different antecedents, we examine stage theorizing in other fields and develop the requirements for an emergent theory of the development of employees’ ISB: (1) the content of stages based on the stage elements and their stage-specific attributes; (2) the stage-independent element explaining the instability of ISB; and (3) the temporal order of stages based on developmental progression. To illustrate the stage theory requirements in an information security context, we suggest four stages: intuitive thinking, declarative thinking, agency-related thinking, and routine-related thinking. We propose that learning is a key driver of change between the stages. According to our theorizing, employees start with intuitive beliefs and later develop routine-related thinking. Furthermore, using interview data collected from employees in a multinational company, we illustrate the differences in the stages. For future information security research, we conceptualize ISB change in terms of stages and contribute a theoretical framework that can be empirically validated. In relation to practice, understanding the differences between the stages offers a foundation for identifying the stage-specific challenges that lead to non-compliance and the corresponding information security training aimed at tackling these challenges. Given that users’ ISB follows stages, although not in a specific order, identifying such stages can improve the effectiveness of information security training interventions within organizations.

Matching training to individual learning styles improves information security awareness

Purpose This paper aims to introduce the concept of a framework of cyber-security controls that are adaptable to different types of organisations and different types of employees. One of these adaptive controls, namely, the mode of training provided, is then empirically tested for its effectiveness. Design/methodology/approach In total, 1,048 working Australian adults completed the human aspects of the information security questionnaire (HAIS-Q) to determine their individual information security awareness (ISA). This included questions relating to the various modes of cyber-security training they had received and how often it was provided. Also, a set of questions called the cyber-security learning-styles inventory was used to identify their preferred learning styles for training. Findings The extent to which the training that an individual received matched their learning preferences was positively associated with their information security awareness (ISA) level. However, the frequency of such training did not directly predict ISA levels. Research limitations/implications Further research should examine the influence of matching cyber-security learning styles to training packages more directly by conducting a controlled trial where the training packages provided differ only in the mode of learning. Further research should also investigate how individual tailoring of aspects of an adaptive control framework (ACF), other than training, may improve ISA. Practical implications If cyber-security training is adapted to the preferred learning styles of individuals, their level of ISA will improve, and therefore, their non-malicious behaviour, whilst using a digital device to do their work, will be safer. Originality/value A review of the literature confirmed that ACFs for cyber-security does exist, but only in terms of hardware and software controls. There is no evidence of any literature on frameworks that include controls that are adaptable to human factors within the context of information security. In addition, this is the first study to show that ISA is improved when cyber-security training is provided in line with an individual’s preferred learning style. Similar improvement was not evident when the training frequency was increased suggesting real-world improvements in ISA may be possible without increasing training budgets but by simply matching individuals to their desired mode of training.

Response awareness and instructional self-efficacy: influences on intent

Purpose This paper aims to examine the influence of response awareness on behavioral intent, and introduces instructional self-efficacy, a construct rarely examined within the context of information security (ISec). Design/methodology/approach A Web-based survey was conducted and a total of 211 valid responses were analyzed. The relationships among response awareness, instructional self-efficacy and behavioral intent were examined through a three-phase structural equation modeling analysis. Findings The results indicate that even at low levels, response awareness has a strong influential effect on the behavioral intent to perform the secure response and on the self-efficacy to instruct others to perform the response. Instructional self-efficacy was also found to be a significant predictor of behavioral intent to perform the response. Finally, evidence was found indicating instructional self-efficacy fully mediates the response awareness to the behavioral intent relationship. Research limitations/implications Because of the characteristics of the population, the focus on a single ISec response and the dependent variable of behavioral intent rather than actual behavior, the generalizability of the findings is impacted. Practical implications The results contribute to practice by confirming the importance of response awareness and of instructional self-efficacy within an ISec context. Specific implications include the indication that informal communications about ISec issues among peers should be encouraged and that instructional self-efficacy should be targeted within ISec awareness training programs. Originality/value This paper’s parsimonious model defined response awareness as vicarious experience with a response and presented instructional self-efficacy, a construct novel to ISec studies that was found to be a significant influence within the relationship between response awareness and behavioral intent.

Диверсифікація джерел інформації в контексті інформаційної безпеки

Диверсифікація джерел інформації в контексті інформаційної безпеки

Understanding commitment and apathy in is security extra-role behavior from a person-organization fit perspective

ABSTRACTThis study presents an empirical investigation of employees’ extra-role behaviour in the information security context based on person – organisation fit theory. The perspective of fit evaluates the differences and similarities between information security policy makers and practitioners to provide employees with an approach to decide whether and how to participate in the implementation of extra security actions. We developed a research model and then conducted a survey and PLS-SEM analysis to test the corresponding hypothesis. The results illustrate that perceived demand – ability fit, perceived need – supply fit, and perceived value fit are effective in motivating security commitment. The empirical evidence shows that security commitment is a partial mediator between complementary fits (demand-ability fit and need-supply fit) and participation intention and is a full mediator between supplementary fit (value fit) and participation intention. In addition, apathy reduces motivation to engage in extra-role behaviour, while value fit and security commitment eliminate such apathy.

On serendipity: The happy discovery of unsought knowledge

On serendipity: The happy discovery of unsought knowledge

The impact of leadership on employees' intended information security behaviour: An examination of the full‐range leadership theory

AbstractExplaining the influence of management leadership on employees' information security behaviour is an important focus in information systems research and for companies and organizations. Unfortunately, the role of leadership has remained largely unexplored in the information security context. Our study addresses this gap in literature: how the dimensions of full‐range leadership influence employees' intended information security behaviour. Consequently, our study takes an interactional psychology perspective and links the dimensions of the full‐range model of leadership to employees' security compliance intention and security participation intention. We tested our multitheoretical model using Smart PLS 3.2.7 on a proprietary data set of 322 professionals in more than 14 branches throughout different regions worldwide. Our study contributes to the literature on information security, management, and leadership by exploring how and why different leadership styles enhance employees' intended information security behaviour. Our empirical findings emphasize the importance of transformational leaders because they are capable of directly influencing employees on the extra‐role and in‐role behaviour levels. Our results indicate new directions for information security and leadership research and implications for leadership practices.

How Much Should We Spend to Protect Privacy?: Data Breaches and the Need for Information We Do Not Have

A cost/benefit approach to privacy confronts two tradeoff issues. One is making appropriate tradeoffs between privacy and many goals served by the collection, distribution, and use of information. The other is making tradeoffs between investments in preventing unauthorized access to information and the variety of other goals that also make money, time, and effort demands. Much has been written about the first tradeoff. We focus on the second. The issue is critical. Data breaches occur at the rate of over three a day, and the aggregate social cost is extremely high. The puzzle is that security experts have long explained how to defend better. So why does society tolerate a significant loss that it has the means to avoid? Some may object that society does not tolerate breaches. Laws—current and proposed—impose requirements aimed at improving information security. However, as Thomas Smedinghoff notes, most of the laws “simply obligate companies to establish and maintain ‘reasonable’ or ‘appropriate’ security measures, controls, safeguards, or procedures, but give no further direction or guidance.” The approach has so far failed to provide an adequate incentive to improve information security. As one commentator notes, the “bad guys basically go where they want to go and do what they want to do, and they're not being stopped. Maybe for every one organization that's effectively stopping attacks, there are 100 that are being breached.” We argue that the problem is not so much a lack of legal guidance as it is a lack of information. A standard cost/benefit approach is particularly suitable here. In the information security context, a business should adopt the following risk management goal: choose the most effective defense meeting the condition that the defense cost is not greater than the expected (business and relevant third-party) losses thereby avoided (over some appropriate short- or long-term time period). Businesses fall far short of a good approximation to business risk management goal. Applying this standard requires reasonably accurate information about the probability of a breach and the losses that will occur if it happens. Unfortunately, we are currently very far from having adequate information about either. The World Economic Forum report paints an accurate, if disturbing, picture of the consequences: “businesses are increasingly delaying the adoption of technological innovations due to inadequate understandings of required countermeasures. . . . A vicious circle results: uncertainty regarding proper levels of preparedness leads to forestalled investments in safeguards as interconnection expands exponentially.” A lack—even a severe lack—of objective information about probability and cost does not imply a complete inability to make better and worse decisions about information security. One can turn to subjective expert judgments and a variety of sophisticated analytic techniques that make use of them. Security outsourcing companies like AllClearID, BayDynamics, Healthguard Cyber Risk Management, and FireEye take this approach. Whatever its virtues, the “subjective judgment” approach can still spend far less or far more than the risk management goal requires. It is not a reliable guide to the optimal investment. We think the best course is to turn the unanswerable question into an answerable one by taking steps to discover the information need to adequately approximate the risk management goal. We see no alternative to the slow road of discovering the necessary information. This solution may seem singularly unappealing. Isn’t there a quicker fix? Data breach notification laws may seem to offer just that. There are at least two reasons to have breach notification laws. One is that the notifications are a source of precisely the information we need. The second is—so it is claimed—that they improve security. We focus on the second claim, which we argue is likely false. Indeed, such laws may make security worse (by focusing resources on avoiding reportable breaches, not on meeting the risk management goal). Breach notification laws are at best an uncertain road to improving risk management. The more certain, if longer, road is to get the information risk management needs. We argue for mandatory anonymous report by businesses of relevant information about data breaches.

Mobile device users’ privacy security assurance behavior

PurposeRecently, the spread of malicious IT has been causing serious privacy threats to mobile device users, which hampers the efficient use of mobile devices for individual and business. To understand the privacy security assurance behavior of mobile device users, this study aims to develop a theoretical model based on technology threat avoidance theory (TTAT), to capture motivation factors in predicting mobile device user’s voluntary adoption of security defensive software.Design/methodology/approachA survey is conducted to validate the proposed research model. A total of 284 valid survey data are collected and partial least square (PLS)-based structural equation modeling is used to test the model.FindingsResults highlight that both privacy concern and coping appraisal have a significant impact on the intention to adopt the security defensive software. Meanwhile, privacy security awareness is a crucial determinant to stimulate mobile device user’s threat and coping appraisal processes in the voluntary context. The results indicate that emotional-based coping appraisal of anticipated regret is also imperative to arouse personal intention to adopt the security tool.Practical implicationsThis result should be of interest to practitioners. Information security awareness training and education programs should be developed in a variety of forms to intensify personal security knowledge and skills. Besides, emotion-based warnings can be designed to arouse users’ protection behavior.Originality/valueThis paper embeds TTAT theory within the mobile security context. The authors extent TTAT by taking anticipated regret into consideration to capture emotional-based coping appraisal, and information security awareness is employed as the antecedent factor. The extent offers a useful starting point for the further empirical study of emotion elements in the information security context.

To fear or not to fear? A critical review and analysis of fear appeals in the information security context

To fear or not to fear? A critical review and analysis of fear appeals in the information security context

Continuance of protective security behavior: A longitudinal study

Previous research has established continuance models that explain and predict an individual's behaviors when engaged with hedonic or functional systems, or with other environments that provide productivity-enhancing outcomes. However, within the context of information security, these models are not applicable and fail to accurately assess the circumstances in which an individual engages in protective security behaviors beyond an initial adoption. This research addresses this gap and establishes a model for explaining an individual's continued engagement in protective security behaviors, which is a significant problem in securing enterprise information resources. Within this model, protection motivation theory (PMT) is considered an underlying theoretical motivation for continuance intention using constructs such as perceived threat severity, perceived threat susceptibility, self-efficacy, and response efficacy as direct antecedents of behavioral intents and indirect predictors of continuance behavior. Furthermore, the introduction of perceived extraneous circumstances is used to reconcile the “acceptance–discontinuance anomaly.” A novel research methodology for measuring actual security behavior continuance was developed for this investigation. Experimental results indicate support for all of the proposed relationships, with the exception of response efficacy—continuance intent. Nearly half of the variance in the dependent variable, continuance behavior, was explained by the model. This is the first comprehensive empirical investigation of protective security behavior continuance intention. The findings have practical implications for security administrators and security technology solution providers, and they have theoretical ramifications in the area of behavioral information security and protection motivation theory.

Enterprise Information Systems within the Context of Information Security: A Risk Assessment for a Health Organization in Turkey

Enterprise information systems implemented in the organizations are critical assets to provide competitive advantage in changing sectoral conditions and continuity of business processes and management of enterprise resources. In this regard, information security approaches and assessment techniques are used to examine the maturity level of enterprise and determine the risks and potential solutions for enterprise information systems. This study aims to measure information systems in terms of information security and risks. On the other hand, it is also aimed to describe the potential effects of assessment techniques and tools for state organizations to manage their critical assets. In order to achieve these aims, information systems of one of the large scale health sector organizations in Turkey were assessed via an international assessment tool that is adapted to Turkish conditions in some parts like legal regulations. The results obtained through assessment tool provide the current maturity level of the organization and remark the points that should be improved for the security of information systems and the critical components such as risks, processes, people, IT reliance and technology.

Perceived significance of information security governance to predict the information security service quality in software service industry

Purpose – Information security is a growing concern in society, across businesses and government. As the offshore IT services market continues to grow providing numerous benefits, there are also perceived risks with respect to the quality of information security delivered in the supply chain. This paper aims to examine, as a case, the perceptions of Indian software services provider (service provider) employees with respect to information security governance and its impact on information security service quality that is delivered to customers. Design/methodology/approach – The paper provides a framework built upon the existing dimensions and instruments for total quality management and service quality, suitably modified to reflect the context of information security. SmartPLS, a structural equation modelling technique, has been used to analyse field survey data collected from across various Indian cities and companies. Findings – Significant finding is that information security governance in an IT outsourcing company providing software services has a highly significant impact on the information security service quality, which can be predicted. The paper also establishes that there is a positive relationship collectively between elements of information security governance and information security service quality. Research limitations/implications – Since data used in this study were taken solely from the responses of employees of outsourced service companies in India, it does not show if this translates into service improvements as perceived by the customer. Practical implications – Information security governance should be made an integral part of corporate governance and is an effective strategic technique, if software outsourcing business enterprises want to achieve a competitive edge, provide client satisfaction and create trust. Originality/value – The paper presents empirical data validation of the connection between information security governance and quality of service.

Deriving an information security assurance indicator at the organizational level

Purpose – Measurement of information security assurance (ISA) is an important but difficult task. This paper aims to propose a framework, which helps in refining information security requirements into controls whose effectiveness can be measured. This work also provides aggregation techniques to combine these measurements so as to obtain an indicator for ISA at the organizational level. Design/methodology/approach – A top-down approach of refining security objectives to measurable independent tasks is carried out using assign graph as the model. This captures the various objectives and their interrelationships whose initial values and relative impacts are obtained from experts. Using fuzzy cognitive model (FCM), these initial values are combined together to obtain an indicator for ISA at the firm's level. Findings – The two applications of the framework revealed that interrelationships do exist between the different controls employed in actual security implementations and that these dependencies are seldom accounted for. When those few controls that are to be measured are clearly identified, the security experts can focus their attention on them and ensure their correct implementation and appropriate measurement. The extent of impact of a single control on the overall security picture of the firm can also be found using this approach. Research limitations/implications – While the framework is generic, the assurance values obtained are context-sensitive. This is primarily because of the subjectivity involved in assigning impact measures and initial values. Practical implications – This work helps in answering two difficult questions in information security management: “what to measure?” and “how to quantify the overall security assurance of the organization?” This assists the information security team in identifying and refining those controls that needs to be appropriately emphasized. The proposed framework helps the top management in doing “what-if” analysis, thereby aiding their decision-making for information security investments. Originality/value – The novel framework proposes a top-down approach for security control refinement and a bottom-up approach for combining the confidence values to obtain an indicator for ISA. This work identifies and accommodates the possibilities of having interdependencies between security controls. The proposed aggregation method using FCM is being applied for the first time in information security context and provides convergence even in the presence of cyclic dependencies amongst the controls.