Information Security Research Research Articles

InfoSec Process Action Model (IPAM)

While much of the extant InfoSec research relies on single assessment models that predict intent to act, this article proposes a multi-stage InfoSec Process Action Model (IPAM) that can positively change individual InfoSec behavior. We believe that this model will allow InfoSec researchers to focus more directly on the process that leads to action and develop better interventions that address problematic security behaviors. Building on successful healthcare efforts that resulted in smoking cessation, regular exercise, and a healthier diet, among others, IPAM is a hybrid predictive process approach to behavioral InfoSec improvement. IPAM formulates the motivational antecedents of intent as separate from the volitional drivers of behavior. Singular fear appeals often seen in InfoSec research are replaced by more nuanced treatments appropriately differentiated to support behavioral change as part of a process; phase-appropriate measures of self-efficacy are employed to more precisely assess the likelihood that a participant will act on good intentions; and decisional balance assessment of pro and con perceptions is monitored over time. These notions better align InfoSec research with both leading security practice and successful comparators in healthcare. We believe IPAM can both help InfoSec research models better explain actual behavior and better inform practical security behavior improvement initiatives.

The Organization Man and the Innovator

Behavioral information security research exhibits a preoccupation with security policy, bureaucratic control, and policy compliance and noncompliance. This preoccupation implicitly treats employees as the sociological archetype described by Whyte (1956), the Organization Man. In doing so, the literature has dedicated less time to the study of other archetypes. In this paper, we compare the Organization Man to the Innovator, an amalgam of the Bricoleur and Engineer archetypes identified by Levi-Strauss (1966). We posit that the Innovator archetype may be more prevalent during times of organizational strain and excess. We develop a theoretical framework to explain how situational factors, namely organizational strain and excess, affect individuals' risk perceptions and their willingness to adopt different archetypal personae (i.e., dispositional factors). The framework further suggests that each archetypal persona will behave differently to common security situations. Finally, the framework suggests that the organization's perceptions of employee behavior will provide a feedback loop that further affects the adoption of different archetypes.

Secure Behavior over Time

Research has investigated the role of numerous influences on individual information security behaviors, including protection motivation, deterrence, and various dispositional and environmental factors. Various theories have been applied to study these influences on security behaviors. One major research stream has looked at threat and coping appraisals by IT users. However, users' beliefs, attitudes, appraisals, and intentions are not static, and there has been little attention to how these factors interact over time. When users (directly or vicariously) experience a security threat, they tend to engage in improved security hygiene, but often only for a limited time. A major theory that can provide comprehensive and unified insights into the phenomenon of continuous secure behavior is the Theory of Process Memory which explains the role of prior experience effects and the underlying mechanisms of continuous behavior, including feedback mechanism, sequential updating mechanism, behavioral automaticity (habit), and reason-based action. The application of this theory to behavioral information security research can foster a deep understanding about how each cognitive mechanism can influence IT users' continuous secure behavior, and through which type of human memory each mechanism can act. This rich theory, which is well-established in cognitive psychology, can help behavioral information security scholars to rigorously investigate the very important, yet understudied, phenomenon of continuance secure behavior.

New Theoretical Perspectives in Behavioral IS Security Research

As we come to press with this fifth issue of the year, we have an exciting development. It is a special case, this issue; we normally have issues 1 through 4 for each volume, but we chose this year to issue number "SI" in addition to issues 1,2,3, and 4, in order to accommodate something very special. The grand joy of editing a journal is the ability to do something unusual and innovative occasionally. With Stacie's concurrence, that is what we did this time around. As you may know, I am a member of the Behavioral Information Security society that styles itself through the highly prestigious "IFIP Working Group 8.11/11.13 Dewald Roode Behavioral Information Security Workshop." This special workshop is an event that takes place each year among the most visible and prolific information security scholars in the world. And, having gained admittance to their august company not so long ago, I sought an opportunity for The DATA BASE for Advances in Information Systems to support and promote behavioral information security research through its presence at the meetings (by virtue of my membership, as an Editor). A couple of meetings ago, when the call for papers went out for the annual research competition that provides the manuscripts for the meeting, I sought permission to issue a joint call for papers on behavior for a special issue of The DATA BASE dedicated to "Theoretical Advances in Behavioral Information Security Research." To my vast delight, the colleagues assented, indicating they thought it was a good idea. (Caveat: what follows will gore several oxen. My apologies in advance, but what needs to be said will inevitably cross lines of mild political sensibility, in the greater service of Theoretical Advancement.)

The impact of collectivism and psychological ownership on protection motivation: A cross-cultural examination

Increased deregulation and globalization have encouraged organizations to expand the cultural diversity of their employees. Integrating each employee into an organization's culture, including practices regarding the protection of information, is critical. Because active employee participation is important for security, managers may need to evaluate individual cultural values to motivate employees to perform secure behaviors. This study analyzes these potential differences by examining two individual characteristics – collectivism and psychological ownership of information – within the context of information security-related behaviors. The results of this study indicate that an individual's personal orientation toward collectivism has an impact on psychological ownership and the intention not to perform secure behaviors. Furthermore, psychological ownership was shown to have a significant impact on the protection motivation constructs as well as on intention. The findings of this study contribute to information security research by studying collectivism's effect on psychological ownership and psychological ownership's impact on protection motivation.

The impact of information security threat awareness on privacy-protective behaviors

In this study, we examine how to motivate computer users to protect themselves from potential security and privacy threats. We draw on the Information Processing framework which posits that threat mitigation commonly occurs before full cognitive threat assessment and we conduct an empirical study to evaluate the effects of an exposure to general information security threats on the strength of passwords and the disclosure of personal information. Through an online experiment, we compare immediate computer user reactions to potential non-individually specific security and privacy threats in an extra-organizational context. We find evidence consistent with automatic security and privacy protective actions in response to these threats. Computer users exposed to news stories about corporate security breaches limit the disclosure of sensitive personal information and choose stronger passwords. The study complements the existing behavior modification research in information security by providing the theoretical and empirical foundation for the exploration of automatic security and privacy threat mitigation strategies across different contexts.

Design of a Cyber Security Research Lab

Important considerations in the design of a network security teaching and research lab are discussed in the context of the University Of Management and Technology Graduate Network Security MS course. The main objective is to provide a learning and research environment for the student to enrich their understanding of the network and computer security theory taught in the classroom with an extensive set of complementary hands-on laboratory exercises. The mission of Information security and DFIR Laboratory is to support varied demands of research, education, and outreach in information security and cyber forensics. More specifically, the laboratory must be able to be used by professors for conducting research activities; individual student thesis and project work, class projects on information security topics, and to support faculty and students partnering with industry on issues of practical security.The type of expected research projects include Information Hiding, Tracing and Watermarking, Intrusion Detection and prevention, Applications of Machine Learning in Information Security, Key Distribution, Escrow and Security Protocols, Survivable Computation, Cryptography, Malware analysis and classification, Mobile Device Security and Forensics, Software Security, Vulnerability Assessments and Penetration Testing to name a few.

Value conflicts and non-compliance

PurposeThe purpose of the study is to explore potential value conflicts between information security work and whistleblowing activities by analysing attitudes to whistleblowing among white-collar workers in Swedish organisations.Design/methodology/approachThe study is conducted using survey data among (n = 674) Swedish white-collar workers. Statistical analyses are conducted to explore variations in acceptance of whistleblowing and analyse the relationship between acceptance for whistleblowing and information security attitudes and behaviours.FindingsThe study finds strong support for whistleblowing in both public and private spheres, and by both private and public sector employees. The study also finds stronger acceptance for intra-organisational whistleblowing, while support for external whistleblowing is low. Finally, the study shows that the whistleblowing activities might be perceived as coming in conflict with information security work, even as the support for including whistleblowing functions in information security practices is high.Research limitations/implicationsWith a focus on one country, the study is limited in terms of empirical scope. It is also limited by a relatively small number of respondents and survey items relating to whistleblowing, which in turn affects its explanatory value. However, the study does provide unique new insight into a specific form of “non-compliance”, i.e. whistleblowing, which merits further investigation.Originality/valueFew studies exist that combine insights from the fields of whistleblowing and information security research. Thus, this study provides a basis for further investigation into attitudes and behaviours linked to whistleblowing in public and private organisations, as well as attendant value conflicts related to information security management and practice.

Information Security Compliance in Organizations: An Institutional Perspective

AbstractThe increasing recognition of the importance of information security has created institutional pressures on organizations to comply with information security standards and policies for protecting their information. How such pressures influence information security compliance in organisations, however, is unclear. This paper presents an empirical study to investigate the impact of institutional pressures on information security compliance in organizations. With the use of structural equation modelling for analysing the data collected through an online survey, the study shows that coercive pressures, normative pressures, and mimetic pressures positively influence information security compliance in organizations. It reveals that the benefits of information security compliance motivate management to strengthen their commitments at information security compliance. Furthermore, the study finds out that social pressures do not have a significant impact on management commitments towards information security compliance. Theoretically this study contributes to the information security research by better understanding how institutional pressures can be used for enhancing information security compliance in organizations. Practically this study informs information security policy makers of the major institutional drivers for information security compliance.

How senior management and workplace norms influence information security attitudes and self-efficacy

ABSTRACTPrior information security research establishes the need to investigate the informal factors that influence employee attitudes and self-efficacy beliefs about information security. Two informal workplace dynamics that are particularly important for how employees think about information security comprise senior management support and workplace norms. However, there are limitations to empirical research to date on these constructs, including conflicting evidence on the relationship between senior management support and information security attitudes and a lack of research on how norms impact self-efficacy beliefs. Also, although some studies suggest that norms might play a mediating role between information security attitudes, self-efficacy beliefs and their (informal and formal) antecedents, empirical research is yet to investigate these possibilities. Consequently, this study considers the relationships between senior management support, norms, formal controls and information security attitudes and self-efficacy beliefs. It comprises a cross-sectional survey of employees at a law enforcement organisation. Results indicate the central role that norms have on employee information security attitudes and self-efficacy beliefs including their direct and mediating role. In addition, the study highlights the important role that senior management support has on employees’ thinking about information security.

Measuring attitude towards personal data for adaptive cybersecurity

PurposeThis paper presents an initial development of a personal data attitude (PDA) measurement instrument based on established psychometric principles. The aim of the research was to develop a reliable measurement scale for quantifying and comparing attitudes towards personal data that can be incorporated into cybersecurity behavioural research models. Such a scale has become necessary for understanding individuals’ attitudes towards specific sets of data, as more technologies are being designed to harvest, collate, share and analyse personal data.Design/methodology/approachAn initial set of 34 five-point Likert-style items were developed with eight subscales and administered to participants online. The data collected were subjected to exploratory and confirmatory factor analyses and MANOVA. The results are consistent with the multidimensionality of attitude theories and suggest that the adopted methodology for the study is appropriate for future research with a more representative sample.FindingsFactor analysis of 247 responses identified six constructs of individuals’ attitude towards personal data: protective behaviour, privacy concerns, cost-benefit, awareness, responsibility and security. This paper illustrates how the PDA scale can be a useful guide for information security research and design by briefly discussing the factor structure of the PDA and related results.Originality/valueThis study addresses a genuine gap in research by taking the first step towards establishing empirical evidence for dimensions underlying personal data attitudes. It also adds a significant benchmark to a growing body of literature on understanding and modelling computer users’ security behaviours.

Why security and privacy research lies at the centre of the information systems (IS) artefact: proposing a bold research agenda

In this essay, we outline some important concerns in the hope of improving the effectiveness of security and privacy research. We discuss the need to re-examine our understanding of information technology and information system (IS) artefacts and to expand the range of the latter to include those artificial phenomena that are crucial to information security and privacy research. We then briefly discuss some prevalent limitations in theory, methodology, and contributions that generally weaken security/privacy studies and jeopardise their chances of publication in a top IS journal. More importantly, we suggest remedies for these weaknesses, identifying specific improvements that can be made and offering a couple of illustrations of such improvements. In particular, we address the notion of loose re-contextualisation, using deterrence theory research as an example. We also provide an illustration of how the focus on intentions may have resulted in an underuse of powerful theories in security and privacy research, because such theories explain more than just intentions. We then outline three promising opportunities for IS research that should be particularly compelling to security and privacy researchers: online platforms, the Internet of things, and big data. All of these carry innate information security and privacy risks and vulnerabilities that can be addressed only by researching each link of the systems chain, that is, technologies–policies–processes–people–society–economy–legislature. We conclude by suggesting several specific opportunities for new research in these areas.

Criminal liability of the artificial intelligence

The article deals with the influence of robotics units on the life of modern mankind, the possibility of creating an artificial intelligence equal to the human intelligence or exceeding its level, the possibilities and validity of the recognition of artificial intelligence physically embodied in a robotics unit by an object and (or) subject of criminal legal relations, the relationship between information security and artificial intelligence research and its results.

From Information Security Awareness to Reasoned Compliant Action

Despite the importance of information security, far too many organizations, in particular banks, are facing behavioral information security incidents. In the context given by the headquarters of a large European banking organization, this single case study investigates whether individual behavioral compliance with the information security policy is influenced by accumulated security information and information security awareness embedded within the theory of reasoned action in an extended norms approach. We collected empirical data through a three-staged process in which we conducted semi-structured interviews, implemented a survey to test the developed research hypotheses, and engaged in interactive presentations to discuss the results. In particular, the qualitative interviews strengthened internal validity of survey constructs related to neutralization techniques and internal channel use for information acquisition. We found that the attitude toward information security policy compliance, and not only social norms but also personal norms related to neutralization techniques, are all significant variables potentially mitigating the knowing-doing gap reported in related information security research. Besides emphasizing the importance of extended norms, which should be accounted for in information security awareness programs, we also highlight the use of internal and external channels to acquire information as initial drivers of awareness. The empirical findings provide implications to practice and advance theoretical development by generally supporting the developed model that accounts for compliant information security behavior at an international bank.

Old risks, new challenges: exploring differences in security between home computer and mobile device use

ABSTRACTHome users are particularly vulnerable to information security threats as they must make decisions about how to protect themselves, often with little knowledge of the technology. Furthermore, information for home users tends to focus on the traditional PC and may downplay threats faced on mobile devices, transforming well-known and old risks into new challenges for information security. To address the need for more behavioural information security research that focusses on mobile devices, this paper reports on the first large-scale study comparing security perceptions and behaviours on home computer and mobile devices. Data from 629 users revealed that in addition to differences in information security behaviour, the following security-related perceptions all differ significantly between home computer and mobile device use: perceived severity, security self-efficacy, response efficacy, response cost, descriptive norm, psychological ownership and intention to perform security behaviours. In each case, the direction of the difference was such that mobile devices were more likely to be at risk than a home computer. The practical implications of these differences are discussed.

Criminal liability of artificial intelligence

The article deals with the influence of robotics objects on the life of modern mankind, the possibility of creating an artificial intellect equal to the human intellect or exceeding its level, the possibilities and reasonability of the recognition of artificial intelligence physically embodied in the robotics object as the object and (or) the subject of criminal legal relations, the relationship between information security and artificial intelligence research and its results.

Organisational culture, procedural countermeasures, and employee security behaviour

PurposeThis paper provides new insights about security behaviour in selected US and Irish organisations by investigating how organisational culture and procedural security countermeasures tend to influence employee security actions. An increasing number of information security breaches in organisations presents a serious threat to the confidentiality of personal and commercially sensitive data. While recent research shows that humans are the weakest link in the security chain and the root cause of a great portion of security breaches, the extant security literature tends to focus on technical issues.Design/methodology/approachThis paper builds on general deterrence theory and prior organisational culture literature. The methodology adapted for this study draws on the analytical grounded theory approach employing a constant comparative method.FindingsThis paper demonstrates that procedural security countermeasures and organisational culture tend to affect security behaviour in organisational settings.Research limitations/implicationsThis paper fills the void in information security research and takes its place among the very few studies that focus on behavioural as opposed to technical issues.Practical implicationsThis paper highlights the important role of procedural security countermeasures, information security awareness and organisational culture in managing illicit behaviour of employees.Originality/valueThis study extends general deterrence theory in a novel way by including information security awareness in the research model and by investigating both negative and positive behaviours.

The quest for complete security: An empirical analysis of users’ multi-layered protection from security threats

Individuals can perform many different behaviors to protect themselves from computer security threats. Research, however, generally explores computer security behaviors in isolation, typically looking at one behavior per study, such as usage of malware or strong passwords. However, defense in depth requires that multiple behaviors be performed concurrently for one’s computer to be protected. Addressing this gap in prior research, this study measures 279 individuals’ computer security behaviors and analyzes them with multi-dimensional scaling. We examined three security threats: security related performance degradation, identify theft, and data loss. The results present a mapping of security behaviors performed together with other behaviors on two dimensions for each of these threats. Using expert reviews of the resulting dimensions, the study proposes that response efficacy and response cost help explain why people perform certain behaviors together. These findings can help explain inconsistent results in prior information security research because they focused on one behavior only whereas people perform various security behaviors together in an effort to mitigate specific security threats. The study informs research and practice by identifying security threat-response pairs via expert interviews, surveying individuals on how they perform multiple security behaviors concurrently to mitigate security threats, identifying why certain behaviors are performed together, and using these findings to identify reasons why IS security research has confounding results based on specific individual threat-response pairs used in prior studies.

Applications of social network analysis in behavioural information security research: Concepts and empirical analysis

The rapid digital transformation and technological disruption in modern organisations demand the development of people-centric security workplaces, whereby the employees can build up their security awareness and accountability for their actions via participation in the organisation's social networks. The social network analysis approach offers a wide array of analytical capabilities to examine in-depth the interactions and relations within an organisation, which assists the development of such security workplaces. This paper proposes the novel and practical adoption of social network analysis methods in behavioural information security field. To this end, we discuss the core features of the social network analysis approach and describe their empirical applications in a real case study of a large organisation in Vietnam, which utilised these methods to improve employees' information security awareness. Towards the end of the paper, a framework detailing the strategies for conducting social network analysis in the behavioural information security field is developed and presented.

Leveraging Human Thinking Style for User Attribution in Digital Forensic Process

User attribution, the process of identifying a human in a digital medium, is a research area that has receive significant attention in information security research areas, with a little research focus on digital forensics. This study explored the probability of the existence of a digital fingerprint based on human thinking style, which can be used to identify an online user. To achieve this, the study utilized Server-side web data of 43-respondents were collected for 10-months as well as a self-report thinking style measurement instrument. Cluster dichotomies from five thinking styles were extracted. Supervised machine-learning techniques were then applied to distinguish individuals on each dichotomy. The result showed that thinking styles of individuals on different dichotomies could be reliably distinguished on the Internet using a Meta classifier of Logistic model tree with bagging technique. The study further modeled how the observed signature can be adopted for a digital forensic process, using high-level universal modeling language modeling process- specifically, the behavioral state-model and use-case modeling process. In addition to the application of this result in forensics process, this result finds relevance and application in human-centered graphical user interface design for recommender system as well as in e-commerce services. It also finds application in online profiling processes, especially in e-learning systems