Security Behavior Research Articles

Optimism bias in susceptibility to phishing attacks: an empirical study

Purpose Researchers looking for ways to change the insecure behaviour that results in phishing have considered multiple possible reasons for such behaviour. Therefore, the purpose of this paper is to understand the role of optimism bias (OB – defined as a cognitive bias), which characterises overly optimistic or unrealistic individuals, to ensure secure behaviour. Research that focused on issues such as personality traits, trust, attitude and Security, Education, Training and Awareness (SETA) was considered. Design/methodology/approach This study built on a recontextualized version of the theory of planned behaviour to evaluate the influence that optimism bias has on phishing susceptibility. To model the data, an analysis was performed on 226 survey responses from a South African financial services organisation using partial least squares (PLS) path modelling. Findings This study found that overly optimistic employees were inclined to behave insecurely, while factors such as attitude and trust significantly influenced the intention to behave securely. Practical implications Our contribution to practice seeks to enhance the effectiveness of SETA by identifying and addressing the optimism bias weakness to deliver a more successful training outcome. Originality/value Our study enriches the Information Systems literature by evaluating the effect of a cognitive bias on phishing susceptibility and offers a contextual explanation of the resultant behaviour.

"No point worrying" – The role of threat devaluation in information security behavior

Extant information security research is characterized by a focus on problem-focused security behaviours, while overlooking the internal, and emotion-focused coping responses that humans exhibit. Threat devaluation, where severity is downplayed, is an established dimension of risk perception, and yet it has not been considered in information security research to date. We address this gap by developing and empirically testing a research model of how threat and coping factors from Protection Motivation Theory influence both problem-focused and emotion-focused coping responses. Data was collected from 518 users and PLS was used to reveal the determinants of, and the relationship between, problem-focused and emotion-focused coping behaviors. The results demonstrate that threat devaluation is a measurable outcome of all threat and coping appraisals considered, providing evidence that multiple coping strategies may be involved in a security threat situation. We also find that many of the well-established determinants of information security behavior, such as self-efficacy, are significantly related to emotion-focused responses. This has implications for researchers and practitioners who seek to create secure environments where users are more likely to enact constructive and problem-focused security behaviors.

Reliability and validity of the Cybersecurity Awareness INventory (CAIN)

ABSTRACT The Cybersecurity Awareness INventory (CAIN) was introduced by Tempestini and colleagues (2023, “The Cybersecurity Awareness INventory (CAIN): Early Phases of Development of a Tool for Assessing Cybersecurity Knowledge Based on the ISO/IEC 27032.” Journal of Cybersecurity and Privacy 3 (1): 61–75) as a proficiency test designed to estimate individuals’ knowledge of cyber threats. The questionnaire was based on ISO/IEC 27032:2012 (Information Technology – Security Techniques – Guidelines for Cybersecurity) and consisted of 46 items. In this paper, we present the results of a survey study conducted on a sample of 1511 Italian workers belonging to the same large organisation. The administration of the CAIN to an Italian sample forced us to make an adaptation to the Italian language of the questionnaire. Using Rasch analysis, we improved the CAIN by eliminating some items that did not fit the expected response patterns, leading to a newer and more parsimonious 30-item version. the CAIN score was also used as the dependent variable in a series of ANOVA designs using several security behaviours as factors. That allowed us to test its predictive validity, confirming the ability of the instrument to discriminate between different user profiles with respect to reported security behaviours. Overall, the revised test showed better performance in terms of reliability and validity.

Presidential attentiveness to international crises

AbstractWhy, and under what conditions, do international crises make the president's national security agenda? I argue that international crises are opportunities for presidents to seek domestic political gains, but that presidents are likely to weigh anticipated political benefits against anticipated risk of political opposition. I analyze presidential National Security Council (NSC) meeting agendas from 1947 to 1993 to find that the War Powers Resolution (WPR) of 1973 reduced the likelihood of presidential crisis attentiveness, that low approval ratings are associated with increased crisis attentiveness, and that post‐WPR presidents under unified government are likely to be more crisis attentive. This article provides fresh analysis of the WPR by connecting presidential national security behavior with American domestic politics.

Fostering security-related citizenship through the employee-supervisor relationship: An examination of supervisor security embodiment

Organizational information security performance is increasingly dependent on employees’ security-related citizenship behaviors that stretch beyond the scope of formal organizational prescription and control. Unfortunately, cultivating enactment of these valued behaviors has proven challenging for many companies. The literature has recognized workplace relationships as important determinants of behavioral security outcomes and extra-role security behaviors (ERBs) in particular. Taken further, an employee's relationship with the immediate supervisor is recognized as one of the most influential relational factors shaping a variety of workplace behaviors, including those related to security. Consistent with these notions, scholars have called for making the employee-supervisor relationship a more central component of behavioral security research and practice. Currently however, beyond recognition of this relationship's importance, the knowledge base is unclear about how it shapes ERB enactment. Because employees view supervisors as both organizational agents and as individuals in their own rights, this relationship has the potential to drive productive or counterproductive security behaviors, depending on how aligned the supervisor's security values are with those of the organization. Yet, the security literature has given surprisingly little consideration to the notion that employees can differ in the extent to which they perceive supervisors as embodying organizational information security values. Responding to this gap, the current study examines how employee-supervisor relations and perceived security-related value alignment between supervisors and the broader organization shape employees’ commitment to organizational information security and ultimately, ERB enactment. Grounded in the social identity theory of leadership (SITL), a research model is developed that positions high-quality employee-supervisor exchange as a direct antecedent of affective commitment to organizational information security, which then serves as a central intrinsic motivational mechanism driving ERB enactment. Further, rooted in SITL's principles on leader prototypicality and supervisor organizational embodiment, employee-perceived value alignment between the immediate supervisor and the organization as a whole—referred to here as supervisor security embodiment (SSE)—is introduced as a critical boundary condition influencing the extent to which employee-supervisor relations drive commitment. Results from model testing empirically demonstrate the value of SSE in explicating how this important relationship shapes workplace ERB enactment, through its influence on affective commitment to organizational information security performance.

Digital literacy, online security behaviors and E-payment intention

E-payment is a key component of e-commerce, facilitating improved user efficiency and fostering the intent to use e-commerce in the digital realm and the international integration arena. This study investigates the joint impact of digital literacy on two similar but fundamentally different activities which are security control behavior and e-payment continuance intention. This research contributes to the growing field of literature in two ways. First, the study examines Digital Literacy, which distinguishes three broad dimensions - Tech Familiarity, Policy understanding, Awareness of institutional surveillance, and its association with Security control Behaviors and E-payment continuance intention. Second, the study tests the mediator effect of Security control Behaviors on the relationship between Digital Literacy and E-payment Intention. The data were collected by using both offline and online survey methods across the national scope, employing a quota sampling approach to encompass a wide range of consumer demographics. Structural equation modeling with the sample of Vietnamese respondents was applied to test the influence of digital literacy on customers’ security control behavior and intention to use e-payments. The results endorse that 1) digital literacy has an important impact on online security behavior; 2) digital literacy bridges a strong direct association with e-payment continuance Intention and indirect through online security behavior. This study suggests several theoretical and practical implications from the findings, as well as limitations and future directions.

Multidimensional Scale to Assess Digital Security in Adolescents

The study examined the psychometric properties of a Digital Security Scale (DSS-A) in a sample of 868 adolescents (460 female, 408 male), made up of 424 early adolescents (M age = 11.84 years, SD = 0.36) and 444 middle adolescents (M age = 13.44, SD = 0.49). The sample was randomly split into two for validation (n = 434) and cross-validation (n = 434) purposes. The results confirmed the fit of a one second-order factor model with four first-order factors (personal data protection, safe relationships, healthy internet use, and self-disclosure). As expected, digital security dimensions were positively associated with parental mediation. Measurement invariance was found in this model by gender and stage of adolescence. Latent mean comparisons showed differences by gender and stage of adolescence. Overall, findings indicate that the measurement model is helpful for measuring adolescents’ digital security behaviors.

Analysis of Behavioral Acceptance and Security Behavior on Implementation of Digital Workplace

The creative industry is growing and accelerating, predicted to be a future of national economic power. The use of the digital workplace in many organizations represents a digital transformation of the work environment through cloud-based productivity tools that facilitate collaboration among companies and employees. Implementing the digital workplace can enhance efficiency and effectiveness in highly dynamic work that requires agility. However, there are risks and potential negatives to the prevalence of cybersecurity threats and incidents. The causes and impacts are interrelated and influenced by user behavior at the individual and organizational levels. This phenomenon is studied and evaluated in detail to understand how behavioral factors and patterns affect the acceptance and security of the digital workplace. The study involved 402 respondents from 13 job positions in 27 business fields in the Application Development Sector. It was examined and evaluated using the UTAUT model and the Security Behavior Model with SEM methodology. The results showed a significant correlation between exogenous variables and endogenous variables such as security behavior, use behavior, and continued usage. The only exception was the perceived security threat, which did not correlate with security behavior. This research provides implications and contributions through strategies for implementing and enhancing the digital workplace as an easily accepted and secure platform to support organizational productivity

Human-centric cyber security: Applying protection motivation theory to analyse micro business owners’ security behaviours

Purpose The current advancements in technologies and the internet industry provide users with many innovative digital devices for entertainment, communication and trade. However, simultaneous development and the rising sophistication of cybercrimes bring new challenges. Micro businesses use technology like how people use it at home, but face higher cyber risks during riskier transactions, with human error playing a significant role. Moreover, information security researchers have often studied individuals’ adherence to compliance behaviour in response to cyber threats. The study aims to examine the protection motivation theory (PMT)-based model to understand individuals’ tendency to adopt secure behaviours. Design/methodology/approach The study focuses on Australian micro businesses since they are more susceptible to cyberattacks due to the least security measures in place. Out of 877 questionnaires distributed online to Australian micro business owners through survey panel provider “Dynata,” 502 (N = 502) complete responses were included. Structural equational modelling was used to analyse the relationships among the variables. Findings The results indicate that all constructs of the protection motivation, except threat susceptibility, successfully predict the user protective behaviours. Also, increased cybersecurity costs negatively impact users’ safe cyber practices. Originality/value The study has critical implications for understanding micro business owners’ cyber security behaviours. The study contributes to the current knowledge of cyber security in micro businesses through the lens of PMT.

Priming through Persuasion: Towards Secure Password Behavior

Users tend to create weak passwords even for the important accounts. The prior research shed light on user's insecure password behavior, and why the interventions, including requirement specification (e.g., password composition policies) and feedback systems (e.g., password meters) fail in practice. To this end, we propose and evaluate the concept: priming-through-persuasion in the realm of secure password creation. In particular, we created visual designs, aimed at priming users about the repercussions of weak passwords before their password creation. We base our designs on two forms of persuasion methods: pathos and logos. Pathos appeals to people's emotion in order to persuade them towards an expected behavior, where logos-based rhetoric appeals to a person's sense of reason. We conducted a lab study including participatory design and semi-structured interview with 20 participants. We updated our designs in an iterative manner based on the feedback from our participants in the lab study. To evaluate our updated designs, we conducted a between-subject online study with 131 participants over Amazon Mechanical Turk. Our study provides insight into how the use of persuasion techniques contributed to user attachment and engagement with the design, as well as the comprehension of the conveyed message about password vulnerabilities. Our findings lead to the guideline for future research on leveraging the priming-through-persuasion to complement the existing techniques in encouraging users towards secure behavior.

Using the theory of interpersonal behaviour to explain employees’ cybercrime preventative behaviour during the pandemic

Purpose The COVID-19 pandemic necessitated a significant shift in how employees executed their professional responsibilities. Concurrently, the incidence of cybercrime experienced a noteworthy surge due to the increased utilisation of cyberspace. The abrupt transition to telecommuting altered the interpersonal dynamics inherent in traditional work environments. This paper aims to examine the impact of interpersonal factors on the cybercrime preventative measures adopted by telecommuting employees. Design/methodology/approach A conceptual model, grounded in the Theory of Interpersonal Behaviour, is evaluated through an online survey. The data set comprises responses from 209 employees in South Africa, and the analysis uses partial least squares structural equation modelling. Findings The results reveal substantial predictive power to explain cybercrime preventative behaviours. Notably, the study underscores the significant influence of habit and affect on intention and subsequent behaviour. Practical implications The results suggest that practitioners should give due attention to emotional dimensions (affect) as a catalyst for information security behaviour. The formulation of employees’ information security responsibilities should be pragmatic, fostering subconscious compliance to establish routine behaviour (habit). Originality/value This research underscores the pivotal roles played by habit and emotions in shaping behavioural patterns related to information security. Furthermore, it provides researchers with an illustrative model for operationalising these constructs within the realm of security. The results contribute additional perspectives on the repercussions of the COVID-19 pandemic on cybercrime preventative behaviours.

Human factors in remote work: examining cyber hygiene practices

Purpose The purpose of this paper is to investigate the cyber hygiene practices of remote workers. Design/methodology/approach This paper used two instruments: first, the Cyber Hygiene Inventory scale, which measures users’ information and computer security behaviors; second, the Recsem Inventory, developed within this paper’s context, to evaluate the cybersecurity measures adopted by organizations for remote workers. It was conducted on remote workers to examine their information security practices. The instrument was administered to a sample of 442 employees reached via the LinkedIn platform. Analyses were performed with SPSS v26, Python programming language and Seaborn library. Findings The findings indicate a significant correlation between the security measures implemented by companies and their employees’ cyber hygiene practices. A sector comparison revealed a significant difference in cyber hygiene levels between public and private sector workers. Research limitations/implications This paper aims to provide policymakers with suggestions for enhancing the cyber hygiene of remote workers to facilitate compliance with corporate security protocols. Originality/value This paper’s conclusions highlight the importance of companies increasing their cybersecurity investments as remote work becomes more prevalent. This should consider not only corporate-level factors but also employees' information and computer security behaviors.

“It is Luring You to Click on the Link With False Advertising” - Mental Models of Clickbait and Its Impact on User’s Perceptions and Behavior Towards Clickbait Warnings

Clickbait, a social engineering attack performed through social media, tricks users through sensationalized or misleading posts into clicking on links that direct them to malicious websites. With the recent boom in social media, clickbait has become a substantial security concern, necessitating efforts from platforms and academia to control it. Despite these attempts, clickbait is effective due to the lack of users’ knowledge. Therefore, we explore user mental models (thought processes about how something works) about clickbait to analyze their deficiencies and their influences on users’ behavior towards clickbait warnings. To this end, we conducted an online study with 770 participants over MTurk to generate user mental models about clickbait and to evaluate the clickbait warnings conveying harm. Our findings suggest that a large portion of users have a simple mental model that fails to comprehend the dangers of clickbait, indicating the importance of warnings in supporting and educating users. Overall, our studies provide valuable insights into understanding the impact of clickbait mental models on users’ online security behavior in social media and offer guidelines for future research in these directions.

Is cyber hygiene a remedy to IPTV infringement? A study of online streaming behaviours and cyber security practices

Spurred by the rapid modernisation of the sector and the advent of Internet Protocol Television (IPTV), audiovisual (AV) piracy is at epidemic levels, with interventions having limited effect. To date, the dominant themes in interventions have been around personal deterrence (i.e. the threat of legal action) and have not considered other factors that may influence an individual’s decision to consume infringing content. In this paper, we consider psychological factors, including perceptions around risk-taking, security behaviours, problematic internet use and personality traits, to gain a comprehensive understanding of factors influencing engagement with IPTV and the potential implications for cyber security. For this purpose, a survey was conducted with 283 participants living in the UK (age range 18–74, male 104), and an integrated structural equation model was constructed. Our findings showed a positive relationship between security behaviours and the perceived risk of viewing IPTV and a negative relationship between the dark personality triad and the perceived risk of viewing IPTV. They suggest that security behaviours fully mediate the relationship between problematic internet use and IPTV risk-taking, indicating a potential new path for anti-piracy interventions with greater efficacy.

Understanding security behaviour among healthcare professionals by comparing results from technology threat avoidance theory and protection motivation theory

ABSTRACT We investigate security behaviour among healthcare professionals while comparing upon two prevalent theories in information security (IS) research: Protection Motivation Theory (PMT) and Technology Threat Avoidance Theory (TTAT). Although IS research often uses these models, very few studies compare the two models using a diverse sample of 245 healthcare professionals. The data were analysed using partial least squares regression - structural equation modelling (PLS-SEM). Results indicated that both models were similarly robust at predicting security behaviour. Perceived severity and response efficacy positively influenced avoidance motivation (AM) for PMT. All factors of the threat appraisal arm of TTAT and safeguard efficacy played an influencing role on AM in TTAT. Response cost and self-efficacy were not supported in either model, providing us with potentially new insights into this specific population’s security intentions. With the addition of Perceived Threat, TTAT appears to be slightly more robust model with 64% of the variance explained by the given model while PMT explains only 60% of the variance. Given the ever-increasing risk of data breaches in healthcare, practical applications and implications of the study’s findings to health information technology (HIT) policy and infrastructure are also discussed.

INSECURITY AND TERRORISTS’ THREATS OF ATTACKS ON SELECTED NIGERIAN CITIES: IMPLICATIONS ON LAGOS RESIDENTS’ CONCERNS FOR SAFETY AND THE CITY SECURITY PLANNING

Terrorism is common but limited to certain towns in Nigeria. However, the nomenclature seems to be changing as security intelligence has it that terrorist groups are planning attacks targeting Lagos, and other notable cities. This study therefore examines concerns for safety among residents and implications on individual and city-level security planning in Lagos. The official wards as demarcated by the Independent National Electoral Commission represent clusters from which at least a respondent was randomly selected. The study’s respondents were selected from 49 (one of every five wards {20%}) wards out of 245 wards in Lagos. In the selected wards, at least two respondents were randomly selected. A total of 288 residents participated in the survey, but, only 134 respondents accurately completed the questionnaire used in this analysis, representing a 58.7% response rate. Results show that 78% of the respondents were concerned about their safety while some 90% took precaution by avoiding certain places and activities. Findings show significant relations between awareness of the planned attacks, concerns for safety, and precautionary behaviour among respondents. Besides, results show that respondents’ socio-economic characteristics, neighbourhood environmental design, and past crime victimisation mediate concerns for safety and security behaviour. The study concludes that the emergence of this security intelligence in the public domain has further contributed to the increasing fear and residents’ mobility change. The study recommends among others policing strategies, a new urbanism, where urban planning and design strategies are applied to make attacks more difficult to carry out in soft spaces and places.

Validation of cyber security behaviour among adolescents at Malaysia university: Revisiting gender as a role

Cyber-attacks and crimes are still a problem in Malaysia. COVID-19 has pushed Malaysians into the digital world more quickly. These cyberattacks may rise and affect more people. Thus, the aim of this study is to find out if there is a significant difference in the level of cyber security behaviour between males and females in the aspects of malware, password usage, phishing, social engineering and online scamming in Malaysia. An online questionnaire survey was used to gather data from Malaysia and received 207 total responses. Cronbach's alpha is used to measure questionnaire items' reliability. A t-test is used to determine the differences between male and female cyber security behaviour. The results show that there is no significant difference between males and females in four aspects out of five, which are malware, password usage, phishing and social engineering. There is a significant difference between males and females in the aspect of online scams. This research helps those who formulate education policies by determining that there is no noticeable gender difference. Men should get the same level of education and training as women. The findings also demonstrate that women's awareness of technology is increasing.

The health belief model and phishing: determinants of preventative security behaviors

Abstract Email is frequently the attack vector of choice for hackers and is a large concern for campus IT organizations. This paper attempts to gain insight into what drives the email security behaviors of students, faculty, and staff at one midwestern public, master’s granting university. The survey relies on the health belief model as its theoretical basis and measures eight constructs including email security behavior, perceived barriers to practice, self-efficacy, cues to action, prior security experience, perceived vulnerability, perceived benefits, and perceived severity. Barriers to practice, self-efficacy, vulnerability, benefits, and prior experience variables were found to be significant determinants of self-reported email security behaviors. Additional discussion of results based on subgroups of the respondents and interaction models is included in this paper. The findings of this study may help shed light on how universities can better prepare students, faculty, and staff to handle this critical information security concern. Given the makeup of the subject population, some findings may be applicable to businesses beyond academic institutions.

An Investigation of the Factors That Influence Information Security Culture in Government Organizations in Bhutan

ABSTRACT Organizations make large investments to secure data and networks, but information security breaches as a result of insiders continue to rise. One possible contributor to this is poor information security culture. This study investigated the key factors that contribute to effective information security culture in government organizations in Bhutan and how information security culture influences employee security behavior. A research model was developed for the study based on an analysis of the information security literature. Data was collected using an online survey of 181 government employees. Senior management support, information security policy, training and awareness campaigns, interpersonal trust, and job- versus employee-oriented organizational culture were all found to influence information security culture, and information security culture contributed to information security behavior. The study extends understanding of the roles of trust and different dimensions of organizational culture in improving information security culture and behavior. The findings should help government policy makers and information security practitioners when developing information security strategies and programs.

Primena teorije stavova za određivanje pristupa bezbednosti korisnika

Mobile phones and internet form a crucial part of modern life, which raises important questions, such as security, data protection and privacy. Countless studies examine what influences users' approaches towards security. The attitude theory gives the basic background to the present study through which the topics of cyber safety and security, data protection and privacy are examined. The three components of attitude, which served as the three pillars of the applied survey, are: (1) the cognitive component (belief and knowledge), (2) the affective component (feelings) and (3) the behavioural component (the effect of the attitude on the users' behaviour). Self-reported security knowledge and feelings about security were assessed, out of which three factors were formed using EFA. The security behaviour of each factor was examined to determine the consistency of the responses. Moreover, the three factors helped to identify three separate clusters. As a conclusion it can be stated that the theory of attitudes can help understanding user security behaviour better. Finally, future research directions are suggested.