Security Behavior Research Articles

Computer Games as a Pedagogical Tool for Creating Cyber Security Awareness

Cyberattacks are increasing world-wide, both on corporate networks and public institutions network. During 2022 hackers were widening their aim to target business collaboration tools such as Slack, Teams, OneDrive, and Google Drive with phishing exploits, making for a rich harvest of sensitive data given that most organizations’ employees continued to work remotely. In the later years we have also seen academic institutions becoming more frequent targets for both cybercriminals and state sponsored hackers. In 2022 the education/research sector was most attacked industry globally, seeing a 43% increase compared to 2021, with an average of 2,314 attacks per organisation every week. Schools and universities have the unique challenge of dealing with children or young adults, many of which use their own devices, work from shared locations, and often connect to public Wi-Fi without thinking of the security concerns. Additionally, Russia’s war on Ukraine has led to an increase in spear-phishing activity targeting educational institutions in NATO countries. This situation calls attention to the need for awareness raising about personal cyber security. In Norway, Nord University is one of a few universities with specific focus on security and preparedness, including cyber security awareness. The university has two information security courses: one belonging to furthering education and one within the MBA-study program in Security and Preparedness Management. This paper examines the question whether serious games and online quizzes can create heighten cyber security awareness and motivate individual students to change their cyber security behaviour. The paper reports on the findings based on written reflection notes from students belonging to both courses. The technique of examination and interpretation applied to the data was qualitative thematic content analysis supported by computer-assisted qualitative data analysis software NVivo. Theoretical analysis was guided by social constructionist perspective on knowledge creation. While many advantages of the use of online quizzes and computer games were specified by students, challenges were identified as well. However, the findings show that the use of serious games and online quizzes can be an efficient approach to raising security awareness among participating students.

Working conditions and cybersecurity: Time pressure, autonomy and threat appraisal shaping employees’ security behavior

With the increasing importance of cybersecurity in organizations, it becomes crucial that employees behave securely. In the present article, we investigate the interplay of antecedents on this behavior. We conceptualize cybersecurity behavior through the components of compliance and participation and investigate the relationship between security knowledge, threat appraisal (i.e., severity and susceptibility), and working conditions (i.e., time pressure, decision-making autonomy). We conducted an online survey in four public organizations, collecting quantitative cross-sectional data from 214 employees. The survey captured subjective perceptions of the concepts. Findings showed a positive effect of security knowledge on security compliance and security participation. The perception of severity and susceptibility strengthened both effects. Additionally, the presence of time pressure reduced the effect of security knowledge on security compliance, while having decision-making autonomy increased the effect of security knowledge on security participation. Our study demonstrates the interplay between antecedents and highlights the role of working conditions in employees’ cybersecurity behavior. Implications for practice in terms of training approaches considering work design are discussed.

India’s security imagination of the Bay of Bengal: aspiration, sub-optimality, and history

ABSTRACT India has consistently demarcated the Bay of Bengal as a security space in standard realist terms which in turn leads to its conversion as a zone of security. The article probes two questions in this context. First, what drives India's insecurity and its imperative to control the Bay of Bengal? Apart from the traditional defence imperative, India pursues an aspirational model of security that is linked to its regional prominence and growing maritime footprint. Second, what are India's security responses in the Bay of Bengal? While realist security theories are often helpful in explaining India's security behaviour, there are several episodes when India's responses are also suboptimal on a realist scale where it does not completely resort to either defensive or offensive realism to attain security. Beyond defending threats and accumulating power, India's security engagements are additionally motivated by the concerns of autonomy, leadership and pre-eminence in this maritime space.

Demographic Comparison of Information Security Behavior Toward Health Information System Protection: Survey Study.

The health information system (HIS) functions are getting wider with more diverse users. Information security in the health industry is crucial because it involves comprehensive and strategic information that might harm human life. The human factor is one of the biggest security threats to HIS. This study aims to investigate the information security behavior (ISB) of HIS users using a comprehensive assessment scale suited to the information security concerns in health care. Patients are increasingly being asked to submit their own data into HIS systems. As a result, this study examines the security behavior of health workers and patients, as well as their demographic variables. We used a quantitative approach using surveys of health workers and patients. We created a research instrument from 4 existing measurement scales to measure prosecurity and antisecurity behavior. We analyzed statistical differences to test the hypotheses, that is, the Kruskal-Wallis test and the Mann-Whitney test. The descriptive analysis was used to determine whether the group exhibited exemplary behavior when processing the survey results. A correlational test using the Spearman correlation coefficient was performed to establish the significance of the relationship between ISB and age as well as level of education. We analyzed 421 responses from the survey. According to demographic factors, the hypotheses tested for full and partial security behavior reveal substantial differences. Education levels most significantly affect security behavior differences, followed by user type, gender, and age. The health workers' ISB is higher than that of the patients. Women are more likely than men to engage in prosecurity actions while avoiding antisecurity behaviors. The older the HIS user, the more likely it is that they will participate in prosecurity behavior and the less probable it is that they will engage in antisecurity behavior. According to this study, differences in prosecurity behavior are mostly impacted by education level. Higher education, on the other hand, does not guarantee improved ISB for HIS users. All demographic characteristics, particularly concerning user type, show discrepancies that are caused mainly by antisecurity behavior rather than prosecurity behavior. Since patients engage in antisecurity behavior more frequently than health workers and may pose security risks, health care facilities should start to consider information security education for patients. More comprehensive research on ISB in health care facilities is required to better understand the patient's perspective, which is currently understudied.

National security in presidential time: The politics of the National Security Council

AbstractThe National Security Council (NSC) is the preeminent national security feature of the modern U.S. presidency. The NSC is the president's council, but presidents have varied dramatically in how frequently they have convened formal meetings of the NSC since the NSC system was created in 1947. Under what conditions are presidents likely to hold NSC meetings? I argue that presidents are pragmatic about when to engage personally in national security affairs and that presidents are incentivized to conduct NSC meetings more frequently early in a presidency. Using a novel data set of all NSC meetings from 1947 to 1993, I find that presidents are likely to hold NSC meetings most frequently in the first year of office and that NSC meeting frequency is likely to decline substantially over a president's first 3 years in office, even after controlling for important international security conditions and domestic political factors previously thought to influence presidential national security behavior. The results affirm prior scholars' description of the NSC as a presidential mechanism for international crisis management but also suggest that time in office is an important determinant of presidential national security behavior.

The Role of Psychological Capital, Sanction and Organization Security Resources in Enhancing the Security behaviour of Employees who Violate Security Policies

The Role of Psychological Capital, Sanction and Organization Security Resources in Enhancing the Security behaviour of Employees who Violate Security Policies

Nurse Information Security Policy Compliance, Information Competence, and Information Security Attitudes Predict Information Security Behavior.

Nurses' attitudes toward information security can influence the hospital's information resources management and development. This study investigated the relationships between nurses' information security policy compliance, information competence, and information security attitudes, which are factors that influence information security behavior. Data were collected during September 2020. The participants were 200 clinical nurses from a general hospital in Korea. The self-reported questionnaire included questions on nurses' general characteristics, information security policy compliance, information competence, and information security attitudes. Information security policy compliance (r = 0.554, P < .001) and information competence (r = 0.614, P < .001) were positively associated with information security attitudes. Predictors of nurses' information security attitudes were information competence (β = .439), information security policy compliance (β = .343), prior information security-related education (β = .113), and job position (nurse manager; β = .101). Implications for practice include the need for strategies to develop information security policy compliance and information competence to improve information security behavior, including different approaches tailored to nurses' job positions and previous information security education.

Formal Analysis and Improvement of Z-Wave Protocol

&lt;p&gt;In order to verify the security of the Z-Wave communication protocol, the possible attacks in the protocol are analyzed to reduce user privacy security vulnerabilities. For the communication process and key exchange process between the controller and the node, this paper uses CPN tools to model the Z-Wave S2 protocol, and introduces the Dolev-Yao attack model to verify the security behavior of the protocol. The results show that there is a man-in-the-middle attack when using S2 authentication for device inclusion. In response to this vulnerability, we propose a lightweight static authentication scheme based on HKDF function and XOR operation, which performs authentication between Z-Wave controller and slave device. Secondly, we formally verify the security objectives of the improved scheme, and prove that the optimization scheme can effectively prevent man-in-the-middle attacks in the S2 security mode. &lt;/p&gt; &lt;p&gt;&amp;nbsp;&lt;/p&gt;

Level of User Security Behavior in the Service Industry

User security behavior is all user actions related to computer system security. Previous studies have shown that user security behavior is one of the main causes of computer and information security problems in many organizations. In order to mitigate this problem, we need to find a solution to improve user security behavior in the organization. This process involves three steps. This study emphasizes the first step to address an organization's security behavior. Therefore, this study aims to determine the level of user security behavior for four service industries in West Sumatra in 2019. This study is carried out by using a survey research method. Questionnaires were distributed to 320 respondents from four service sectors: government, education, banking, and private services. The questionnaire consists of 30 questions comprising seven factors influencing user security behavior: the organization's values, co-workers' behavior, the ability to make decisions, the availability of supporting tools, individual values and standards, the employee-employer relationship, and the Effort required. The result shows that the level of user security behavior is reasonably high. This implies that service sector employees in Indonesia are aware of the threats in cyberspace and the importance of the security procedure at work. For further research, we plan to study some security problems in more detail to propose possible solutions or actions to improve user security behavior in the service industry, particularly in Indonesia.

Employees' in-role and extra-role information security behaviors from the P-E fit perspective

Organizations are increasingly seeking ways to encourage employee in-role and extra-role information security (InfoSec) behaviors for enhancing organizational InfoSec. One important consideration is the InfoSec congruence between the person and the organizational environment. Accordingly, drawing on person–environment (P–E) fit theory, we conducted an empirical investigation that examined (1) the effect of key components in organizational InfoSec management practice on InfoSec value P–E fit, and (2) the role of InfoSec value P–E fit on employees’ InfoSec in-role and extra-role behaviors in the organization. The results suggest that three practices—InfoSec policies; security education, training, and awareness programs; and computer monitoring—cultivate InfoSec value P–E fit, leading to an increase in employees’ InfoSec in-role and extra-role behaviors.

An analysis of differences in behaviors and practices of security-conscious users and regular users on mobile devices

PurposeThis study aims to investigate the differences in security-conscious (group A) and regular (group B) users’ behaviors and practices on mobile devices.Design/methodology/approachA survey was used to investigate the differences in behaviors and practices of security-conscious users (group A) and regular users (group B) on mobile devices. Each group will have 50 participants for a total of 100.FindingsThe analysis revealed differences in the behaviors and practices of security-conscious and regular users. The results indicated that security-conscious users engage in behaviors and practices that are more secure on mobile devices when compared with regular users.Research limitations/implicationsThe results will help recommend the best behaviors and practices for mobile device users, increasing mobile device security.Social implicationsThe results will help society to be more aware of security behaviors and practices on mobile devices.Originality/valueThis study answers the call for addressing the weaknesses and vulnerabilities in mobile device security. It develops a research instrument to measure the differences in behaviors and practices of security-conscious and regular mobile device users.

Rushing for security: a document analysis on the sources and effects of time pressure on organizational cybersecurity

PurposeA growing body of research has identified time pressure as a key driver of cybersecurity (CS) risks and vulnerabilities. To strengthen CS, organizations use CS documents (e.g. best practices, guidelines and policies) intended to strengthen CS. The purpose of this paper is to provide an overview of how specifically time pressure is addressed by CS documents.Design/methodology/approachThe authors conducted a systematic search for CS documents followed by a content analysis of the identified documents. First, the authors carried out a systematic Web search and identified 92 formal and informal CS documents (e.g. security policies, procedures, guidelines, manuals and best practices). Second, they systematically analyzed the resulting documents (n = 92), using a structured approach of data familiarization and low-/high-level coding for the identification and interpretation of themes. Based on this analysis, the authors formulated a conceptual framework that captures the sources and effects of time pressure along the themes of industry, operations and users.FindingsThe authors developed a conceptual framework that outlines the role of time pressure for the CS industry, threats and operations. This provides a shared frame of reference for researchers and practitioners to understand the antecedents and consequences of time pressure in the organizational CS context.Research limitations/implicationsWhile the analyzed documents acknowledge time pressure as an important factor for CS, the documents provide limited information on how to respond to these concerns. Future research could, hence, consult with CS experts and policymakers to inform the development of effective guidelines and policies on how to address time pressure in the identified areas. A dedicated analysis within each area will allow to investigate the corresponding aspects of time pressure in-depth along with a consideration for targeted guidelines and policies. Last, note that a differentiation between CS document types (e.g. formal vs informal and global vs regional) was beyond the scope of this paper and may be investigated by future work.Originality/valueThis study makes three main contributions to the CS literature. First, this study broadens the understanding of the role of time pressure in CS to consider the organizational perspective along the themes of industry, threats and operations. Second, this study provides the first comprehensive assessment of how organizations address time pressure through CS documents, and how this compares to existing research in academic literature. Third, by developing a conceptual framework, this study provides a shared frame of reference for researchers and practitioners to further develop CS documents that consider time pressure’s role in secure behavior.

Understanding extra-role security behaviors: An integration of self-determination theory and construal level theory

Extra-role security behaviors (ERSBs) – spontaneous security behaviors that are not prescribed in organizational security policies – are seen as a useful addition to securing informational assets in organizations. However, this exploratory study, based on findings obtained through 29 in-depth-interviews, challenges this positive perspective and shows that extra-role security behaviors cut both ways: They are either helpful or harmful. In addition, our results suggest that (1) ERSB contributes to varying degrees to the effectiveness of information security compliance, (2) the self-determination theory contributes to understanding the motivators for ERSB, and (3) the construal level theory of psychological distance explains the differential risk evaluation of ERSB. We discuss implications for researchers and practitioners – particularly in terms of promoting the beneficial nature of extra-role security behaviors – and suggest compelling avenues for future research.

Identifying the idiosyncrasies of behavioral information security discourse and proposing future research directions: A Foucauldian perspective

Information security (InfoSec)–related behaviors have been defined in many different ways in the security literature. Indeed, the coexistence of varying terms describing IS security behaviors could be seen as a conceptual inconsistency. However, we believe that it could also be construed as the sign of a vivid and living field embracing dispersed objects of study without changing the disciplinary discourse itself. To test this belief, we conduct a two-part study. Study 1 analyzes the definitions of InfoSec-related behaviors in the existing security literature. The result of Study 1 uncovers the Foucauldian rules that make possible the discourse on behavioral information security, including the surface of emergence, authorities of delimitation, and the grids of specification. Study 1 also indicates that, although behavioral Information Systems Security (ISS) shares the three rules with other disciplines, it is the only field that studies the relations between them. We therefore propose a disciplinary question that reflects this idiosyncrasy. We then conduct Study 2, using Foucault’s view on preconceptual schemata as a theoretical lens, to identify understudied areas in the ISS literature. We found that the existing literature utilizes two variations of the actor and organization schemata to form or to adapt concepts, and utilize two different approaches to study these two variations, namely, an antecedents approach and a dialectics approach. It is noteworthy that the latter is important but understudied in the literature. We then draw an analogy from moral studies to develop three concepts for future ISS research, namely, Stages of Awareness Development, Security Agency, and Security Disengagement.

THE RELATIONSHIP BETWEEN THE CHARACTERISTICS OF SOFTWARE DEVELOPERS AND SECURITY BEHAVIOR INTENTION

Software security is integral to information security, requiring software developers to be aware of software security as implementers and information security as employees. Little is known about the impact of software developers’ characteristics on their information security behaviors. This study examined the relationship between software developer characteristics such as their application security awareness (AW), training, and self-efficacy (SE) and their information security behavior intention (SeBI). Data from a survey of 200 software developers in the United States were analyzed using correlational statistical methods. AW and SE positively correlated with SeBI, while application security training did not correlate. Developers’ AW and SeBI mean score was found to be poor. Information security managers should aim to improve software developers’ application security awareness and self-efficacy to help improve their information security behavior. Application security training infused with information security awareness and conducted by application security experts is recommended.

The influence of organizational values on employee attitude and information security behavior: the mediating role of psychological capital

PurposeWith increased remote working, employers are concerned with employees’ commitment and compliance with security procedures. Through the lens of psychological capital, this study aims to investigate whether strong organizational values can improve employees’ commitment to the organization and security behaviors.Design/methodology/approachUsing Qualtrics platform, the authors conducted an online survey. The survey participants are college-educated, full-time employees. The authors used structural equation modeling to analyze 289 responses.FindingsThe results indicate perceived importance of organizational values is associated with increased organizational commitment and information security behavior. The authors find that psychological capital partially mediates these relations suggesting that employees’ psychological capital effectively directs employees toward an affinity for the organization and information security behavior. The results highlight the importance of organizational values for improving security behavior and organizational commitment. Second, the results suggest that psychological capital is an effective mechanism for this influence. Finally, the authors find that individual differences (gender, organizational level and education) are boundary conditions on their findings, providing a nuanced view of their results and offering opportunities for further investigation.Originality/valueTo the best of the authors’ knowledge, this study is the first to explore organizational values in relation to information security behaviors. In addition, this study investigates the underlying mechanism of this relationship by showing psychological capital’s mediating role in this relationship. Therefore, the authors suggest organizations create a supportive environment that appreciates innovation, quality services, diversity and collaboration. Furthermore, organizations should communicate the importance of these values to their employees to motivate them to have a stronger affective commitment and a more careful set of security behaviors.

Modelling Responsible Digital Security Behaviour for Countering Social Media Manipulation

While the digital environment, and in particular social media, surrounds not only human’s identity and its societal functions projection, e.g., institutional and financial aspects, it also captures both individual and collective thoughts regarding former, ongoing, and future concepts, trends, and incidents placed in the physical world, in the digital environment, or in both which could impact both individual and collective consciousness, behaviour, and attitude towards different dimensions of reality. Accordingly, an initial attempt to define and model responsible digital security behaviour was made and ongoing discourses and AI-based solutions for tackling and containing social manipulation mechanisms exist in this domain. Noteworthily is that dedicated attention to understanding and modelling responsible digital security behaviour in social media for tackling and/or countering social media manipulation, e.g., disinformation and misinformation, still lacks. To this end, this research aims (i) to capture the factors influencing user behaviour towards tackling and/or countering social media manipulation, (ii) to build a Machine Learning model that assesses user’s responsibility in relation to tackling and/or countering social media manipulation mechanisms, and (iii) propose a set of socio-technical recommendations for building resilience to such mechanisms. To accomplish these research objectives, a Design Science Research methodological approach is taken by designing, developing, and evaluating the model proposed through exemplification. Finally, this research aims to enhance digital security awareness and resilience to social media manipulation of users and policy decision-makers to manage and further extend in a responsible and safe way the digital environment.

The Next Generation of Japan's National Security

The Next Generation of Japan's National Security Marina Fujita Dickson (bio) and Yoichi Funabashi (bio) Japan's security policy has undergone several drastic changes in past decade: the establishment of the National Security Council in 2013; the easing of defense equipment exports in 2014; and, most recently, the publication of the new National Security Strategy, National Defense Strategy, and Defense Buildup Program white papers in late 2022, combined with the increase of the defense budget to 2% of GDP and plans to establish new measures like a counterstrike capability. While many analysts have highlighted these developments as significant shifts in Japan's strategic priorities, a single major factor looms in the background that continues to hinder developments—Japan's aging population. Japan's attempt to become a "normal nation"—a country with an effective security policy that can accept the use of force as a potential policy tool—is constrained today by a declining birth rate, an aging population that both stresses the government's budget and limits the recruitment pool for the Japan Self-Defense Forces (JSDF), and the slow pace of technology adoption in the JSDF. Tom Phuong Le's book Japan's Aging Peace: Pacifism and Militarism in the Twenty-First Century addresses these major challenges and uniquely explores the intersection between Japanese defense policy and the country's demographic crisis, detailing exactly why and how these issues are causational. First, fewer children mean fewer potential military recruits. Second, an older, aging population requires a larger budget for institutions like the pension system, leaving less money for defense matters, such as recruiting and retaining troops. Le carefully describes both the uniqueness and individuality of the problem; while most developed economies today are experiencing declining birth rates, Japan's crisis has arguably attracted the most attention as a social phenomenon over the last two decades. In exploring how the abovementioned demographic shift affects Japan's defense, Le compares Japan with its neighbors South Korea, Taiwan, China, and Singapore, which all have some form of mandatory conscription. Yet, each of these countries faces the same issue of an aging population—and [End Page 169] some of these countries (such as Taiwan and South Korea) are experiencing this problem to an even more acute degree than Japan. Having tapped into the full extent of their recruitment pool, these four countries could be looking at a potentially more dire situation in their future. Indeed, Japan is not the only country, but rather just the first, to face the challenge of an aging population. Le argues that the way in which Japan manages this crisis domestically will thus be a lesson for its neighbors. Throughout the text, the author also underscores the various constraints on Japanese militarism beyond demographics, including issues resulting from an underdeveloped military industrial complex, arms export principles, public opinion, the constitution, the international stigma of militarism, the U.S.-Japan alliance, and Japan's three nonnuclear principles, among others. While the government can alleviate some of these issues through policy reform, many are norms that cannot be overcome without "significant social engineering" (p. 11), which is beyond the capability of the government. While Le's discussion of Japan's intertwined demographic and defense challenges—and the immense hurdles Japan faces to overcome them—is crucial, Le's most important contribution to the existing literature is perhaps his examination of "militarism" itself as a concept. Some scholars have predicted that Japan will "return to normal security behavior" (p. 34), but what do they mean by that precisely? Because there is a lack of specificity in this idea of a return to normal, it is unclear what path of militarization Japan would take and what it would mean for the country's future. It is clear, however, that Japan's "return to normal" in military terms will not be a return to the 1930s. To understand this point, one must look beyond conventional metrics of militarization such as the "increased activity" of the armed forces or changes in the defense budget to other indicators such as civil-military dynamics, the prevalence of military symbols in public view, and education on Japanese history and war, to name a few. In...

Game analysis of enterprise safety investment and employee safety behavior strategy evolution in high-risk industries

This paper aims to explore the influential relationship between the decision-making of investment of enterprise safety and employee safety behavior strategy selection, thus improve the effectiveness of decision-making. Based on traditional game theory, this paper establishes an evolutionary game model of enterprise safety investment and employee safety behavior strategy selection, and conducts numerical simulation analysis. The result shows:when the security investment cost is greater than the security investment benefit, the employee's security behavior strategy choice is significant for the enterprise security investment strategy decision; when the security investment benefit is greater than the security investment cost, the enterprise security investment decision is not affected by the employee safety behavior strategy; the choice of employee safety behavior strategy is not affected by the choice of enterprise safety investment strategy. The conclusion can provide a reference basis for enterprise safety production decision-making, which has certain theoretical and practical significance.

Digital Workplaces and Information Security Behavior of Business Employees: An Empirical Study of Saudi Arabia

In the post pandemic era, the telecommuting of business employees has widely become acceptable in organizations, which demands extensive dependence on digital technologies. In addition, this poses additional security threats for business employees as well as organizations. In order to better respond to security threats, business employees must have a higher level of awareness of the potential threats that are relevant to digital infrastructure used within the workplace. In this paper, we present a quantitative study conducted in line with the theory of planned behavior to gain insight into employee behavior toward information security within different business sectors in Saudi Arabia. The key factors chosen for our model were password management, infrastructure security management, email management, organizational security policy, organizational support and training, and the perception of the level of security. We have applied structured equation modelling to identify most of the relevant factors based on the respondents’ feedback. The results based on the business employee behavior showed that they respondents did not perceive all of the constructs of our model as relevant security factors, which can potentially result in security lapses. This indicates that more security-related measures should be put in place and that business employees should be updated periodically about potential security threats. To this effect, we divided the studied security measures into those which should be implemented at organizational and individual levels. The results will potentially help business managers to design appropriate security trainings, guidelines, and policies for their employees to ensure more information security awareness and protect their technological infrastructure, especially within home office environments.