Security Behavior Research Articles

The security environment in Indian commercial banks: an employee's information security behaviour perspective

The security environment in Indian commercial banks: an employee's information security behaviour perspective

Evaluating the Influence of Attitude versus Knowledge and Individual Factor versus Intervention Factor on Information Security Awareness in Local Government

Local government as a public organization that typically collects mass amounts of sensitive data is one of the vulnerable and targeted sectors for information security attacks. The human aspect is the most critical but weak link to information security incidents. Among government organizations, local governments usually have more limited human resources either in number and competencies including information security awareness. This study aims to validate the Information Security Awareness (ISA) model for local government, including confirming the influence of knowledge and attitude on information security behavior, evaluating the stronger predictor between knowledge and attitude toward information security behavior, and analyzing the influence of gender (as an individual factor) and training (as an intervention factor) on the information security behavior. Utilizing the HAIS-Q assessment tool, this study collected responses from 704 employees of 68 departments/units under the government of East Java Province, Indonesia. The results suggest that in the local government context, there is a significant direct relationship between Knowledge of information security and information security Behavior and its indirect relationship via Attitude toward information security behavior. However, Attitude toward information security behavior has a stronger effect on Behavior than Knowledge. This study also suggests significant differences in information security behavior between employees who have trained and those who have not, regardless of gender. The proposed model suggests that to improve Information Security Awareness among employees, local government should focus on improving employees’ Attitudes toward information security behavior, either by improving their Knowledge of Information Security via training or their affective attitude toward information security behavior.

Can I Help Prevent Data Breaches in the Workplace? From Routine Activities to Extra-Role Security Behaviors

Can I Help Prevent Data Breaches in the Workplace? From Routine Activities to Extra-Role Security Behaviors

An exploration of dark and light triad personality traits towards situational crime prevention and compliant information security behaviour

PurposeThis investigation serves a dual purpose: providing preliminary results and serving as a pilot study to confirm the viability of the hypotheses advanced towards a full-scale study. This paper aims to present the preliminary findings of an investigation that explored the constructs of personality traits and situational crime prevention theory (SCPT) as antecedents to social cognitive determinants (attitude, perceived behavioural control and subjective norms using the theory of planned behaviour [TPB] framing) and how these elements subsequently estimate compliant information security behaviour. Moreover, this paper delves into the contrasting influences of light and dark personality traits on insider information security compliance.Design/methodology/approachA cross-sectional survey was conducted to study SCPT measures and the personality factors dyad using a diverse but limited sample (n = 82).FindingsThere were ten significant direct relationships between SCPT factors and personality traits related to the components of the TPB. Seventeen hypotheses were not supported. However, these findings highlight the complexity of the topic under study.Practical implicationsUnderstanding individual differences within the compliance model could be used for custom training protocols, employee selection, assignment and specific types of information security interventions.Originality/valueThere is a scarcity of studies considering the effects of situational and personality factors, specifically the dark versus light triad of personality traits within the information security domain. Therefore, this preliminary result provides early insight that could guide further studies. This research could have important implications for organisations at risk of insider attacks.

TEK KUTUPLU SİSTEMDE BÖLGESEL GÜÇLERİN GÜVENLİK YAKLAŞIMLARI BOYUTLARI

The power capacities of the states and the distribution of these capacities are important in determining both the polarity of the system and the characteristics of the countries in terms of being a superpower, great power, and regional power within the anarchic structure of the international system. Within the framework of the regional policies of the superpower, the security threats of the countries in the region are defined, and in order to combat these threats, it is emphasized that the internal threats are more important for the security of the regime within the framework of the characteristics of the regional powers. The features of a state such as competing allegiencies, monarchical state structure, being a rentier state cause the security of the regime in that state to be more important and prioritized than the security of the state. In this category, it is necessary to evaluate the state with a different approach than the alignment and bandwagoning strategies used by the classical approaches for the security strategies of the superpowers and great powers. This article examines a range of local conditions and motivations regarding the security behavior of states, especially regional powers, that have not been adequately discussed in the literature. In addition, it is aimed to strengthen the argument by explaining what is effective in determining the alliance relations of regional powers, unlike the great powers.

BYOA and Security: Examining Perspective-Taking and Self-Determination

ABSTRACT Bring your own applications (BYOA) in organizational networks introduces security risks. We examine whether individuals who BYOA at work are motivated to use multi-factor authentication (MFA) to protect the organization’s security, a practice we describe as bring your own security (BYOS). The behaviors are examined through dual theoretical lenses (a) intrinsic motivation, capturing the personal satisfaction related to the use, and (b) perspective-taking, capturing the user’s ability to consider information security from the organization’s perspective. We analyzed survey data of 154 samples using partial least squares structural equation modeling (PLS-SEM). Our results demonstrate that while the intrinsic motivation path is instrumental in influencing MFA use, perspective-taking offers significant explanatory power to information security behaviors. This article extends the current knowledge of the impact of perspective-taking on voluntary security behavior, which makes a novel and significant contribution to cybersecurity research and practice.

Examining the Factors That Influence User Information Security Behavior toward COVID-19 Scams

Amidst the COVID-19 pandemic, cybercriminals have capitalized on the situation and targeted online users. As a result, there has been a surge in the number of complaints related to new types of scams and fraud that have emerged during the pandemic. This study utilizes Protection Motivation Theory (PMT), Cultivation Theory (CT), and other constructs, including fear, attitude, general security awareness, general security orientation, subjective norms, openness, stress, and conscientiousness, to investigate the user information security behavior (ISB) against COVID-19 scams. The study gathered data from 423 internet users through a cross-sectional survey and used Partial Least Square Structural Equation Modeling (PLS-SEM) to test the conceptual framework. The results indicate that stress, government social media, general security awareness, response efficacy, and attitude were all positive determinants of the users’ ISB. The findings also highlight the impact of emotions, such as stress and fear, as well as government social media, on decision-making during a crisis. Additionally, the study found that the combined effects of the two threat appraisal factors on coping behaviors, which are mediated by fear, and the combined effect of the two coping appraisal factors on coping behaviors, which are mediated by attitude, were significant. However, the subjective norms on ISB did not show any variations and surprisingly, the study found that conscientiousness did not moderate the association between attitude and ISB.

The role of Self-Efficacy in effective strategies to promote secure behavior among employees in Tanzania’s public authorities: A case of Tanzania Communication Regulatory Authority (TCRA)

The role of Self-Efficacy in effective strategies to promote secure behavior among employees in Tanzania’s public authorities: A case of Tanzania Communication Regulatory Authority (TCRA)

A Regressional Study on the Impact of Organizational Security Culture and Transformational Leadership on Social Engineering Awareness among Bank Employees: The Interplay of Security Education and Behavioral Change

Organizations across various sectors are increasingly vulnerable to cybersecurity breaches in an era characterized by unprecedented technological advancements and a rapidly evolving threat landscape. Among the myriad methods employed by malicious actors, social engineering stands out as a particularly insidious and effective means of infiltrating secure systems and obtaining sensitive information. To effectively address these issues, organizations must establish and sustain a principled security process; this process goes beyond installing the latest security technologies. It encompasses the concept of "organizational security culture. This paper investigates the impact of organizational security culture and transformational leadership on bank employees' social engineering awareness, focusing on security education and behavioral change. Social engineering is the unauthorized infiltration of the end user's computer system and network through malware techniques such as tailgating, phishing, vishing, pretexting, and baiting to gain access to companies and individual confidential data; thus, this study aims to analyze the effect of organizational security culture and transformational leadership on social engineering awareness among bank employees while assessing security education's role in driving behavioral change. This research used the Likert scale model to collect primary data through survey questionnaires from 450 bank employees. The data collected was analyzed using linear regression analysis to test the study’s hypothesis. This study recommends that banking institutions should adopt a good organizational security culture and expose their staff to effective security education, as this will cause a change in employees' security behavior and more research should be conducted regarding security culture, security education, and awareness programs within banking institutions due to bank operations' ever-dynamic nature and ensuring preparedness for prevailing cyber threats.

Usable Security: A Systematic Literature Review

Usable security involves designing security measures that accommodate users’ needs and behaviors. Balancing usability and security poses challenges: the more secure the systems, the less usable they will be. On the contrary, more usable systems will be less secure. Numerous studies have addressed this balance. These studies, spanning psychology and computer science/engineering, contribute diverse perspectives, necessitating a systematic review to understand strategies and findings in this area. This systematic literature review examined articles on usable security from 2005 to 2022. A total of 55 research studies were selected after evaluation. The studies have been broadly categorized into four main clusters, each addressing different aspects: (1) usability of authentication methods, (2) helping security developers improve usability, (3) design strategies for influencing user security behavior, and (4) formal models for usable security evaluation. Based on this review, we report that the field’s current state reveals a certain immaturity, with studies tending toward system comparisons rather than establishing robust design guidelines based on a thorough analysis of user behavior. A common theoretical and methodological background is one of the main areas for improvement in this area of research. Moreover, the absence of requirements for Usable security in almost all development contexts greatly discourages implementing good practices since the earlier stages of development.

Design principles for cognitively accessible cybersecurity training

Exploiting human behavior to gain unauthorized access to computer systems has become common practice for modern cybercriminals. Users are expected to adopt secure behavior to avoid those attackers. This secure behavior requires cognitive processing and is often seen as a nuisance which could explain why attacks exploiting user behavior continues to be a fruitful approach for attackers. While adopting secure behavior can be difficult for any user, it can be even more difficult for users with cognitive disabilities. This research focuses on users with cognitive disabilities with the intent of developing design principles for the development of cognitively accessible cybersecurity training. The target group is estimated to include almost 10 % of all users but is previously understudied. The results show that the target group experience cybersecurity as cognitively demanding, sometimes to a degree that becomes incapacitating. Participating in cybersecurity training requires cognitive energy which is a finite resource. Cognitively accessible cybersecurity training requires a minimalist design approach and inclusion of accessibility functions. A minimalist design approach, in this case, means that both informative and design elements should be kept to a minimum. The rationale is that all such elements require cognitive processing which should be kept to a minimum.

How to keep your information secure? Toward a better understanding of users security behavior

Use of computers and the Internet is an integral part of our lives, with business becoming more digital. As a result, individuals are using their home computers to perform diverse tasks and to store sensitive data. This paper investigates the relative efficacy of two strategies to protect home computers from security threats: security tools and security activities. For the analysis, we collected data from over 1900 individuals in Spain, following an approach combining self- reported data, via an online survey, with actual data collected directly from home users' computers. The main contribution of the paper is to provide a model, based on routine activity theory, explaining the role of security tools and security activities in protecting personal computers from malware infection, thus offering an in-depth understanding of users' security behavior. Using multivariate, logit and probit regressions, our study reveals that having security tools is positively related with higher risk activities and more infections, while pursuing security activities reduces malware infections. These results have important implications for policy makers and organizations, reinforcing the view that security tools are not sufficient to protect users from malware infection, and the need to develop security education and awareness programs for computer users.

The antecedents of employees' proactive information security behaviour: The perspective of proactive motivation

AbstractOrganisational information security (ISec) protection is undergoing a turbulent shift in the workplace environment. In an environment of ever‐increasing risks of insider threats and external cyberattacks, individual employees are often expected to take the initiative to solve organisational security problems. This study therefore focuses on employees' proactive information security behaviours (ISBs)—behaviours that are self‐initiated, change‐oriented, and future‐focused—and the motivations that compel employees to protect organisational assets. We ground our study in Parker et al. (2010) proactive motivation theory (ProMT) and develop an integrated multilevel model to examine the respective effects of proactive motivational states, that is, can‐do, reason‐to, and energised‐to motivations, on employees' proactive ISBs. We also explore the roles of individual differences and contextual factors—namely, proactive personality and supervisory ISec support—and their influences on proactive motivational states. Data were collected from 210 employees situated in 55 departments distributed among multiple organisations located in China. The results show that supervisory ISec support positively influences employees' proactive motivational states and thereby boosts employees' proactive ISBs. Proactive personality negatively moderates the effect of supervisory ISec support on flexible security role orientation (reason‐to motivation). By identifying the antecedents of employees' proactive ISBs, we make key theoretical contributions to ISec research and valuable practical contributions to organisational ISec management.

How memory anxiety can influence password security behavior

Password reuse and modification are insecure password behaviors that are becoming increasingly prevalent as users are obliged to remember more passwords to access various digital services. Many users adopt these risky behaviors as a memory strategy in the belief that they have too many passwords for their memories to cope with. One important avenue in password research is metamemory, which encompasses the knowledge and understanding of memory capabilities and strategies. Previous research on password metamemory has examined the role that metamemory plays in memory performance (i.e., how well memory performs) and password recall. However, no previous research to date has investigated whether password reuse and modification are adopted as memory strategies due to an increase in knowledge and understanding of metamemory. To address this gap, two survey studies (Study1: N = 50, Study 2: N = 303) were implemented to examine the role that password metamemory plays in reusing and modifying passwords. Our findings suggest that of all metamemory constructs, users’ anxiety regarding their perceived ability to remember passwords can influence them to reuse and modify their passwords. These findings have potentially important implications because with an enhanced understanding of how users’ anxiety towards remembering passwords influences their security behavior, this could identify means of reducing password reuse and modification, thereby increasing password security and ultimately reduce some of the consequences of insecure password behaviors.

Informational inequality: the role of resources and attributes in information security awareness

PurposeThe rapid expansion of internet usage and device connectivity has underscored the importance of understanding the public’s cyber behavior and knowledge. Despite this, there is little research that examines the public’s objective knowledge of secure information security practices. The purpose of this study is to examine how objective cyber awareness is distributed throughout society.Design/methodology/approachThis study draws on a large national survey of adults to examine the relationship between individual factors – such as demographic attributes and socioeconomic resources – and information security awareness. The study estimates several statistical models using weighted logistic regression to model objective information security awareness.FindingsThe results indicate that socioeconomic resources such as income and education have a significant effect on individuals’ information security awareness with richer and more highly educated individuals exhibiting greater awareness of important security practices and tools. Additionally, age and gender represent consistent and clear informational gaps in society as older individuals and females are significantly less knowledgeable about an array of information security practices than younger individuals and males, respectively.Social implicationsThe findings have important implications for our understanding of information security behavior and user vulnerability in an increasingly digital and connected society. Despite the growing importance of cybersecurity for all individuals in nearly all domains of daily life, there is substantial inequality in awareness about secure cyber practices and the tools and techniques used to protect one’s self from attacks. While digital technology will continue to permeate many aspects of daily life – from financial transactions to health services to social interactions – the findings here indicate that some users may be far more exposed and vulnerable to attack than others.Originality/valueThis study contributes to our understanding of general user information security awareness using a large survey and statistical models to generalize about the public’s information security awareness across multiple domains and stimulates future research on public knowledge of information security. The findings indicate that some users may be far more exposed and vulnerable to attack than others. Despite the growing importance of cybersecurity for all individuals in nearly all domains of daily life, there is substantial inequality in awareness about secure cyber practices and the tools and techniques used to protect one’s self from attacks.

Rule-Based Detection of Anomalous Patterns in Device Behavior for Explainable IoT Security

Rule-Based Detection of Anomalous Patterns in Device Behavior for Explainable IoT Security

Methodological foundations of information security of students at school

The article presents the experience of researching information security issues in modern educational organizations (preschool, general education, professional), which made it possible to conclude that the search for the methodological foundations of this activity in a modern school is relevant. As a methodological basis, the study considers a systematic approach applied to the analysis of objects that have many interrelated elements, united by common functions and goals, management and functioning, and which involves structural and functional modeling of the process of building the information security of school students. The model of organization of this activity is considered, including the target (goal, objectives, principles), content (pedagogical conditions, components of information security behavior as the basis of information security of school students), organizational and technological (the logic of constructing technology stages), control and evaluation (monitoring, evaluation) components. The presented structural and functional model is characterized by reproducibility, provided that the described components and their content are implemented in the presented sequence.

Enforcing Information System Security

Every year brings numerous security breaches that lead to highly destructive ransomware attacks, data leaks, and reputational damage to governments, companies, and other organizations around the world. As a result, there is a growing need to ensure that workers comply with critical policies put in place to avoid such incidents. This study investigated how factors from social bond theory and involvement theory affected compliance with information security policies and procedures. All of the factors examined were found to have a significant influence on attitudes about compliance, and attitude had a significant impact on intention to comply. The findings of this study revealed that it is vital to raise employees' awareness about compliance with security policies by improving their information security behavior. Moreover, all the factors were found to have a significant influence on the attitude of employees towards compliance with their organizational information security policies and procedures.

The Effects of Environmental Education on Residents' Ecological Security Behavior: The Mediating Role of Nature's Psychological Ownership Perspective and The Moderating Role of Visual Fluency.

Residents are one of the most significant stakeholder groups in ecologically vulnerable regions, and the local ecological environmental governance efforts require their active cooperation and participation. To this end, this study leverages the sampled survey data from residents across 14 cities in Guangxi, China, and uses a structural equation modeling analysis to explore the impact of environmental education perception on residents' ecological security behavior. The results indicate that psychological ownership of nature plays a positive mediating role between environmental education perception and residents' ecological security behavior, as well as between ecological consciousness and residents' ecological security behavior, thereby supporting the idea that a sense of stewardship in protecting ecological security is a key factor in residents' conversion of their ecological protection cognition into practical actions. Further research finds that visual fluency has a moderating effect on the relationship between environmental education perception and psychological ownership of nature. This study provides new insights into the theoretical understanding of the formation mechanism of residents' ecological security behavior, enriches the theory of psychological ownership, and offers policy recommendations for governments implementing ecological environmental propaganda programs.

The need for game-based learning methods to address cyber threats

Cyber security threats are increasingly a serious concern to organisations, with an annual worldwide cost of a trillion dollars in 2021. Potentially the most significant contributor to cyber security threats is the human element, yet this has typically been insufficiently addressed in proposed solutions. Significant resources have been allocated to software, training and other solutions designed to tackle this threat, yet existing methods to improve cyber security have failed to deliver the desired results. Commonly cited issues include the lack of engagement in training, leading to disinterest and a ‘one size fits all’ approach, meaning some groups benefit from training more than others. This study will examine the need for game-based training methods in addressing cyber security threats caused by human error. Game-based training methods have previously been proposed to improve engagement in training and this study will discuss other potential benefits of game-based training. The aim of this work is to justify the use of game-based training methods in cyber security and begin to determine which aspects of games may be most effective at causing long-term positive behaviour change. Following an extensive literature review, a pilot study was run in which a survey was presented to 37 individuals who have taken cyber security training in the past, to query opinions and perceptions regarding cyber security training participants had previously taken, and how they feel they would behave when faced with certain cyber security threats. Upon analysis in SPSS, the results of this work indicate that factors such as training frequency and exposure to cyber security attacks have a significant impact on cyber security behaviour. A correlation between engaging training and impact of training on behaviour also serves to justify the development of such training methods. When combined with previous results on cyber security training this highlights the need for training to be engaging, regular, and relevant, and shows that the realistic simulation of cyber security threats (such as in game-based training) is of significant benefit. These results will help inform future development of effective game-based training methods and encourage their use more widely.