User Security Behavior Research Articles

Unraveling juxtaposed effects of biometric characteristics on user security behaviors: A controversial information technology perspective

Biometric authentication has become ubiquitous and profoundly impacts decision-making for both individuals and firms. Despite its extensive implementation, there is a discernible knowledge gap in understanding the nuanced influence of biometric characteristics on user security behaviors. To advance this line of research, we embrace the controversial information technology framework to delve into the juxtaposed nature of biometric characteristics, wherein they concurrently yield benefits and raise concerns that manifest in opposing effects on users' switching behavior. Adopting a sequential mixed methods approach, we first conducted semi-structured interviews that uncovered three key biometric characteristics and identified two benefits and two concerns associated with them. A follow-up survey was conducted to explore the interplay between each identified construct. The results emphasize the pivotal role of biometric characteristics in shaping user security behavior. Our research contributes to theoretical understanding by scrutinizing user behaviors vis-à-vis biometric authentication through a controversial IT perspective.

Primena teorije stavova za određivanje pristupa bezbednosti korisnika

Mobile phones and internet form a crucial part of modern life, which raises important questions, such as security, data protection and privacy. Countless studies examine what influences users' approaches towards security. The attitude theory gives the basic background to the present study through which the topics of cyber safety and security, data protection and privacy are examined. The three components of attitude, which served as the three pillars of the applied survey, are: (1) the cognitive component (belief and knowledge), (2) the affective component (feelings) and (3) the behavioural component (the effect of the attitude on the users' behaviour). Self-reported security knowledge and feelings about security were assessed, out of which three factors were formed using EFA. The security behaviour of each factor was examined to determine the consistency of the responses. Moreover, the three factors helped to identify three separate clusters. As a conclusion it can be stated that the theory of attitudes can help understanding user security behaviour better. Finally, future research directions are suggested.

Usable Security: A Systematic Literature Review

Usable security involves designing security measures that accommodate users’ needs and behaviors. Balancing usability and security poses challenges: the more secure the systems, the less usable they will be. On the contrary, more usable systems will be less secure. Numerous studies have addressed this balance. These studies, spanning psychology and computer science/engineering, contribute diverse perspectives, necessitating a systematic review to understand strategies and findings in this area. This systematic literature review examined articles on usable security from 2005 to 2022. A total of 55 research studies were selected after evaluation. The studies have been broadly categorized into four main clusters, each addressing different aspects: (1) usability of authentication methods, (2) helping security developers improve usability, (3) design strategies for influencing user security behavior, and (4) formal models for usable security evaluation. Based on this review, we report that the field’s current state reveals a certain immaturity, with studies tending toward system comparisons rather than establishing robust design guidelines based on a thorough analysis of user behavior. A common theoretical and methodological background is one of the main areas for improvement in this area of research. Moreover, the absence of requirements for Usable security in almost all development contexts greatly discourages implementing good practices since the earlier stages of development.

Level of User Security Behavior in the Service Industry

User security behavior is all user actions related to computer system security. Previous studies have shown that user security behavior is one of the main causes of computer and information security problems in many organizations. In order to mitigate this problem, we need to find a solution to improve user security behavior in the organization. This process involves three steps. This study emphasizes the first step to address an organization's security behavior. Therefore, this study aims to determine the level of user security behavior for four service industries in West Sumatra in 2019. This study is carried out by using a survey research method. Questionnaires were distributed to 320 respondents from four service sectors: government, education, banking, and private services. The questionnaire consists of 30 questions comprising seven factors influencing user security behavior: the organization's values, co-workers' behavior, the ability to make decisions, the availability of supporting tools, individual values and standards, the employee-employer relationship, and the Effort required. The result shows that the level of user security behavior is reasonably high. This implies that service sector employees in Indonesia are aware of the threats in cyberspace and the importance of the security procedure at work. For further research, we plan to study some security problems in more detail to propose possible solutions or actions to improve user security behavior in the service industry, particularly in Indonesia.

Intention to share: the relationship between cybersecurity behaviour and sharing specific content in Facebook

Introduction. Sharing information on Facebook is becoming increasingly popular. Sharing text, video, voice, and pictures with unique content of the language-specific and sacred text, is becoming a trend. Consequently, issues of secure and trustable content have become increasingly important to all netizens. This issue has its foundations in the intention to share behaviour where the emphasis is on user security behaviour when sharing specific content. Method. The proposed theory was adapted and modified from previous research to empirically evaluate survey data collected from 154 Facebook users. A snowball sampling method was used. Analysis. A quantitative analysis was carried out on the data, which related to 154 Facebook users. This analysis used SmartPLS software. Results. The experience of information sharing was found to be an important determinant of personal outcome expectation as it explained about 89.9 per cent of the total variance. The ability to create and share information, subjective norms, feedback, information sharing self-efficacy, personal outcome expectations, and information security behaviour have become most important factors when intending to share specific content on Facebook. Conclusions. There is a theoretical understanding of security behaviour as a factor that promotes specific-content sharing behaviour on Facebook.

Security behaviour of mobile financial service users

PurposeThe inception of mobile financial services (MFSs) has positively provoked economic growth and productivity, nonetheless, it has pessimistically caused an upward surge in cybersecurity threat. Customers are progressively becoming conscious of some of the threat and several of them now shun away from some suspicious activities over the internet as a form of protection. This study aims to explore the factors that influence users’ to adopt security behaviour.Design/methodology/approachA synthesis of theories – Self-efficacy and technology threat avoidance theories – was used to examine the security behaviour of users of MFSs. Data was gathered from 530 students in Ghana using convenience sampling technique. Data analysis was carried out using descriptive statistics, inferential statistics and structural equation model.FindingsOutcome of the investigation indicate that both mastery experience and verbal persuasion have substantial effect on the avoidance motivation of MFSs users. It was, however, found that emotional state and vicarious experience of users do not influence their avoidance motivation. Also, it was established that avoidance motivation is a positive prognosticator of avoidance behaviour.Practical implicationsUnderstanding the security behaviour of MFS users will help the operators to outline strategies to sustain the successes achieved.Originality/valueStudies on user security behaviour are rare, especially in sub Saharan Africa, thus, this study will contribute to extant literature by adding a new dimension of user security behaviour.

The password practices applied by South African online consumers: Perception versus reality

Background: The ability to identify and authenticate users is regarded as the foundation of computer security. Although new authentication technologies are evolving, passwords are the most common method used to control access in most computer systems. Research suggests that a large portion of computer security password breaches are the result of poor user security behaviour. The password creation and management practices that online consumers apply have a direct effect on the level of computer security and are often targeted in attacks. Objectives: The objective of this study was to investigate South African online consumers’ computer password security practices and to determine whether consumers’ perceptions regarding their password security ability is reflected in the password creation and management practices that they apply. Method: A Web-based survey was designed to (1) determine online consumers’ perceptions of their skills and competence in respect of computer password security and (2) determine the practices that South African online consumers apply when creating and managing passwords. The measures applied were then compared to (1) the users’ perceptions about their computer password security abilities and (2) the results of international studies to determine agreement and inconsistencies. Results: South African online consumers regard themselves as proficient password users. However, various instances of unsafe passwords practices were identified. The results of this South African study correspond with the results of various international studies confirming that challenges to ensure safe online transacting are in line with international challenges. Conclusion: There is a disparity between South African online consumers’ perceived ability regarding computer password security and the password creation and management practices that they apply.

Dimension of mobile security model: mobile user security threats and awareness

This is an exploratory study that evaluates mobile security awareness and mobile security vulnerabilities based on practices among mobile users in higher education institutions. Using a cross-sectional survey and a convenient sampling technique, students from one of the universities in Malaysia where e-learning and m-learning are implemented were chosen as the target population. The work shows that different layers of mobile security awareness exist among learners of each establishment. Key findings include differences in perception of wireless connection in mobile devices while on a public network, seemingly inappropriate usage, security protection among mobile users, security threat created by mobile devices and security threat awareness behaviour of users. This paper indicates a generic threat model for the processes of mobile learning. After a brief discussion of the attributes involved with mobile user security behaviour and protective characteristics of digital learning from the security and dependability point of view, the use of threat models in mobile users' security is explained. Limitations and future research have been indicated.

Influence of Awareness and Training on Cyber Security

This article presents the results of a study to determine the impact of a cyber threat education and awareness intervention on changes in user security behavior. Subjects were randomly assigned to one of two introductory lectures about cyber threats due to poor password management. The low-information condition was based on very general background information on passwords and computer security, while the high-information condition included very detailed and specific information on the threats to subjects' use of e-commerce. The pre/post-treatment design was a single, between-subjects factor (information level–low/high), repeated measures study, with password strength at Time 1 and password strength at Time 2 used to measure change in security behavior over a period of two weeks. The study found that at Time 1, participants possessed no significant differences in the strength of their passwords. Two weeks later, the password strength of the participants in the low-information condition was not statistically different than their initial levels, while subjects in the high-information condition demonstrated password ratings 36 percent stronger (t = 17.0, p = .000). It is concluded that when users were educated of the threats to e-commerce and trained about proper security practices, their behavior could be changed to enhance online security for themselves and the firms where they are employed.

Improving user security behaviour

Many organisations suspect that their internal security threat is more pressing than their external security threat. The internal threat is predominantly the result of poor user security behaviour. Yet, despite that, security awareness programmes often seem more likely to put users to sleep than to improve their behaviour. This article discusses the influences that affect a user's security behaviour and outlines how a well structured approach focused on improving behaviour could be an excellent way to take security slack out of an organisation and to achieve a high return for a modest, low-risk investment.