Self-efficacy in information security: Its influence on end users' information security practice behavior

INTRODUCTION Today, in large part, information security is the implementation of controls and best practices suggested by consultants, standard governing bodies (i.e. National Institute of Standards & Technology) (NIST), International Organization for Standardization / International Electrotechnical Commission (ISO/IEC), etc.), the organization's information security department and, sometimes, the organization's employees. While the use of global standards of practice, top management and the information security department within the organization to guide information security planning and implementations may be useful, existing research consistently shows a positive relationship exists between user involvement in planning and the effectiveness of the information systems function within organizations (Gottschalk, 1999; Sambamurthy et al., 1994; Segars & Grover, 1998). A deliverable of the information security planning process is the organization's information security policies and procedures. Standard governing bodies (NIST, ISO/IEC) and researchers (Bidgoli, 2003; Garrison & Posey, 2006) stress the importance of creating information security policies and provide guidance on the different types of information security policies that an organization may need. This research attempts to examine the impact of end-user involvement and formalized information security policies on the effectiveness of the information security function within organizations. Specifically, this study focuses on two antecedent variables, collaborative exchange and formalization, and how it impacts the effective utilization of the information security strategies of deterrence, detection and recovery. Collaborative exchange is an assessment of the extent of collaboration between upper-level management, end users and the information security function. Formalization is an assessment of the extent of established formal information security policies within an organization. The purpose of this research is twofold. First, this research aims to examine the individual effects of formalization and collaborative exchange on the effectiveness of information security detection, deterrence, and recovery activities. Much of the effort expended in the management of information security is in developing and enforcing information security policies. By examining formalization separately, the impact of information security policy development on effective utilization of information security strategies can be assessed. The second aim of this research is to examine the impact of collaborative exchange and formalization in concert on the effectiveness of information security detection, deterrence, and recovery activities. Evaluating complementary effect of collaborative exchange and formalization on effective utilization of information security strategies provides evidence supporting the importance of establishing information security policies with input and effort from all major constituencies within the organization. This study makes several contributions to the literature and practice. First, this research provides insight into how management choices in regards to establishing formal communication channels and developing information security policies may impact the effectiveness of the information security function. Second, the presence of the dependent variable, effectiveness of detection, deterrence and recovery activities, gives academics and practitioners a success measure which can guide more effective decision making in the information security domain. The remainder of this manuscript is organized as follows. The next section discusses the literature supporting the constructs of interest in this study. The following two sections will present the methodological approach taken in this study and the results of data collection. The next section will present the efforts in data analysis. The last section will present a discussion of the important findings and limitations of this research. …

Purpose The purpose of this study is to explore the relationships between learning and ethical behavior with mediation of self-efficacy. The current study is distinguished from previous studies by its investigation of the relationships of three variables such as learning, self-efficacy, and ethical behavior based on the four-level model of Kirkpatrick and transfer of training by the application of the social cognitive theory of Bandura through the analysis of human resource development (HRD) in corporate social responsibility (CSR) activity in local Thai firms. This study aims to encourage organizations to prepare and construct “ethical behavior” through CSR activity. Design/methodology/approach Linear and multiple regression procedures were the basis of the analyses and a PASW statistics version 18 macro (syntax) was used. Findings The major finding was that self-efficacy mediated the relationship between learning (KSA change) and ethical behavior. Practical implications The researchers believe that companies should promote and encourage employees to participate in actual learning of such kinds of CSR activity in order to develop confidence. To achieve this goal, in addition to the purpose of KSA, improvement learning emphasis should be arranged to support self-efficacy of employees and increase a person's confidence in his/her ability to eventually perform ethical behavior. In terms of modification of the four-level model, the company ought to add “self-efficacy” into the procedure of the training and/or activity evaluation to increase its effectiveness. Originality/value The study examined Kirkpatrick's foul-level evaluation model and transfer of training by the application of Bandura's social cognitive theory.

Aim/Purpose: This paper examines the behavior of financial firm employees with regard to information security procedures instituted within their organization. Furthermore, the effect of information security awareness and its importance within a firm is explored. Background: The study focuses on employees’ attitude toward compliance with information security policies (ISP), combined with various norms and personal abilities. Methodology: A self-reported questionnaire was distributed among 202 employees of a large financial Corporation Contribution: As far as we know, this is the first paper to thoroughly explore employees’ awareness of information system procedures, among financial organizations in Israel, and also the first to develop operative recommendations for these organizations aimed at increasing ISP compliance behavior. The main contribution of this study is that it investigates compliance with information security practices among employees of a defined financial corporation operating under rigid regulatory governance, confidentiality and privacy of data, and stringent requirements for compliance with information security procedures. Findings: Our results indicate that employees’ attitudes, normative beliefs and personal capabilities to comply with firm’s ISP, have positive effects on the firm’s ISP compliance. Also, employees’ general awareness of IS, as well as awareness to ISP within the firm, positively affect employees’ ISP compliance. Recommendations for Practitioners: This study can help information security managers identify the motivating factors for employee behavior to maintain information security procedures, properly channel information security resources, and manage appropriate information security behavior. Recommendation for Researchers: Researchers can see that corporate rewards and sanctions have significant effects on employee security behavior, but other motivational factors also reinforce the ISP’s compliance behavior. Distinguishing between types of corporations and organizations is essential to understanding employee compliance with information security procedures. Impact on Society: This study offers another level of understanding of employee behavior with regard to information security in organizations and comprises a significant contribution to the growing knowledge in this area. The research results form an important basis for IS policymakers, culture designers, managers, and those directly responsible for IS in the organization. Future Research: Future work should sample employees from another type of corporation from other fields and should apply qualitative analysis to explore other aspects of behavioral patterns related to the subject matter.

Self-efficacy

The article addresses the problem of the discrepancy between declared information security policies, the requirements of standards and protocols, and the actual functioning of organizational information infrastructures. In practice, components of comprehensive information security systems (CISS) are often developed formally, without considering real risks, characteristics of network protocols, or compliance with international and national security standards. As a result, information security policies are not aligned with technical configuration parameters, leading to fragmentation of protection mechanisms and a decrease in overall system effectiveness. Another critical issue is the continued use of outdated or insecure protocols that remain operational due to the absence of systematic compliance control mechanisms. This study proposes a method for integrating information security policies, standard requirements (ISO/IEC 27001:2022, NIST SP 800-53, Ukrainian ND TZI), and secure network protocols (TLS 1.3, SSHv2, DNSSEC, IPSec) into the process of developing a comprehensive information security system. The method consists of four stages: asset and protocol analysis, development and formalization of security policies, compliance mapping with standards, and construction of an integrated CISS architecture based on the obtained results. To quantitatively assess the consistency of CISS components, a compliance scoring algorithm is introduced, enabling objective evaluation of the information infrastructure’s conformity with regulatory requirements and internal policies. Experimental validation of the method in a test environment demonstrated an increase in compliance with standards from 52% to 92%, the elimination of outdated or insecure protocols (FTP, SMB1, HTTP), and improved accuracy of CISS parameterization due to automated mapping of policies to technical security mechanisms. The obtained results confirm the feasibility and effectiveness of the proposed method for designing and modernizing CISS in organizations of various types. The purpose of this study is to develop a method for integrating information security policies, standards, and protocols into the formation of a comprehensive information security system within an organization.

The key threat to information security is constituted by careless employees who do not comply with information security policies. To ensure that employees comply with organizations’ information security procedures, a number of information security policy compliance measures have been proposed in the past. Prior research has criticized these measures as lacking theoretically and empirically grounded principles to ensure that employees comply with information security policies. To fill this gap in research, this paper advances a new model that explains employees’ adherence to information security policies. In this model, we extend the Protection Motivation Theory (PMT) by integrating the General Deterrence Theory (GDT) and the Theory of Reasoned Action (TRA) with PMT. To test this model, we collected data (N = 917) from four different companies. The results show that threat appraisal, self-efficacy and response efficacy have a significant impact on intention to comply with information security policies. Sanctions have a significant impact on actual compliance with information security policies. Intention to comply with information security policies also has a significant impact on actual compliance with information security policies.KeywordsInformation SecuritySecurity PolicyActual ComplianceResponse EfficacyThreat AppraisalThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

"This book offers insightful articles on the most salient contemporary issues of managing social and human aspects of information security" - Provided by publisher

With increasing dependence on information technology and information system, enterprises are confronting with a more and more complicated information security environment. Thus, information security has become an intractable problem for many enterprises. Generally speaking, there are two methods to improve enterprises’ information security level, that is, technology and management means. Technology means mainly settle software and hardware security of computers and networks, while management means mainly regulate and restrain the entire enterprise system including software, hardware, and employees. At present, a lot of enterprises mostly employ the technology means to solve information security problems. However, the lack or imperfection of information security institutions leads to bad enterprise information security situation. Therefore, technology and management means to solve information security are complementary to each other. As such, it is urgent and necessary to establish and improve information security institutions for many enterprises. In fact, enterprise information security is a complicated activity which needs different sectors to get involved in. More specifically, the information security departments play the very critical role in the implementation of information security institutions, and all employees should comply with the information security policy. Therefore, only the top management teams have the ability to coordinate the relationship between different departments, determine the introduction of information technology, and deploy the information systems. In response, top management support has an important impact on the construct of information security institutions and the effectiveness of information security management. So far, few studies have investigated the mechanism that how top management support affects information security legitimation, and legitimation information security management. Therefore, it has great theoretical and practical significance to the exploration of whether the legitimation supported by top management can improve the effectiveness of information security management. The objective of the current study is to explore whether legitimation prompted by top management team can improve the effectiveness of enterprise information security management. By doing so, the data was collected from the enterprises which have passed the certification of information security management system, and analyzed by using PLS-SEM. The results indicate that information security awareness can improve top management support（including top management belief and top management participation）and the effectiveness of information security management respectively. In addition, top management belief can improve implementation（the first stage of legitimation）and internalization（the second stage of legitimation）. Moreover, implementation can improve the effectiveness of information security management. This paper analyzes the way to enhance effectiveness of information security management, which has a reality-oriented meaning for prompting information security management of enterprises from the standpoint of institution.

A large variety of financial instruments has emerged to allow hedging of risks associated with the underlying assets, whether it is a commodity, weather or economic indicators. However, in the information security domain, cyber-insurance products are the only financial instrument available to hedge the information security risk. Furthermore, cyber-insurance markets are unable or unwilling to accept the high probability and/or high-intensity risks. Thus, there is a need for new financial instruments and a market mechanism to facilitate risk hedging in the information security domain. This article explains the limitations of cyber-insurance market and presents a novel financial instrument and a corresponding trading mechanism to address the problems in the cyber-insurance market. The proposed instrument and trading mechanism can be implemented in an information security prediction market to facilitate the hedging of the risk associated with the underlying information security event or condition. Furthermore, the article demonstrates the application of the proposed financial instrument in an imaginary scenario. Lastly, the article presents an evaluation of the proposed financial instrument and corresponding trading mechanism in hedging the underlying risk. In our analysis, we found that the proposed financial instrument can be a solution, at least to some extent, to the problems in the existing risk hedging mechanisms available in the information security domain.

As organizations’ interest in information resources expands, their investments in information security (IS), such as the introduction of IS policies and new technologies, are also expanding. Nevertheless, IS incidents and threats within the organization have not decreased. This study aims to protect organizations’ information assets by maintaining the level of continuous IS behavior of the organization insiders. Moreover, this study suggests a method to induce continuous security behavior of individuals by confirming the relationship between IS-related voice behavior and IS-related organizational justice, which is an action concept that provides continuous opinions to achieve security goals. This study derives research models and hypotheses through previous studies and tests hypotheses through structural equation modeling. The target subjects are members of the organization who introduced the IS policy. A total of 325 samples were secured through the questionnaire method, and hypotheses were verified. Results reveal that voice behavior related to IS is negatively influenced by work impediment and positively influenced by organizational identification. In addition, procedural and information justice that influence prior actions related to IS affect the cause of personal security behavior (work impediment and organizational identification). Additionally, justice sensitivity adjusted the impact relationship between IS-related organizational justice and the cause of security behavior. The study presents the importance of voice behavior in maintaining the level of IS within the organization continuously. Moreover, it has practical implications in that efforts to improve organizational justice and voice behaviors vary according to the level of individual justice sensitivity.

Information security policy (ISP) noncompliance continue to impede information security in organizations. This paper consolidates the strength of previous studies into an effective single solution. The paper, first, synthesizes the existing literature and groups relevant ISP compliance factors into user involvement, personality types, security awareness and training, behavioral factors, and information security culture. Secondly, a generic framework that guides the development of frameworks for ISP compliance in organizations was developed based on the literature review. The generic framework categorized elements required for developing an ISP compliance framework into structure, content and outcome elements. Thirdly, the generic framework was applied to develop a composite ISP compliance framework that proposes the establishment of ISP compliance as a culture in organizations. Finally, the results of the expert review assessment showed that the proposed composite ISP framework was suitable, structurally sound and fit for purpose.

PurposeThis paper proposes a new framework for optimizing investment decisions when deciding about information security remedies.Design/methodology/approachThe framework assumes that the organization is aware of a set of remedies that can be employed to address end‐effects that have been identified. The framework also assumes that the organization defines its information security policy by setting a minimum level of protection for each end‐effect. Given the two sets of costs, that of the end‐effect and the potential damage it can cause and that of the remedy and the required level of protection from each end‐effect, this framework can be used to identify the optimal set of remedies for a given budget that complies with the organization's information security policy. The framework is illustrated using a practical example concerning investment decision optimization in a financial organization.FindingsThe paper shows that exhausting the information security budget does not assure a higher level of security required by the organisation.Practical implicationsConcentrating on end‐effects and on the organizational requirements eases the process of remedy selection. The proposed methodology circumvents the common process of assuming probabilities of information security events.Originality/valueThis research proposes a practical and an easily implementable framework, enabling the information security manager to align the information security remedies and best practice methodological requirements with organizational budget constraints and business requirements while maintaining a required level of security.

PurposeThe purpose of this study is to respond to calls to increase levels of theory application and extend understanding beyond individuals ensuring social and structural environmental considerations are taken into account. Social cognitive theory (SCT) was applied across two settings to examine its potential to explain breakfast eating frequency.Design/methodology/approachA cross-sectional survey was conducted in two institutional feeding populations [military (n = 314) and mining (n = 235)]. Participants reported key SCT constructs including breakfast eating behaviour (self-efficacy, skills, practice), cognitive aspects (knowledge, attitude, expectations) and their perceptions regarding environmental constructs (access, social norms, influence). These were measured and analysed through SPSS and structural equation modelling (SEM).FindingsResults indicated that 71% males and 90% females in the military do not eat breakfast at work, and in the mining, 23% males and 24% of females do not eat breakfast at work. Furthermore, SEM modelling found only a satisfactory fit for SCT as operationalised in this study. Within the models, behavioural aspects of self-efficacy, skills and practice were significant influences on breakfast eating. Cognitive influences and perceptions of environmental influences exerted little to no effect on breakfast eating. Study results indicate that SCT, as measured in this study using a selection of environment, cognitive and behavioural constructs, does not offer sufficient explanatory potential to explain breakfast eating behaviour.Originality/valueThe value of this paper is to deliver a complete application of Social Cognitive Theory, ensuring multiple constructs are measured to examine the explanatory behaviour of breakfast eating frequency in workplace institutional settings.

Crowdsourcing is a well-established concept in several application areas of computer science and information systems. While crowdsourcing is favored in areas such as information sharing, quality management or data acquisition, only little attention has been drawn to crowdsourcing capabilities for information security in the past. Since a few years an increase of crowdsourcing-based research in information security can be identified. To which extend remains unclear since a comprehensive overview of applied crowdsourcing techniques and related challenges is missing. In this paper we try to shed some light on this by conducting a systematic literature review based on the snowballing methodology. It delivered 23 relevant papers which we analyzed with respect to the following perspectives: (a) Bibliographic information, (b) applied research methodology, (c) addressed information security application context, (d) applied crowdsourcing approach, and (e) challenges for crowdsourcingbased research in information security. Finally, based on the described investigations, we give a comprehensive overview, and identify several challenges of crowdsourcing based research in information security.

PurposeThis paper aims to propose a conceptual model of policy components for software that supports modularizing and tailoring of information security policies (ISPs).Design/methodology/approachThis study used a design science research approach, drawing on design knowledge from the field of situational method engineering. The conceptual model was developed as a unified modeling language class diagram using existing ISPs from public agencies in Sweden.FindingsThis study’s demonstration as proof of concept indicates that the conceptual model can be used to create free-standing modules that provide guidance about information security in relation to a specific work task and that these modules can be used across multiple tailored ISPs. Thus, the model can be considered as a step toward developing software to tailor ISPs.Research limitations/implicationsThe proposed conceptual model bears several short- and long-term implications for research. In the short term, the model can act as a foundation for developing software to design tailored ISPs. In the long term, having software that enables tailorable ISPs will allow researchers to do new types of studies, such as evaluating the software's effectiveness in the ISP development process.Practical implicationsPractitioners can use the model to develop software that assist information security managers in designing tailored ISPs. Such a tool can offer the opportunity for information security managers to design more purposeful ISPs.Originality/valueThe proposed model offers a detailed and well-elaborated starting point for developing software that supports modularizing and tailoring of ISPs.