Theorising on Information Cascades and Sequential Decision-making for Analysing Security Behaviour

As organizations’ interest in information resources expands, their investments in information security (IS), such as the introduction of IS policies and new technologies, are also expanding. Nevertheless, IS incidents and threats within the organization have not decreased. This study aims to protect organizations’ information assets by maintaining the level of continuous IS behavior of the organization insiders. Moreover, this study suggests a method to induce continuous security behavior of individuals by confirming the relationship between IS-related voice behavior and IS-related organizational justice, which is an action concept that provides continuous opinions to achieve security goals. This study derives research models and hypotheses through previous studies and tests hypotheses through structural equation modeling. The target subjects are members of the organization who introduced the IS policy. A total of 325 samples were secured through the questionnaire method, and hypotheses were verified. Results reveal that voice behavior related to IS is negatively influenced by work impediment and positively influenced by organizational identification. In addition, procedural and information justice that influence prior actions related to IS affect the cause of personal security behavior (work impediment and organizational identification). Additionally, justice sensitivity adjusted the impact relationship between IS-related organizational justice and the cause of security behavior. The study presents the importance of voice behavior in maintaining the level of IS within the organization continuously. Moreover, it has practical implications in that efforts to improve organizational justice and voice behaviors vary according to the level of individual justice sensitivity.

Purpose – The purpose of this paper was to analyse existing theories from the social sciences to gain a better understanding of factors which contribute to student mobile phone users’ poor information security behaviour. Two key aspects associated with information security behaviour were considered, namely, awareness and behavioural intent. This paper proposes that the knowing-and-doing gap can possibly be reduced by addressing both awareness and behavioural intent. This research paper explores the relationship between student mobile phone user information security awareness and behavioural intent in a developmental university in South Africa. Design/methodology/approach – Information security awareness interventions were implemented in this action research study, and student information security behavioural intent was observed after each cycle. Findings – The poor security behaviour exhibited by student mobile phone users, which was confirmed by the findings of this study, is of particular interest in the university context, as most undergraduate students are offered a computer-related course which covers certain information security-related principles. Existing researchers in the field of information security still grapple with the “knowing-and-doing” gap, where user information security knowledge/awareness sometimes does not result in safer behavioural practises. Originality/value – Zhang et al. (2009) suggest that understanding human behaviour is important when dealing with the problems caused by human errors. Harnesk and Lindstrom (2011) expressed a concern that existing research does not address the interlinked relationship between anticipated security behaviour and the enactment of security procedures. This study acknowledges Choi et al. (2008) contribution in their discussions on the “knowing-and-doing gap” suggests a link between awareness and actual behaviour that is confirmed by the findings of this study.

IS professionals’ information security behaviors in Chinese IT organizations for information security protection

Aim/Purpose: This paper examines the behavior of financial firm employees with regard to information security procedures instituted within their organization. Furthermore, the effect of information security awareness and its importance within a firm is explored. Background: The study focuses on employees’ attitude toward compliance with information security policies (ISP), combined with various norms and personal abilities. Methodology: A self-reported questionnaire was distributed among 202 employees of a large financial Corporation Contribution: As far as we know, this is the first paper to thoroughly explore employees’ awareness of information system procedures, among financial organizations in Israel, and also the first to develop operative recommendations for these organizations aimed at increasing ISP compliance behavior. The main contribution of this study is that it investigates compliance with information security practices among employees of a defined financial corporation operating under rigid regulatory governance, confidentiality and privacy of data, and stringent requirements for compliance with information security procedures. Findings: Our results indicate that employees’ attitudes, normative beliefs and personal capabilities to comply with firm’s ISP, have positive effects on the firm’s ISP compliance. Also, employees’ general awareness of IS, as well as awareness to ISP within the firm, positively affect employees’ ISP compliance. Recommendations for Practitioners: This study can help information security managers identify the motivating factors for employee behavior to maintain information security procedures, properly channel information security resources, and manage appropriate information security behavior. Recommendation for Researchers: Researchers can see that corporate rewards and sanctions have significant effects on employee security behavior, but other motivational factors also reinforce the ISP’s compliance behavior. Distinguishing between types of corporations and organizations is essential to understanding employee compliance with information security procedures. Impact on Society: This study offers another level of understanding of employee behavior with regard to information security in organizations and comprises a significant contribution to the growing knowledge in this area. The research results form an important basis for IS policymakers, culture designers, managers, and those directly responsible for IS in the organization. Future Research: Future work should sample employees from another type of corporation from other fields and should apply qualitative analysis to explore other aspects of behavioral patterns related to the subject matter.

Purpose The purpose of this paper is to examine factors and mechanism inducing end users' faithful appropriation of information security behavior through the information security system. This study is also trying to find out the role of Employees' adaptive activities like learning and feedback seeking behavior for the information security in organizations. Design/methodology/approach An empirical study was carried out with a sample of employees working in the financial service company. Employees(n = 268) completed a written questionnaire. Structural equation modeling was used to analyze the data. Findings Results indicated that employees' learning activities and feedback seeking behavior fully mediated the effect of major information security factors toward end users' faithfulness of appropriation of information security systems. In order to increase the level of employees information security behavior in accordance with security guideline, organizations should facilitate interactions that support the feedback seeking process between employees on information security awareness and behavior. Additionally, organizations may reinforce these behaviors by periodical training and adopting bounty hunter systems.

This article examines the occurrences of four types of unethical employee information security behavior—misbehavior in networks/applications, dangerous Web use, omissive security behavior, and poor access control—and their relationships with employees’ information security management efforts to maintain sustainable information systems in the workplace. In terms of theoretical contributions, this article identifies and develops reliable and valid instruments to measure different types of unethical employee information security behavior. In addition, it investigates factors affecting different types of such behavior and how such behavior can be used to predict employees’ willingness to report information security incidents. In terms of managerial contributions, the article suggests that information security awareness programs and perceived punishment have differential effects on the four types of unethical behavior and that certain types of unethical information security behavior exert negative effects on employees’ willingness to report information security incidents. The findings will help managers to derive better security rules and policies, which are important for business continuity.

IntroductionInformation security policy (ISP) compliance of employees has a profound impact on organization. In the context of information technology innovation and information systems upgrade, employees’ information security behavior is one of the most crucial elements in the information security management of organizations. Based on the two-dimensional model of challenge−hindrance stressor theory and affective events theory, this study explores the mediating effects of emotions on the relationship between challenge information security stress and ISP compliance.MethodsA field quasi-experimental method was used in this study. Materials include the Challenge Information Security Stress Scale, Information System Security Policy Compliance Scale, and Emotions Scale, which were used to form the two-stage questionnaire surveys. Data of 217 employees from three Chinese companies in Shanghai and Beijing that had passed certifications for information security management system (GB/t22080-2008/ISO/IEC 27001:2005) were collected. Bootstrapping method for multiple mediation models and the Process 3.0 plug-in of SPSS 20.0 were used for data analysis.ResultsThe findings indicate that challenge information security stress has a positive effect on ISP compliance. Challenge information security stress has a positive effect on positive emotions and a negative effect on negative emotions. Positive emotions have mediating effect between challenge information security stress and ISP compliance, but negative emotions have no mediating effect.ConclusionThe research results expand the research scope of challenging stress in the two-dimensional model of challenge−hindrance stressor theory in the context of organizational information security. The findings reveal the mediating effect of positive emotions in challenge information security stress and ISP compliance relationship, which provides empirical support for the application of positive psychology in the field of management.

This article investigates security behaviours of employees using the Health Belief Model (HBM) as a theoretical lens. Given the fact that previous studies on security behaviours paid much attention to conscious information security behaviours; this article extends the HBM to study both habitual or automatic security behaviours (security habit) and conscious security behaviours of Tanzanian government employees. A structural equation modelling (SEM) technique was used for data analysis. The study found that, the intentions of government employees to practice information security behaviour is influenced by perceived severity, perceived susceptibility, perceived barriers, and cues to action and security habits. Their intentions, however, is not affected by perceived benefits and self-efficacy. Further, an employee's intentions and security habits has a significant effect on actual security practice. Generally, the extended research model enriches the understanding of the role played by both conscious and habitual security behaviours on information security behaviours of employees.

Human factors significantly contribute to breaches in healthcare organizations, such as a lack of awareness regarding cybersecurity threats. This study aims to evaluate the information security behaviors of healthcare workers and identify critical demographic factors that influence them. The demographic factors examined in this study include age, gender, education level, type of profession, and frequently used devices to access health information systems (HIS). Information security behavior evaluated in this study consists of four dimensions: Device Protection, Password Management, Proactive Awareness, and Information Handling. This study employs quantitative methods. Data are collected through an online survey of 209 health workers in Indonesia. The data analysis process consists of two stages. The first stage is comparison group analysis using the Chi-square test to define significant factors in studied security behavior, and the second stage is multivariate analysis, which employs binary logistic regression to determine the most impactful variables. The findings show that, among the five characteristics examined, education level had the most significant effect on the information security behavior of healthcare workers in Indonesia. It underlines the necessity of education in sculpting security practices and awareness in an ever-changing digital world. This study recommends that while developing a security training and awareness program, the education level of healthcare workers should be considered to improve healthcare facilities' security posture and decrease data breach risks. As a result, governments and healthcare managers are encouraged to emphasize training programs as a strategic method of improving information security standards in the business.

An analysis of multiple factors relating to teachers' problematic information security behavior

PurposeInformation security is a growing issue that impacts organizations in virtually all industries, and data breaches impact millions of customers and cost organizations millions of dollars. Within the past several years alone, huge data breaches have been experienced by organizations such as Marriot, Equifax, eBay, JP Morgan Chase, Home Depot, Target and Yahoo, the latter of which impacted three billion users. This study aims to examine the utilization of pre-employment screening to identify potential hires that may require enhanced information security training to avoid such costs.Design/methodology/approachThe authors hypothesize that an individual’s work ethic predicts a person’s information security behavior. The authors test this hypothesis using structural equation modeling with bootstrapping techniques.FindingsData analysis suggests that certain dimensions of work ethic do indeed predict information security posture, and thus, simple pre-employment screening techniques (i.e. questionnaires) can aid in identifying potential security threats.Practical implicationsThe findings provide a tool for identifying problematic employee security posture prior to hiring, which may be useful in identifying training needs for new hires.Originality/valueThe findings provide a tool for identifying problematic employee security posture prior to hiring, which may be useful in identifying training needs for new hires.

ABSTRACTEmployees’ violation of information security policies is a major threat to an organisation. Some violations such as using an easy-to-guess password or storing confidential data on personal unencrypted flash drives usually do not cause immediate harm; instead, these actions create security flaws that can be attacked in the future and cause delayed consequences. We call such behaviour consequence-delayed information security violation (CDISV). The ignorance or denial of the possible delayed consequences is the main reason employees engage in such insecure behaviour. Due to the delay between the action and the consequence, a long-term mindset could play an important role in employees’ current decision-making. Specifically, in this study, we propose that long-term orientation is an influential factor in decreasing CDISV. The long-term orientation includes three dimensions: continuity, futurity, and perseverance. In addition, based on the stewardship theory and the needs theory, we further propose that value identification and the fulfilment of higher-order needs (trusted relationship and growth) are important drivers for employees to have a long-term orientation. We collected survey data using the 170 responses we received from a global company’s employees. The empirical results support our arguments. Our findings provide implications to organisations to encourage employees’ information security behaviours.

Information security risks have become a significant concern for users of computer information technology. However, users' behavior of acceptance and actual use of available information security solutions has not been commensurate with the level of their information security concerns. Traditional technology acceptance theory (TAM) emphasizes the factors of perceived usefulness and perceived ease of use in acceptance of technology. There has been little research focus and consensus on the role of knowledge in user adoptions of information security solutions. This paper proposes a new and adapted model of technology acceptance that focuses on the relationship between users' knowledge of information security and their behavioral intention to use information security solutions. This study employs a survey method that measures users' knowledge of information security and their attitude and intention toward using information security solutions. Statistical analysis of the results indicates a positive correlation between user knowledge of information security and user intention to adopt and use information security solutions.

In the digital era, organizations are increasingly vulnerable to insider threats and non-compliance with information security policies. This study presents a systematic literature review aimed at conceptually distinguishing between absolute and restrictive deterrence within the context of employee compliance with organizational information security policies. The review draws upon academic databases such as MIS, Springer, JSTOR, ScienceDirect, AISeL, and EBSCO using keywords including deterrence theory, compliance, and information security behavior. The findings reveal that while absolute deterrence focuses on formal, law-enforced sanctions to prevent insider criminal acts, restrictive deterrence seeks to reduce the frequency of policy violations by imposing informal or less severe formal controls. This review highlights inconsistencies in how deterrence constructs are operationalized across studies—some blending severity, certainty, and swiftness into a single variable, others substituting deterrence indicators with proxies like awareness and education. Despite these differences, the review underscores that research on deterrence in information security remains in its developmental stage. It suggests a need for further empirical studies that compare the impact of deterrence mechanisms with positive motivational strategies to encourage compliance. Additionally, this review calls for future research to address different types of criminal decision-making processes and contextual organizational factors that influence behavior. These insights are valuable for designing more effective information security governance frameworks tailored to human behavior in the workplace.

Traditionally, information security has been approached in terms of how to achieve the confidentiality, integrity, and availability of information. In this paper, we seek to ontologically examine information security by using Gilles Deleuze and Félix Guattari’s philosophical concepts of machine, coupling, interruption, and territory. Through these concepts, we conceptualize information security as an order-seeking, connection-based, territorial security machine that attempts to subject and harness other actors – from technical devices and physical barriers to employees and various combinations of these actors – to carry out the security machine’s protective tasks. The goal of the security machine is to block or interrupt the chaotic forces of the outside and, thus, to maintain the fragile order of information. However, the process of interrupting the outside requires interruption of the inside as well: users and organizations are interrupted daily by the security machine and its practices. Yet this aspect of information security has remained largely unexamined. We argue that the question of what information security does to its subjects – what its effects are – in the protected system should be examined more thoroughly.