Purpose– The purpose of this empirical research is to attempt to explore the effect of information security initiatives (ISI) on supply chain performance, considering various intra- and inter-organization information security aspects that are deemed to have an influence on supply chain operations and performance.Design/methodology/approach– Based on extant information security management and supply chain security management literature, a conceptual model was developed and validated. A questionnaire survey instrument was developed and administered among supply chain managers to collect data. Data were collected from 197 organizations belonging to various sectors. The study used exploratory and confirmatory factor analysis for data analysis. Further, to test the hypotheses and to fit the theoretical model, structural equation modeling techniques were used.Findings– Results of this study indicate that ISI, comprising technical, formal and informal security aspects in an intra- and inter-organizational environment, are positively associated with supply chain operations, which, in turn, positively affects supply chain performance.Research limitations/implications– This study provides the foundation for future research in the management of information security in supply chains. Findings are expected to provide the communities of practice with better information security decision-making in a supply chain context, by clearly formulating technical, formal and informal information security policies for improving supply chain performance.Originality/value– In today’s global supply chain environment where competition prevails among supply chains, this research is relevant in terms of capability that an organization has to acquire for managing internal and external information security. In that sense, this study contributes to the body of knowledge with an empirical analysis of organizations’ information security management initiatives as a blend of technical, formal and informal security aspects.

Purpose – The purpose of this paper is to survey the status of information security awareness among college students in order to develop effective information security awareness training (ISAT). Design/methodology/approach – Based on a review of the literature and theoretical standpoints as well as the National Institute of Standards and Technology Special Publication 800-50 report, the author developed a questionnaire to investigate the attitudes toward information security awareness of undergraduate and graduate students in a business college at a mid-sized university in New England. Based on that survey and the previous literature, suggestions for more effective ISAT are provided. Findings – College students understand the importance and the need for ISAT but many of them do not participate in it. However, security topics that are not commonly covered by any installed (or built-in) programs or web sites have a significant relationship with information security awareness. It seems that students learned security concepts piecemeal from variety of sources. Practical implications – Universities can assess their ISAT for students based on the findings of this study. Originality/value – If any universities want to improve their current ISAT, or establish it, the findings of this study offer some guidelines.

Purpose – The purpose of this paper is to identify variables that influence compliance with information security policies of organizations and to identify how important these variables are. Design/methodology/approach – A systematic review of empirical studies described in extant literature is performed. This review found 29 studies meeting its inclusion criterion. The investigated variables in these studies and the effect size reported for them were extracted and analysed. Findings – In the 29 studies, more than 60 variables have been studied in relation to security policy compliance and incompliance. Unfortunately, no clear winners can be found among the variables or the theories they are drawn from. Each of the variables only explains a small part of the variation in people's behaviour and when a variable has been investigated in multiple studies the findings often show a considerable variation. Research limitations/implications – It is possible that the disparate findings of the reviewed studies can be explained by the sampling methods used in the studies, the treatment/control of extraneous variables and interplay between variables. These aspects ought to be addressed in future research efforts. Practical implications – For decision makers who seek guidance on how to best achieve compliance with their information security policies should recognize that a large number of variables probably influence employees' compliance. In addition, both their influence strength and interplay are uncertain and largely unknown. Originality/value – This is the first systematic review of research on variables that influence compliance with information security policies of organizations.

– The purpose of this paper is to develop a model for online transactions, integrating the social influence approach, the trust‐risk framework, and the theory of reasoned action, and to test it in a non US/UK context such as Greece., – Structural equation modeling was used to survey data from 376 household respondents from two residential departments of the city of Thessaloniki in Greece in order to examine causal inferences., – The results of the model, where the trust‐risk‐subjective norms framework mediated the impact of information privacy on actual transactions, indicated that the individual's attitude toward using technology, through the intention to submit individual information, resulted in positive actual transaction outcomes., – Cross‐section data were used for testing the model. However, for properly investigating causality time‐series or longitudinal data should be employed., – For increasing online transactions, organizations should make their websites as simple and attractive as possible, develop their image that they do care about customers and are trustworthy, and develop privacy‐friendly policies for gaining competitive advantage., – This study proposes and empirically validates an integrative framework for online transactions at the individual level by adapting information privacy concerns and trust‐risk‐subjective norm beliefs and relates them to attitudes of individuals. Thus, the proposed integrative framework is critically engaging and well established but with limited information models.

PurposeThe purpose of this paper is to measure and discuss the long‐term effects of an e‐learning tool aiming at improving the information security knowledge, awareness, and behaviour of employees.Design/methodology/approachThe intervention study had two assessments of knowledge and attitudes among employees: one survey, one week before the intervention, and one survey eight months after the intervention. The population was divided into an intervention group and a control group, where the only separated the groups was participation in the intervention (i.e. the e‐learning tool).FindingsThe study documents that the effects of the intervention on security awareness and behavior partly remains more than half a year after the intervention, but that the detailed knowledge on information security issues diminished during the period. The study also discusses how such courseware can contribute to long‐term organizational learning compared with human interventions such as action research. Both human resource management and internal promotion are necessary input in the process to successfully educate and train employees in information security.Research limitations/implicationsOne weakness of concern is the low response rate of 37 in the final analysis.Practical implicationsThe study can document that short‐time effects of software supported information security awareness on employees' knowledge, behaviour, and awareness diminish over time. It is thus important to maintain and continually perform information security awareness. More interventions studies, following the same principles as presented in this paper, of other user‐directed measures is needed, to test and document the effects of different measures.Originality/valueThe paper is innovative in the area of information security research as it shows how an information security intervention can be measured.

PurposeThis paper proposes a new framework for optimizing investment decisions when deciding about information security remedies.Design/methodology/approachThe framework assumes that the organization is aware of a set of remedies that can be employed to address end‐effects that have been identified. The framework also assumes that the organization defines its information security policy by setting a minimum level of protection for each end‐effect. Given the two sets of costs, that of the end‐effect and the potential damage it can cause and that of the remedy and the required level of protection from each end‐effect, this framework can be used to identify the optimal set of remedies for a given budget that complies with the organization's information security policy. The framework is illustrated using a practical example concerning investment decision optimization in a financial organization.FindingsThe paper shows that exhausting the information security budget does not assure a higher level of security required by the organisation.Practical implicationsConcentrating on end‐effects and on the organizational requirements eases the process of remedy selection. The proposed methodology circumvents the common process of assuming probabilities of information security events.Originality/valueThis research proposes a practical and an easily implementable framework, enabling the information security manager to align the information security remedies and best practice methodological requirements with organizational budget constraints and business requirements while maintaining a required level of security.

Purpose Cognitive passwords are typically realized using “one size fits all” fact-based or opinion-based questions, and as such are prone to guessing attacks. The purpose of this paper is to propose a method of personalizing cognitive passwords to individual users, to close this loophole, and evaluate its performance against rigid cognitive passwords. Design/methodology/approach A personalized questionnaire formulated by the subjects was benchmarked against a rigid questionnaire in terms of recall and security. The evaluation employed two constructs used extensively in previous research, namely, Recall – the success in remembering a password, and Secrecy – the likelihood that the password cannot be guessed. Findings While the experiment found that personalization increases the recall of cognitive passwords, it showed no improvement in secrecy (reducing guessing rates). Research limitations/implications The study was conducted in an academic environment with young freshmen students thereby limiting external validity. Another problem might stem from the difference in the length of the questionnaires between groups in order to minimize drop-out rates. Practical implications Secrecy was and still is the Achilles heel of the cognitive password mechanism and therefore the results imply that some restrictions should be imposed to prevent selection of over-simplistic cognitive passwords. Originality/value This study is important because it is the first of its kind – benchmarking recall and secrecy of two types of cognitive authentication methods – rigid and personalized.

Purpose The purpose of this paper is to take a novel approach to help users better understand and be more aware of what third parties are learning about them as they browse the web. Design/methodology/approach The approach the authors take is to personalize the awareness by using JavaScript embedded in a web page to examine portions of a user's web-browser history in order to ascertain web sites that the user has visited. The authors then personalize information reported to the user about what third-party sites are tracking the user's behavior along with demographic information these sites may be inferring from these visited sites and the user's geographic location. Findings It was found that 63 percent of users agreed with a statement of concern for third parties monitoring activities, about half of the respondents agreed with a concern for knowledge about a user's location and a little more than half agreed to concern about inference of demographic information. It was found that females are more concerned about these issues than males. In terms of possible actions, a majority of users report using an ad blocker tool and even more delete cookies at least some amount of time. Using an opt-out mechanism or removing browser history is done by less than 20 percent of users. Despite expressing more concern for information known by third parties, females are not significantly more likely to take actions that may limit what is leaked to these third parties. A contributor to this discrepancy is that females were much less likely to know their settings for many of the actions, indicating less familiarity with them. Social implications Web privacy is an important social issue so helping users to better understand tracking of their actions, along with what actions can be taken to limit tracking, is important. Originality/value The paper takes an original approach to helping users understand what third parties learn about them and follows up that approach with a survey of user attitudes and actions on this important topic.