A police officer sees a drunk man searching for something under a streetlight and asks what he's lost. The drunk man says that he's lost his keys. They both look under the streetlight together. After a few minutes, the officer asks the man whether he's sure he lost them here; the drunk replies "no," and that he lost them in the park. The officer asks why he's searching here, and the drunk replies, "This is where the light is. "

No abstract

Many organisations run security awareness programmes with the aim of improving end user behaviours around information security. Yet behavioural research tells us that raising awareness will not necessarily lead to behaviour change. In this paper we examine the challenge of changing end user behaviour and put forward social marketing as a new paradigm. Social marketing is a proven framework for achieving behavioural change and has traditionally been used in health care interventions, although there is an increasing recognition that it could be successfully applied to a broader range of behaviour change issues. It has yet to be applied however, to information security in an organizational context. We explore the social marketing framework in relation to information security behavioural change and highlight the key challenges that this approach poses for information security managers. We conclude with suggestions for future research.