A Reliable Measure of Information Security Awareness and the Identification of Bias in Responses

Abstract

The Human Aspects of Information Security Questionnaire (HAIS-Q) is designed to measure Information Security Awareness. More specifically, the tool measures an individual's knowledge, attitude, and self-reported behaviour relating to information security in the workplace. This paper reports on the reliability of the HAIS-Q, including test-retest reliability and internal consistency. The paper also assesses the reliability of three preliminary overclaiming items, designed specifically to complement the HAIS-Q, and identify those individuals who provide socially desirable responses. A total of 197 working Australians completed two iterations of the HAIS-Q and the over-claiming items, approximately 4 weeks apart. Results of the analysis showed that the HAIS-Q was externally reliable and internally consistent. Therefore, the HAIS-Q can be used to reliably measure information security awareness. Reliability testing on the preliminary over-claiming items was not as robust and further development is required and recommended. The implications of these findings mean that organisations can confidently use the HAIS-Q to not only measure the current state of employee information security awareness within their organisation, but they can also measure the effectiveness and impacts of training interventions, information security awareness programs and campaigns. The influence of cultural changes and the effect of security incidents can also be assessed.

The influence of social education level on cybersecurity awareness and behaviour: a comparative study of university students and working graduates

“…Hence, a clear distinction can be observed between awareness and behaviours. Finally, studies have shown that HAIS-Q has high internal consistency and external reliability (McCormac et al, 2017;Parsons et al, 2014), making it a valid and reliable measurement tool for internet security perceptions and actions.…”

“…Participants respond to each of the items by indicating a score on a five-point Likert scale ("5 = strongly agree", "1 = strongly disagree"). With a total of 31 reverse question items, the HAIS-Q have been consistently found to be a reliable and valid instrument for measuring ISA (McCormac et al, 2017;Parsons et al, 2017;Pattinson et al, 2017). The questionnaire was created and distributed online using one of the biggest local survey platforms, Wenjuanxing, 2 also known as Sojump (Mei & Brown, 2018).…”

“…Nevertheless, the abundant literature has provided a number of methods to assess cybersecurity awareness (Rahim et al, 2015). Among all, the knowledge-attitudebehaviour (KAB) model has been used to explain cybersecurity awareness and behaviours (Parsons et al, 2014;Zwilling et al, 2020), and the HAIS-Q is a relatively new and comprehensive scale to investigate internet security knowledge, attitude and behaviours, which has been confirmed to have high internal consistency and external reliability (McCormac et al, 2017;Parsons et al, 2014). However, like many other emerging models, KAB is subject to further improvements, as Parsons et al (2014) rightly acknowledged.…”

Deep Learning Affective Computing to Elicit Sentiment Towards Information Security Policies

“…It is a significant problem in situations where opinions are solicited, and numerous studies exist on various aspects of applications and ways to address any adverse effects [34]- [36]. Social desirability is also applicable in information security, such as information security behaviour [19] and information security awareness evaluations [37]. The work by [38] is of particular interest as this research study has proved that response bias exists in current scale measurements used in compliance research.…”

Biosafety: From a traditional approach to an integrated approach

“…The perception of risk is personal. In fact, people decide to face or avoid the risk situation in a subjective way ( 14 ). Each activity is based on the perception of risk and its more or less conscious evaluation.…”