Future directions for behavioral information security research

Decision Making and Biases in Cybersecurity Capability Development: Evidence from a Simulation Game Experiment

“…Beyond the financial impact [4], a cyber-attack may, for example, cause irreparable damage to a firm in the form of corporate liability [5], a weakened competitive position, and loss of credibility [6].…”

Effects of Color Appeal, Perceived Risk and Culture on Users Decision in Presence of Warning Banner Message

“…42,43]. However, BI may not always lead to actual behaviors [44]. Indeed, several studies suggest that, in an information security context, it is better and more realistic to measure actual behaviors rather than intentions [44][45][46].…”

The Mobile Privacy-Security Knowledge Gap Model: Understanding Behaviors

“…Indeed, users often feel overwhelmed with how to control others' access to their personal information [19]. This is crucial because citizens' understanding of information security and privacy threats, and knowledge of the tools they can use to protect themselves, are necessary to provide a more secure society, particularly since individuals are the weakest link in security [12] and the last line of defense in information privacy [20].…”

“…Disclosure of information, even voluntary, is not only an information privacy issue but also an information security issue. Information security refers to individuals protecting themselves against threats to their information assets [12], while information privacy is viewed as an individual's ability to control information about themselves [e.g., 13,14,15]. Today's smartphones are typically set up with complex information security and privacy settings, with many default settings often set to give away most information.…”

“…In the mobile environment, protecting an individual's information security and/or privacy requires an actual behavior to be enacted. Prior research has suggested that intending to protect one's information privacy or security is not sufficient; one needs to actually use information protection practices to be protected [12] [76].…”