Improving Compliance with Password Guidelines: How User Perceptions of Passwords and Security Threats Affect Compliance with Guidelines

Abstract

Passwords have long been the preferred method of user authentication, yet poor password practices cause security issues. The study described in this paper investigates how user perceptions of passwords and security threats affect intended compliance with guidelines and explores how these perceptions might be altered in order to improve compliance. It tests a research model based on protection motivation theory [24]. Two groups of internet users were surveyed, one of which received password security information and an exercise to reinforce it. This study suggests effective ways that trainers or employers can improve compliance with password guidelines. In particular, training programs should aim to enhance IS security coping appraisal. The research model proposed in this study has also been shown to be a useful model for explaining IS security behavioral intentions.

Analysis of health professional security behaviors in a real clinical setting: An empirical study

“…Literature [91,92] shows that problems may occur when attempting to implement HIPAA, and no consensus has been reached as to the implementation and compliance requirements of HIPAA's security and privacy rules [93]. However the HIPAA documents selected have been previously used in surveys [94], exploratory studies [95] and to define security risk-oriented patterns [96]. Moreover, generic security and privacy principles (password strength, secure use of e-mails, the Internet and the Intranet, PHI protection of printers and screens, etc.)…”

Refining Technology Threat Avoidance Theory

“…However, they did not test the proposed model. Mwagwabi, McGill, and Dixon (2014) examined a partial TTAT model and reported significant relationships between susceptibility and threat and between severity and threat but did not test the interaction between susceptibility and severity. Couraud (2014) invoked a partial model in extending TTAT using risk sensitivity.…”

“Security begins at home”: Determinants of home computer and mobile device security behavior

“…Ifinedo, 2012;Siponen, Mahmood, & Pahnila, 2014). However, this over-representation of organization-focused research is giving way to more recent studies of home computer users (Anderson & Agarwal, 2010;Liang & Xue, 2010;Mwagwabi, McGill, & Dixon, 2014;Woon, Tan, & Low, 2005;Zhang & McDowell, 2009) in recognition of the vulnerability of home users and the potential flow on effects from home user breaches to organizational breaches (Jenkins, Grimes, Proudfoot, & Lowry, 2014;Winkler, 2009). While there may be similarities in "security behavior" that span both the organizational and home environments, Li and Siponen (2011) identified nine contextual factors that differentiate the home setting from organizational use, including the role of technical support, training, sanctions and organizational policies among others, calling for focused research with home users.…”

“…Protection Motivation Theory (PMT) (Rogers, 1975(Rogers, , 1983 has been widely used to try to explain user security behavior with some success (e.g., Crossler, Long, Loraas, & Trinkle, 2014;Herath & Rao, 2009;Ifinedo, 2012;Vance, Siponen, & Pahnila, 2012); however, the majority of this research has taken place in an organizational context and research using it to understand personal computing security behavior has shown more mixed results, particularly with respect to the role of perceived vulnerability to threats (Liang and Xue 2010;Mwagwabi, McGill, and Dixon 2014;Zhang and McDowell 2009). The study described in this paper addresses the need to improve understanding of home computer and mobile device computing security behavior by testing a model of personal computing security behavior that is based on PMT, but is extended to incorporate findings from the personal computing domain on the roles of psychological ownership and social influence (Anderson & Agarwal, 2010;Tu, Turel, Yuan, & Archer, 2015).…”