Information security conscious care behaviour formation in organizations

Abstract

Conscious care behaviourAwareness Risk Organization policy a b s t r a c t Today, the Internet can be considered to be a basic commodity, similar to electricity, without which many businesses simply cannot operate. However, information security for both private and business aspects is important. Experts believe that technology cannot solely guarantee a secure environment for information. Users' behaviour should be considered as an important factor in this domain. The Internet is a huge network with great potential for information security breaches. Hackers use different methods to change confidentiality, integrity, and the availability of information in line with their benefits, while users intentionally or through negligence are a great threat for information security. Sharing their account information, downloading any software from the Internet, writing passwords on sticky paper, and using social security numbers as a username or password are examples of their mistakes. Users' negligence, ignorance, lack of awareness, mischievous, apathy and resistance are usually the reasons for security breaches. Users' poor information security behaviour is the main problem in this domain and the presented model endeavours to reduce the risk of users' behaviour in this realm. The results of structural equation modelling (SEM) showed that Information Security Awareness, Information Security Organization Policy, Information Security Experience and Involvement, Attitude towards information security, Subjective Norms, Threat Appraisal, and Information Security Self-efficacy have a positive effect on users' behaviour. However, Perceived Behavioural Control does not affect their behaviour significantly. The Protection Motivation Theory and Theory of Planned Behaviour were applied as the backbone of the research model. ScienceDirect jo urnal homepage: www .e lsev ie r. co m/ lo cate/ co se c o m p u t e r s & s e c u r i t y 5 3 ( 2 0 1 5 ) 6 5 e7 8

Human errors in the information security realm – and how to fix them

“…Conscious care behaviour is an effective approach to counter creative attacks to reduce the risk of information security breaches (Safa et al, 2015). When a user is faced with a suspicious email that asks him/her to change his/her username or password, user awareness and knowledge about phishing sends the first alarm to his/her mind.…”

“…Suitable information security training is necessary to improve users' awareness. Formal presentations, games, Internet pages, email, meetings, posters, pens and screen savers are key methods to improve individuals' knowledge and awareness (Safa, Sookhak et al, 2015). Hackers use creative, ingenious and novel methods to achieve their targets.…”

Information security collaboration formation in organisations

“…[18,23] utilised the TPB to show how the disposition to comply with OISPs is formed in the organisations. Safa, Sookhak [3] also used the TPB to explain the formation of information security conscious care behaviour in organisations. In another study, Cox [24] used the TPB to investigate the disregard of information security policies by users, even though they know the policies.…”

“…In the modern environment, information security is the most important and controversial subject among experts [1]. Applying different strategies, such as acting based on information security organisational procedures and policies [2], information security conscious care behaviour [3], sharing information security knowledge [4,5] and information security collaboration in organisations [6], have been acknowledged to be useful in decreasing the vulnerability of information security incidents in companies. A novel conceptual model is presented in this study that depicts how collaboration develops and reduces the risk of information security incidents in organisations.…”

The information security landscape in the supply chain

“…In addition, hackers use novel and creative methods to access information assets. Different kinds of phishing, social engineering, and misleading software are examples of methods typically used to achieve their target [2]. Users, intentionally or unintentionally, are a source of risk for information assets.…”