As bring your own device (BYOD) becomes part of workplace tools for employees in Zimbabwe, the responsibility to implement information security management methods, which was traditionally confined to the information technology (IT) employees, has extended to all the employees, who now become unintended administrators because of the usage of their devices. The purpose of this paper is to show how banks can mitigate the information security risks caused by the unintended administrator using the BYOD information security behavioural (BISB) model. A literature review of the BYOD information security and organisational information security culture was conducted. A questionnaire was developed from the literature and sent to 270 bank employees in Zimbabwe. A total of 205 employees participated, and 179 completed the questionnaire. An expert review consisting of chief information officers (CIOs) at banks in Zimbabwe was conducted to evaluate the proposed model. From the literature review, individual traits of attitude, knowledge, and habit, as well as organisational traits of the environment, governance, and training, were identified as key traits that constituted the constructs of the BISB model. The overall theme of this paper is that banks can mitigate the BYOD information security challenges by using of the BISB model.
KEYWORDSbring your own device, BYOD information security behavioural model, information security culture, unintended administrator This paper starts by providing an overview of how BYOD has affected the way IS is managed in organisations and indicates how the employees who own such devices have become unintended administrators in the BYOD phenomenon. The security risks that the unintended administrators introduce to the organisation because of BYOD forms the research problem that this paper attempts to address. The identification of individual and organisational traits forming the constructs for the BYOD information security behavioural (BISB) model is then discussed, which leads to the statistical survey that tested these constructs.The next section discusses the background on the emergence of the unintended administrator in the workplace.
| BACKGROUNDBYOD is emerging as the new norm in modern business computing trends. All organisations that are serious about remaining relevant in the digital era are searching for BYOD security solutions (Brodin, 2016a). Digital transformation visionaries such as Wood (2004) and Morrow (2012) share the sentiment that IS in all organisations is now multidisciplinary, multidepartmental, and multiorganisational. This paper explores the multidepartmental nature of IS. Lim and Churchill (2016) further argue that the management of IS in earlier decades was strictly technical and fell under the exclusive management of an organisation's information technologists. Since 2010, a shift occurred away from specialised management of IS by IT administrators to the management of IS by employees in the various departments of the organisation (Keyes, 2013). The management of IS has al...