Speak their Language: Designing Effective Messages to Improve Employees’ Information Security Decision Making

Abstract

Employee disinterest in information security remains one of the greatest impediments to effective information security management programs. How can organizations enhance the persuasiveness of the information security messages used to warn employees of threats and encourage employees to take specific actions to improve their security? We use fear appeal theory and the elaboration likelihood model to argue that security messages presented using more personally relevant language are more likely to induce employees to engage in the recommended protective security behaviors. Our strategy uses organization identification theory to segment employees into two groups and then develops security messages that use language aligned with each of the two segments. We tested this strategy within a large U.S. organization, and found that employees were more likely to consider and act upon messages that used language aligned with their organizational identification than messages using language not aligned. The effect size was large. Our results show that subtly changing less than a dozen words in the way a security message was presented without changing its substantive content (e.g., using “our” instead of “your”) has both significant and meaningful effects on how employees think about and respond to it.

Enhancing users’ security engagement through cultivating commitment: the role of psychological needs fulfilment

“…Employee behaviour is fundamental to corporate InfoSec capabilities across the phases of prevention, detection, and response (Baskerville et al, 2014). Unfortunately, despite more than a decade of research on the human side of organisational InfoSec, people are often still identified as the weakest link, rooted in disinterest in security threats and the behaviours that mitigate them (Johnston et al, 2019). Motivated by this disconnect, the current study extends the Overall, the findings shed new light on the motivational mechanisms underpinning end user engagement in organisational InfoSec.…”

“…As evidenced above, substantial progress has been made in identifying various drivers of different security behaviours that ultimately contribute to the organisation's InfoSec posture. Despite this, problems in the human side of organisational InfoSec continue to burden companies, often rooted in employee disinterest in security threats and the behaviours that mitigate them (Johnston et al, 2019). A review of the extant literature (Appendix A) reveals two traditions within this stream that may help explain the disconnect between scholarly productivity and performance in practice.…”

Protection Motivation Theory in Information Systems Security Research

“…The potential negative outcomes associated with IS security threats may therefore be more difficult to grasp and anticipate. Prior studies especially conducted in work environments found that often users do not appraise IS security threats as causing them real levels of concern (Johnston et al, 2019).…”

“…and Johnston et al (2016) highlight the importance of personal relevance of the IS security threat. We would add that personalizing the content of threat messages and how it is expressed to targeted audiences is likewise important to enhance threat message effectiveness (Johnston et al, 2019;Tannenbaum et al, 2015;Webb et al, 2010). We propose six new manipulations to personalize IS security threat messages.…”

Understanding the Role of Incentives in Security Behavior

“…Employees are widely recognized as the weakest link in an organization's cybersecurity practice. Yet current programs designed to improve employee security behaviors often fail because interventions are not viewed as personally relevant (Johnston et al, 2019a(Johnston et al, , 2019b. Our study addresses a significant gap in scientific investigations of user cybersecurity hygiene by providing direct financial incentives to motivate users to comply with organizational cybersecurity policies and procedures.…”