The Effects of Awareness Programs on Information Security in Banks: The Roles of Protection Motivation and Monitoring

Abstract

Abstract. Our aim is to understand how information security awareness (ISA) programs affect the intention of employees for compliant information security behavior. We draw on Protection Motivation Theory (PMT) to uncover indirect influences of ISA programs, and seek to identify the extent to which intention translates into actual compliance is contingent on monitoring. Based on partial least squares structural equation modeling analysis of 183 survey responses consisting of German bank employees, we find strong empirical evidence for the importance of ISA programs, protection motivation and monitoring. While ISA programs effectively change how employees cope with and assess security threats, only coping appraisal is an important condition for the positive behavioral effects of such programs to occur. However, ISA programs may cause a false sense of security, as vulnerability perceptions are reduced by consuming ISA programs but not affecting intentions for compliant security behavior. Perceived monitoring strengthens this confirmed intention-behavior link.

Reliable Behavioural Factors in the Information Security Context

“…While one study [41] failed to meet the threshold for a weak effect, a funnel plot also indicated that it represented an outlier in the available data. Of the other studies, one reported a medium effect [5] and five reported a weak effect [6,13,27,28]. Overall, our investigation therefore indicates a weak positive reliable effect for response efficacy on BI.…”

“…Self-efficacy. Three studies [5,13] investigating the effect of selfefficacy on BI could be found in the literature review. All three show small effects (0.190 ≤ β ≤ 0.296), drawing a relatively clear picture.…”

“…Five relevant studies from the literature research investigate the effect of the perceived severity of threats on BI. Four of those [5,6,13] report a weak positive effect (0.120 ≤ β ≤ 0.276). In contrast, only one [27] indicates a weak negative effect (β = −0.200).…”

Information Security Awareness in Public Administrations

“…In a general way, ISA programs and ISATs may generate a false sense of security, as taking part in ISA programs reduces perceptions of vulnerability, while the intentions for compliant security behavior are not affected [77]. Information and IT security awareness-raising measures and the evaluation of these measures are an indispensable part of today's information and knowledge society [65].…”

Scientific Knowledge of the Human Side of Information Security as a Basis for Sustainable Trainings in Organizational Practices

“…In the German banking sector, Bauer and Bernroider find strong empirical evidence showing the importance of ISA programs, protection motivation, and monitoring [4], while the findings of Fagade and Tryfonas suggest that security by compliance as a campaign to secure information assets in Nigerian financial institutions is a far-fetched approach [24]. This might relate to sociocultural influences on ISA.…”