The quest for complete security: An empirical analysis of users’ multi-layered protection from security threats

Abstract

Individuals can perform many different behaviors to protect themselves from computer security threats. Research, however, generally explores computer security behaviors in isolation, typically looking at one behavior per study, such as usage of malware or strong passwords. However, defense in depth requires that multiple behaviors be performed concurrently for one's computer to be protected. Addressing this gap in prior research, this study measures 279 individuals' computer security behaviors and analyzes them with multi-dimensional scaling. We examined three security threats: security related performance degradation, identify theft, and data loss. The results present a mapping of security behaviors performed together with other behaviors on two dimensions for each of these threats. Using expert reviews of the resulting dimensions, the study proposes that response efficacy and response cost help explain why people perform certain behaviors together. These findings can help explain inconsistent results in prior information security research because they focused on one behavior only whereas people perform various security behaviors together in an effort to mitigate specific security threats. The study informs research and practice by identifying security threat-response pairs via expert interviews, surveying individuals on how they perform multiple security behaviors concurrently to mitigate security threats, identifying why certain behaviors are performed together, and using these findings to identify reasons why IS security research has confounding results based on specific individual threat-response pairs used in prior studies.

Persuading end users to act cautiously online: a fear appeals study on phishing

“…Both a strength and a weakness of the current study is that it focussed on one type of behaviour, as precautionary online behaviour (against phishing) consists of a range of behaviours (Crossler et al , 2017). The strength is related to the fact that predictors of one type of behaviour might not influence another type of behaviour (Blythe et al , 2015).…”

Information Security Behavior and Information Security Policy Compliance: A Systematic Literature Review for Identifying the Transformation Process from Noncompliance to Compliance

“…This study has shown that psychological capital can play a vital role in developing employees' protective motivated behaviors. Reference [64] briefly outlined that existing information security behavior research addresses one threat and one behavior at a time while users perform multiple security behaviors to mitigate security threats. Their study examined three security threats (data loss, security-related performance degradation, identify theft) on 279 computer users and showed that users perform multiple security behaviors to deal with these threats.…”

“…PMT predicts better ISB if the threat and the coping process are specific, and PMT is a good predictor of ISB for individuals' threats, not the organizational threats [62] Mixed method approach used and PLS used for research model testing 559 insiders participated from the city government of Finland Enhanced fear appeal with PMT has better results on ISPC [54] The longitudinal research design was adopted. PLS is used for data and model testing 253 valid responses were collected Self-efficacy perceived threat severity, and perceived threat susceptibility significantly affect employees' continue protective behaviors [63] The quantitative research design adopted SEM used for model and hypothesis testing 377 usable responses from the public and private organizations Psychological capital has positive effects on employees' protective motivated behaviors [64] Mixed method research with multidimensional scaling analysis Seven expert interviews and 279 computer users participated Users perform multiple security behaviors to deal with security threats.…”

Fear of Online Consumer Identity Theft: Cross-Country Application and Short Scale Development

“…Consumer-friendly online shopping environments and processes need to address privacy considerations, and research needs to determine how consumers incorporate privacy considerations into their online purchasing decisions Tsai et al 2011). Identity theft and data breaches are global phenomena (Targett 2018) that spark widespread reluctance to divulge personal details to e-commerce providers, and the problem is a global one (e.g., Crossler et al 2019). In the United States, the personal and bank account information of almost one in every five Internet users has been stolen (Madden 2014).…”