Purpose – This paper aims to provide an overview of theories used in the field of employees’ information systems (IS) security behavior over the past decade. Research gaps and implications for future research are worked out by analyzing and synthesizing existing literature. Design/methodology/approach – This paper presents the results of a literature review comprising 113 publications. The literature review was designed to identify applied theories and to understand the cognitive determinants in the research field. A meta-model that explains employees’ IS security behavior is introduced by assembling the core constructs of the used theories. Findings – The paper identified 54 used theories, but four behavioral theories were primarily used: Theory of Planned Behavior (TPB), General Deterrence Theory (GDT), Protection Motivation Theory (PMT) and Technology Acceptance Model (TAM). By synthesizing results of empirically tested research models, a survey of factors proven to have a significant influence on empl...

/pdf/information-security-awareness-and-behavior-a-theory-based-4m948bwed1.pdf

Information security awareness and behavior: a theory-based literature review

Understanding the impact of personality traits on mobile app adoption - Insights from a large-scale field study

A major stream of research within the field of information systems security examines the use of organizational policies that specify how users of information and technology resources should behave ...

Organizational information security policies: a review and research framework

Threat modeling – A systematic literature review

We present a model of employee compliance with information security policy (ISP) that (1) explicates stable, cognitive beliefs regarding the consequences of compliance and noncompliance as well as state-based affective constructs, namely, positive and negative mood states and episodic, security-related work-impediment events, and (2) provides an expanded conceptualisation of moral considerations and normative influences regarding employees' ISP compliance. Because affect is central to this theorisation, we ensure that the model captures and explains differences in day-to-day affective constructs to account for the often fleeting nature of affective states. We test our multilevel model using an experience-sampling methodology design, in which employees completed daily surveys over a 2-week period, followed by a hierarchal linear modelling statistical assessment. Our contribution to theory is a unique account of ISP compliance that integrates affective factors with constructs from rational choice theory and theory of planned behaviour and that diverges from prior conceptualisations of ISP compliance as a purely stable and reason-based phenomenon. For practitioners, our results suggest that a combination of cognitive and affective influences may produce discrete episodes of ISP compliance that do not coincide with prior behavioural trends.

Cognitive-affective drivers of employees' daily compliance with information security policies: A multilevel, longitudinal study

Today's organizations are highly dependent on information management and processes. Information security is one of the top issues for researchers and practitioners. In literature, there is consent that employees are the weakest link in IS security. A variety of researchers discuss explanations for employees' security related awareness and behavior. This paper presents a theory-based literature review of the extant approaches used within employees' information security awareness and behavior research over the past decade. In total, 113 publications were identified and analyzed. The information security research community covers 54 different theories. Focusing on the four main behavioral theories, a state-of-the-art overview of employees' security awareness and behavior research over the past decade is given. From there, gaps in existing research are uncovered and implications and recommendations for future research are discussed. The literature review might also be useful for practitioners that need information about behavioral factors that are critical to the success of a organization's security awareness.

/pdf/employees-information-security-awareness-and-behavior-a-zc76a6te9i.pdf

Employees' Information Security Awareness and Behavior: A Literature Review

In the last years, increasing smartphones’
capabilities have caused a paradigm shift in the way of users’ view and using mobile
devices. Although researchers have started to focus on behavioral models to
explain and predict human behavior, there is limited empirical research about
the influence of smartphone users’ individual differences on the usage of
security measures. The aim of this study is to examine the influence of
individual differences on cognitive determinants of behavioral intention to use
security measures. Individual differences are measured by the Five-Factor
Model; cognitive determinants of behavioral intention are adapted from the
validated behavioral models theory of planned behavior and technology
acceptance model. An explorative, quantitative survey of 435 smartphone users is served as data basis. The results suggest
that multiple facets of smartphone user’s personalities significantly affect
the cognitive determinants, which indicate the behavioral intention to use
security measures. From these findings, practical and theoretical implications
for companies, organizations, and researchers are derived and discussed.

/pdf/personality-traits-and-cognitive-determinants-an-empirical-2y4gs4irxr.pdf

Personality Traits and Cognitive Determinants – An Empirical Investigation of the Use of Smartphone Security Measures

Integrated information systems continuously develop into a strategic instrument for higher education institutions. In contrast to private companies, specific characteristics of higher education institutions in regards to their organizational structure as well as their management and operations require a tailored project management approach. There is need for thorough research and practical recommendations for implementation of integrated information systems in higher education institutions. This paper provides a systematic meta-analysis and a state of the art overview of critical success factors for selection and implementation of integrated information systems based on the characteristic of the higher education sector. A qualitative content analysis is applied to receive a comprehensive list of critical success factors for higher education institutions. The mostly named critical success factors are stakeholder participation, business process reengineering and communication which align well with the peculiarities of the higher education sector.

https://aisel.aisnet.org/cgi/viewcontent.cgi?article=1052&context=amcis2011_submissions

Jörg Uffen

Papers

Information security awareness and behavior: a theory-based literature review

Employees' Information Security Awareness and Behavior: A Literature Review

Personality Traits and Cognitive Determinants – An Empirical Investigation of the Use of Smartphone Security Measures

Critical success factors for adoption of integrated information systems in higher education institutions – a meta-analysis

Personality Traits and Information Security Management: An Empirical Study of Information Security Executives