The Human Aspects of Information Security Questionnaire (HAIS-Q): Two further validation studies. Issue 66 (May 2017)

• Record Type: Journal Article
• Authors: Parsons, Kathryn; Calic, Dragana; Pattinson, Malcolm; Butavicius, Marcus; McCormac, Agata; Zwaans, Tara
• Is Part Of: Computers & security. Issue 66(2017)
• Page Start: 40
• Page End: 51
• Publication Date: 2017-05
• Subjects: Information security (InfoSec) -- Security behaviours -- Questionnaire design -- Cyber security -- Information security awareness (ISA); Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2017.01.004
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Information security awareness (ISA) is integral to protecting an organisation from cyber threats. The aim of this paper is to further establish the validity of the Human Aspects of Information Security Questionnaire (HAIS-Q), as an effective instrument for measuring ISA. We present two studies to further establish the construct validity of this instrument. In Study 1, 112 university students completed the HAIS-Q and also took part in an empirical lab-based phishing experiment. Results indicated that participants who scored more highly on the HAIS-Q had better performance in the phishing experiment. This means the HAIS-Q can predict an aspect of information security behaviour, and provides evidence for its convergent validity. In Study 2, the HAIS-Q was administered to a larger and more representative population of 505 working Australians to further establish the construct validity of the instrument. The results of a factor analysis and other statistical techniques provide evidence for the validity of the HAIS-Q as a robust measure of ISA. We also describe the practical implications of the HAIS-Q, particularly how it could be used by information security practitioners.