The application of behavioural thresholds to analyse collective behaviour in information security. (12th June 2017)

• Record Type: Journal Article
• Authors: Snyman, Dirk; Kruger, Hennie
• Is Part Of: Information and computer security. Volume 25:Number 2(2017)
• Page Start: 152
• Page End: 164
• Publication Date: 2017-06-12
• Subjects: Information security -- Human behaviour -- Behavioural threshold analysis -- Information security awareness programmes -- Security culture; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-03-2017-0015
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: The purpose of this study is to perform an exploratory investigation into the feasibility of behavioural threshold analysis as a possible aid in security awareness campaigns. Design/methodology/approach: Generic behavioural threshold analysis is presented and then applied in the domain of information security by collecting data on the behavioural thresholds of individuals in a group setting and how the individuals influence each other when it comes to security behaviour. Findings: Initial experimental results show that behavioural threshold analysis is feasible in the context of information security and may provide useful guidelines on how to construct information security awareness programmes. Practical implications: Threshold analysis may contribute in a number of ways to information security, e.g. identification of security issues that are susceptible to peer pressure and easily influenced by peer behaviour; serve as a countermeasure against security fatigue; contribute to the economics of information security awareness programmes; track progress of security awareness campaigns; and provide a new measure for determining the importance of security awareness issues. Originality/value: This paper describes the very first experiment to test the behavioural threshold analysis concepts in the context of information security.