A longitudinal study on improving employee information protective knowledge and behaviors. Issue 116 (May 2022)

• Record Type: Journal Article
• Authors: Bélanger, France; Maier, Jürgen; Maier, Michaela
• Is Part Of: Computers & security. Issue 116(2022)
• Publication Date: 2022-05
• Subjects: Knowledge -- Information protective behavior -- Motivation -- Longitudinal study -- Information security and privacy; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.102641
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: Repeated, mandatory exposure to security and privacy news increases knowledge. Knowledge has greater impact on information protective behavior than motivation. Measuring behavior, not intentions, and actual knowledge is crucial. Firms need holistic employee compliance programs with repeated information exposure. Consider storytelling to make security training more relevant. Abstract: Research shows it is challenging to ensure that individuals use information protective behaviors (e.g., secure passwords, turning off tracking features), especially on smartphones. Concurrently, employees increasingly use their own devices for work (BYOD), but with limited compliance with BYOD policies. This research studies the role of knowledge in increasing employees' use of information protective settings, and explores how exposure to security and privacy news can increase such knowledge. A 10-month field intervention with 826 corporate trainees who received daily newspapers covering privacy and security articles. Our findings show that it is possible to increase employee knowledge of security and privacy, and in turn positively affect their usage of information protective settings over time through repeated, perceived-to-be-mandatory information exposure. The study contributes to a better understanding of the importance of measuring actual knowledge in studies of employee behavioral actions towards protection of organizational information. The results suggest organizations need holistic employee compliance programs, where in addition to developing policies, as well as compliance testing and sanctions, they provide repeated information exposure. Graphical abstract: Image, graphical abstract