Analyzing the role of cognitive and cultural biases in the internalization of information security policies: Recommendations for information security awareness programs

Tsohou, Aggeliki; Karyda, Maria; Kokolakis, Spyros

doi:10.1016/j.cose.2015.04.006

Cited by 112 publications

(69 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Moreover, some people may in fact doubt their self-efficacy in that they are unequipped to handle security related issues. Tsohou et al (2015) claim that these factors come as a result of "cognitive and cultural biases" that people may have, based on their personal beliefs and experiences.…”

Section: Introductionmentioning

confidence: 99%

“…This affects both how people regard security in general, as well as how they will respond to security training (Beris et al, 2015). Tsohou et al (2015) provide an aggregated list of factors that have been mentioned in extant literature to affect security policy compliance. Seemingly, there are several factors to consider other than just awareness.…”

Section: Introductionmentioning

confidence: 99%

“…Behaviour change is a precarious subject and is actually more a case of psychology than of security itself (Tsohou et al, 2015;Bada et al, 2015). The first thing to acknowledge is that people are different and somewhat unpredictable.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Gamification of Information Security Awareness and Training

Gjertsen

Gjære

Bartnes

et al. 2017

Proceedings of the 3rd International Conference on Information Systems Security and Privacy

View full text Add to dashboard Cite

Abstract:Security Awareness and Training (SAT) programs are commonly put in place to reduce risk related to insecure behaviour among employees. There are however studies questioning how effective SAT programs are in terms of improving end-user behaviours. In this context, we have explored the potential of applying the concept of gamification -i.e. using game mechanics -to increase motivation and learning outcomes. An interactive SAT prototype application was developed, based on interviews with security experts and a workshop with regular employees at two companies. The prototype was tested by employees in a second workshop. Our results indicate that gamification has potential for use in SAT programs, in terms of potential strengths in areas where current SAT efforts are believed to fail. There are however significant pitfalls one must avoid when designing such applications, and more research is needed on long-term effects of a gamified SAT application.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Gamification of Information Security Awareness and Training

Gjertsen

Gjære

Bartnes

et al. 2017

Proceedings of the 3rd International Conference on Information Systems Security and Privacy

View full text Add to dashboard Cite

show abstract

“…Alternatively, organizations can implement role-based access control policies that describe viable user accounts in terms of interdependences and relationships with other data sources [13]. However, some research results show that security policy that is based on monitoring alone is far from ideal in fostering users to comply with security procedures [6].…”

Section: Introductionmentioning

confidence: 99%

“…Moreover, the lower-levels employees should be involved in the formulation of the information security policies as stakeholders in this process [5]. HR and IT must collaborate on the internal policy guidelines that define authorization and responsibility issues [13]. Information security knowledge sharing, positive collaboration and adoption of training methods within the organization are pivotal to the success of the process and strongly affect the attitudes and awareness of employees towards organizational security policies and procedures.…”

Section: Introductionmentioning

confidence: 99%