Cybersecurity Behaviour: A Conceptual Taxonomy

Abstract

User cybersecurity behaviour is a concern for organisations as well as home users. This is because cyber-criminals have made a shift from targeting security systems to targeting the users of the systems. As a result, an increasing number of studies have been conducted in efforts to understand user cybersecurity behaviour. The advantage in understanding user behaviour is that researchers and security practitioners can apply this knowledge and begin to change behaviour to benefit cybersecurity. Different studies have categorised similar cybersecurity behaviours, however the naming conventions differ across studies. This brings out the first contribution of the paper, unified terminology for the cybersecurity behaviour. Secondly, most studies were conducted in an organisational setting. User behaviour in other environments is yet to be identified and categorised. The second contribution of this study is the identification and categorisation of home user cybersecurity behaviour. The identification and classification of more cybersecurity behaviour is aimed to have a positive impact in the creation of strategic interventions to change and maintain good cybersecurity behaviour.

Towards a Taxonomy of Information Security Policy Non-Compliance Behavior

“…Based on our classification scheme, it is possible to derive measures for specific types of behavior, such as targeted awareness programs, based on behaviors where employees were not aware of their offenses or specific measures against the different types of expected added values. Further possibilities would be, e.g., the use of behavior with organizational moral or beneficial intention to achieve a positive effect on information security, e.g., promoting an information security culture [32].…”

A Taxonomy of SETA Methods and Linkage to Delivery Preferences

“…One such example would be that behavior is likely to be different between a user's work-related and private use. That since the user is likely to be constrained by policies and technical security controls at work, but not equally so at home (Mashiane & Kritzinger, 2018). Individual factors such as gender, stress level, the user's security awareness and knowledge, and predisposition to being suspicious are also important factors influencing the users' response to different situations (Chowdhury, Adam, & Skinner, 2019;Donalds & Osei-Bryson, 2020;Harrison, Vishwanath, & Rao, 2016).…”