End user nonmalicious, counterproductive computer security behaviors: concept, development, and validation of an instrument

Abstract

Employees' engagement in nonmalicious, counterproductive computer security behaviors (CCSB) poses a threat to organizations' information systems (IS) resources and assets. In order to understand CCSB, there is a need to propose theoretical foundations to research the phenomenon and to offer useful tools to help organizations assess such behaviors in their particular contexts. Relevant instruments that systematically measure or assess workers' participation in CCSB remain underdeveloped. This study proposes an instrument to assess engagement in CCSB. Confirmatory factor analysis confirmed three subscales of CCSB, that is, "careless use of IS resources," "procrastinating carrying out required IS actions," and "improper use of IS resources." The instrument's relevance to research and practice is discussed and directions for future research are outlined. KEYWORDScounterproductive security behavior, employee, end user, information security, non-malicious IS behavior, scale development, validation 1 Security Privacy. 2019;2:e66.wileyonlinelibrary.com/journal/spy2

Effects of Personal Factors and Organizational Reinforcing Tools in Decreasing Employee Engagement in Unhygienic Cyber Practices

“…Similarly, SETA programs' availability and their impact on reducing workers' involvement in UCP might be contextual. Thus, where an individual is located might have a bearing on his or her ability to deal with UCP and related IS security issues (e.g., Bellman et al, 2004;Ifinedo, 2019;KNOWBE4, 2019;The African Report, 2021;Ameen et al, 2021).…”

“…Recent research has focused attention on cyber-related end-user IS security behaviors by developing taxonomies for categorizing such behaviors (Egelman & Peer, 2015;Lee et al, 2008;Posey et al, 2013;Ifinedo, 2019;Vishwanath et al, 2020). For example, Posey et al (2013) proposed a scheme classifying IS protection-motivated behaviors, and Egelman and Peer (2015) developed a security behavior intentions scale.…”

“…For example, Posey et al (2013) proposed a scheme classifying IS protection-motivated behaviors, and Egelman and Peer (2015) developed a security behavior intentions scale. Ifinedo (2019) developed a non-malicious IS security deviant behavior taxonomy, and Vishwanath et al (2020) presented a cyber hygiene inventory. It is noteworthy that these frameworks have items covering unsafe online computing and unhygienic cyber practices.…”

“…The diffusion of the Internet has boosted cyber-based operations for private and public organizations across the world. Internet-adopting organizations entrust workers to use the tool to perform workrelated tasks; however, employees often deviate from organizational rules on prescribed cybersecurity practices and measures (Farshadkhah et al, 2021;Ogbanufe, 2021;Hamidi & Moradi, 2017;The ePolicy Institute, 2017;Ifinedo, 2019;Wang et al, 2020). Organizations that use the Internet for operations, including storing customer data, employee information, and financial records, as well as transmitting data and information to clients and partners, must accept that they share in its increased vulnerability because security incidents and breaches do occur (Anderson & Agarwal, 2010;CyberEdge Group Report, 2020).…”