Human factors in cybersecurity; examining the link between Internet addiction, impulsivity, attitudes towards cybersecurity, and risky cybersecurity behaviours

Abstract

The present study explored the relationship between risky cybersecurity behaviours, attitudes towards cybersecurity in a business environment, Internet addiction, and impulsivity. 538 participants in part-time or full-time employment in the UK completed an online questionnaire, with responses from 515 being used in the data analysis. The survey included an attitude towards cybercrime and cybersecurity in business scale, a measure of impulsivity, Internet addiction and a ‘risky’ cybersecurity behaviours scale. The results demonstrated that Internet addiction was a significant predictor for risky cybersecurity behaviours. A positive attitude towards cybersecurity in business was negatively related to risky cybersecurity behaviours. Finally, the measure of impulsivity revealed that both attentional and motor impulsivity were both significant positive predictors of risky cybersecurity behaviours, with non-planning being a significant negative predictor. The results present a further step in understanding the individual differences that may govern good cybersecurity practices, highlighting the need to focus directly on more effective training and awareness mechanisms.

Forming the Awareness of Employees in the Field of Information Security

“…Each security breach incident in an organisation is more or less dependent not only on technology but primarily on the end users (Hadlington, 2017). In order to mitigate the risk of information security, the organisations are required to implement an appropriate awareness program for all employees.…”

“…According to Kruger and Kearney, information security is perceived as the degree to which every employee understands the importance and consequences of security policies, internal guidelines for information security organizations (Kruger and Kearney, 2006). The cited definition of information security awareness refers fully to the KAB model that forms the basis of the HAIS-Q research instrument (Parsons et al, 2014;2017). The mentioned method of measuring consciousness relies heavily on techniques borrowed from social psychology, which suggests that the tendency of a person to do something beneficial or unfavorable depends on three components, namely knowledge, attitude and behavior.…”

Botching Human Factors in Cybersecurity in Business Organizations

“…The observation of human performance and behavior by cognitive and human factor experts can provide practical insight on automation and information overload, technological deterministic thinking, procedural alignment, operational tempo, and the impact of technology on the workforce (Nobles, 2015). With the ascendancy of technology in cybersecurity, cognitive scientists and human factor experts are pivotal in conducting performance and human factors assessments to predispose (a) systemic weaknesses, (b) vulnerabilities, (c) critical phases of cybersecurity operations, and (d) cognitive overload (Hadlington, 2017;Pfleeger & Caputo, 2012). Human factors initiatives can be solidified through organizational culture by implementing practices and processes to increase awareness of human performance and decision-making (Hadlington, 2017).…”

“…Businesses rely on information systems and technology to yield profits; yet, most companies struggle with integrating human factors into the organizational culture (Hadlington, 2017). Not only are human factors a concern for protecting crown jewels, critical information, intellectual property, and networks.…”

“…Change is a strategic objective for organizations to withstand continuous evolution; however, resistance to change is a significant phenomenon (Georgalis, Samaratunge, Kimberley, & Lu, 2015) that can be disruptive and counterproductive. For human factors to be recognized as a credible science requires cybersecurity leaders must undergo a cultural and philosophical change (Hadlington, 2017). A part of the fundamental change involves accepting psychology as a vital element of cybersecurity (Hadlington, 2017).…”