Theorising on risk homeostasis in the context of information security behaviour

Abstract

Purpose The purpose of this paper is to discuss and theorise on the appropriateness and potential impact of risk homeostasis in the context of information security. Design/methodology/approach The discussion is mainly based on a literature survey backed up by illustrative empirical examples. Findings Risk homeostasis in the context of information security is an under-explored topic. The principles, assumptions and methodology of a risk homeostasis framework offer new insights and knowledge to explain and predict contradictory human behaviour in information security. Practical implications The paper shows that explanations for contradictory human behaviour (e.g. the privacy paradox) would gain from considering risk homeostasis as an information security risk management model. The ideas discussed open up the prospect to theorise on risk homeostasis as a framework in information security and should form a basis for further research and practical implementations. On a more practical level, it offers decision makers useful information and new insights that could be advantageous in a strategic security planning process. Originality/value This is the first systematic comprehensive review of risk homeostasis in the context of information security behaviour and readers of the paper will find new theories, guidelines and insights on risk homeostasis.

Establishing information security policy compliance culture in organizations

“…Involvement theory was introduced by Astin (1999) to understudy factors in the college environment that affected students’ persistence in college and has been widely adopted by previous researchers in psychological and management research. Previous researchers have examined the role of involvement features related to ISP compliance including security knowledge sharing, collaboration, intervention and experience (Safa et al , 2016; Kearney and Kruger, 2016). Astin (1999) described quantitative and qualitative features of Involvement theory.…”

Risk homeostasis and security fatigue: a case study of data specialists

“…RHT has also been adapted in several security-related studies. Kearney and Kruger (2016) claimed that RHT can be leveraged to extend knowledge and insights into contradictory human behaviour.…”

The application of behavioural thresholds to analyse collective behaviour in information security

“…Many theories and models have been developed to study behaviour in various situations. Kearney and Kruger (2016) summarise the most prevalent theories as the following: the theory of reasoned action (TRA); the theory of planned behaviour (TPB); the general deterrence theory; and the protection motivation theory. Of the aforementioned, TPB (which is an extension of TRA) draws on the attitude of an individual to predict the intention that the individual has to perform a specific behaviour (Ifinedo, 2012;Bulgurcu et al, 2010).…”

“…Frangopoulos et al (2014) mention some common issues pertaining to bias when respondents answer questionnaires -which is a common data collection tool and also used in this studythat could have a negative impact on the subject being measured. Social desirability is a bias that is driven by respondents having a pre-conceived notion of the "correct" or "expected" answer (Kearney and Kruger, 2016;Fisher, 1993). The answers given are not a reflection of the truth or status quo, but rather a version of events that reflects actions that are deemed socially acceptable.…”