(PDF) Human Behaviour as an aspect of Cyber Security

Running head: MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED
TO INFORMATION SECURITY
Minimizing the affect of human behaviour risks related to information security
Name of the Student:
Name of the University:

1
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
Abstract
Into the information security practices, there are various numerous security breaches which are
caused due to human errors. One of the main contributions into this particular research study is
to make changes into holistic management of the information security for establishment of the
information security cultures. There are lack of research is done on role as well as impact of the
organizational cultural dimensions on the information security. The human factors are
uncontrollable forces which interact with the technological elements to secure of the information
system. The human errors occur due to inadequate skills, lack of information security awareness,
intentional as well as unintentional errors to pose the risks towards the information security.

2
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
Table of Contents
Chapter 1: Developing the research agenda/Introduction...............................................................8
1.1 Introduction............................................................................................................................8
1.2 Research Background..........................................................................................................10
1.2.1 Human factors for information security.......................................................................11
1.3 Research problem statement................................................................................................13
1.4 Research questions...............................................................................................................14
1.5 Research aim and objectives................................................................................................14
1.6 Research scope.....................................................................................................................15
1.7 Research hypothesis.............................................................................................................16
1.8 Importance of the research...................................................................................................17
1.9 Research plan.......................................................................................................................18
1.10 Thesis structure..................................................................................................................18
1.11 Research novelty and contribution....................................................................................20
1.12 Summary............................................................................................................................22
Chapter 2: Development of theoretical background/ Literature review on human behaviour risks
related to information security.......................................................................................................23
2.1 Introduction..........................................................................................................................23
2.2 What is Information Security...............................................................................................23

3
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
2.3 Background to Information Security...................................................................................24
2.4 Information Security Principles...........................................................................................25
2.5 Relevant Theories and Methods..........................................................................................26
2.6 Threats to Information Security: Human Behavior a constant risk.....................................33
2.6.1 Threats with information security.................................................................................33
2.6.2 Human Behavior as aspect of information security......................................................35
2.7 Information Security Standards and Guidelines..................................................................36
2.7.1 COBIT..........................................................................................................................36
2.8 Human factors have implications to end user’s behavior....................................................38
2.9 Human behaviour risks related to information security......................................................42
2.10 Organization Information Security Culture.......................................................................43
2.10.1 Organizational culture................................................................................................43
2.10.2 Information security culture.......................................................................................44
2.10.3 Cultural Change..........................................................................................................45
2.10.4 Cultural Impact on Human Behavior..........................................................................45
2.11 Information Security Policy...............................................................................................46
2.11.1 What is an Information Security Policy......................................................................46
2.11.2 The Needs for Information Security Policy................................................................47
2.11.3 Compliance with information security policy............................................................48
2.12 Human Computer Interaction (HCI) and Behaviors Change............................................49

4
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
2.13 Insider Threats Behavior....................................................................................................51
2.14 Modeling human behavior to anticipate of insider attacks................................................52
2.15 Intrinsic and Extrinsic Motivators in Information Security Behavior...............................54
2.16 Insider Misuse and Incident Responses.............................................................................57
Chapter 3: Research Conceptual Framework................................................................................59
3.1 Introduction..........................................................................................................................59
3.2 Conceptual framework of the research study......................................................................59
3.3 Internal threat into Small and medium size enterprise........................................................61
3.4 Human’s behavior and information security system...........................................................63
3.5 Information security countermeasures.................................................................................64
3.6 Human security culture........................................................................................................66
3.7 Human behavior theory.......................................................................................................69
3.8 Summary..............................................................................................................................70
Chapter 4: Research Methodology................................................................................................72
4.1 Introduction..........................................................................................................................72
4.2 Research philosophy............................................................................................................72
4.3 Research approach...............................................................................................................74
4.4 Research design...................................................................................................................75
4.5 Data collection process........................................................................................................76
4.5.1 Data sources..................................................................................................................76

5
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
4.5.2 Data techniques.............................................................................................................77
4.6 Sampling method.................................................................................................................78
4.7 Ethical considerations..........................................................................................................79
4.8 Limitations of the research study.........................................................................................79
4.9 Time horizons......................................................................................................................81
4.10 Summary............................................................................................................................82
References......................................................................................................................................84

6
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
Table of Figures
Figure 1.1: Research plan process.................................................................................................18
Figure 2.1: Theory of reasoned action...........................................................................................29
Figure 2.2: Theory of planned behavior........................................................................................30
Figure 2.3: Protection motivation theory.......................................................................................31
Figure 2.4: General Deterrence Theory.........................................................................................32
Figure 2.5: Technology acceptance theory....................................................................................33
Figure 3.1: Conceptual framework of research study....................................................................60
Figure 3.2: Relations among threat countermeasures and human behavior..................................62

7
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
Table of Tables
Table 2.1: Intrinsic and Extrinsic Motivators in Information Security Behavior..........................56
Table 3.1: Human security culture.................................................................................................68