University Dissertation: Human Behavior and InfoSec Risks

This dissertation delves into the critical intersection of human behavior and information security, recognizing that human error is a significant cause of security breaches. The research investigates the impact of organizational culture on information security, exploring various human factors such as inadequate skills, lack of awareness, and both intentional and unintentional errors. The study examines relevant theories and methods, including the theory of reasoned action, planned behavior, and protection motivation theory, to understand and model human behavior in the context of information security. The research also covers information security standards, policies, and the influence of human-computer interaction. A conceptual framework is developed to analyze internal threats, human behavior in information systems, and security countermeasures, with a focus on human security culture and behavior theories. The methodology includes a discussion of research philosophy, approach, design, data collection, sampling, ethical considerations, and limitations, providing a comprehensive analysis of the research process. The aim is to provide insights into minimizing the impact of human behavior risks and improve information security practices.

Running head: MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED
TO INFORMATION SECURITY
Minimizing the affect of human behaviour risks related to information security
Name of the Student:
Name of the University:

1
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
Abstract
Into the information security practices, there are various numerous security breaches which are
caused due to human errors. One of the main contributions into this particular research study is
to make changes into holistic management of the information security for establishment of the
information security cultures. There are lack of research is done on role as well as impact of the
organizational cultural dimensions on the information security. The human factors are
uncontrollable forces which interact with the technological elements to secure of the information
system. The human errors occur due to inadequate skills, lack of information security awareness,
intentional as well as unintentional errors to pose the risks towards the information security.

2
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
Table of Contents
Chapter 1: Developing the research agenda/Introduction...............................................................8
1.1 Introduction............................................................................................................................8
1.2 Research Background..........................................................................................................10
1.2.1 Human factors for information security.......................................................................11
1.3 Research problem statement................................................................................................13
1.4 Research questions...............................................................................................................14
1.5 Research aim and objectives................................................................................................14
1.6 Research scope.....................................................................................................................15
1.7 Research hypothesis.............................................................................................................16
1.8 Importance of the research...................................................................................................17
1.9 Research plan.......................................................................................................................18
1.10 Thesis structure..................................................................................................................18
1.11 Research novelty and contribution....................................................................................20
1.12 Summary............................................................................................................................22
Chapter 2: Development of theoretical background/ Literature review on human behaviour risks
related to information security.......................................................................................................23
2.1 Introduction..........................................................................................................................23
2.2 What is Information Security...............................................................................................23

3
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
2.3 Background to Information Security...................................................................................24
2.4 Information Security Principles...........................................................................................25
2.5 Relevant Theories and Methods..........................................................................................26
2.6 Threats to Information Security: Human Behavior a constant risk.....................................33
2.6.1 Threats with information security.................................................................................33
2.6.2 Human Behavior as aspect of information security......................................................35
2.7 Information Security Standards and Guidelines..................................................................36
2.7.1 COBIT..........................................................................................................................36
2.8 Human factors have implications to end user’s behavior....................................................38
2.9 Human behaviour risks related to information security......................................................42
2.10 Organization Information Security Culture.......................................................................43
2.10.1 Organizational culture................................................................................................43
2.10.2 Information security culture.......................................................................................44
2.10.3 Cultural Change..........................................................................................................45
2.10.4 Cultural Impact on Human Behavior..........................................................................45
2.11 Information Security Policy...............................................................................................46
2.11.1 What is an Information Security Policy......................................................................46
2.11.2 The Needs for Information Security Policy................................................................47
2.11.3 Compliance with information security policy............................................................48
2.12 Human Computer Interaction (HCI) and Behaviors Change............................................49

4
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
2.13 Insider Threats Behavior....................................................................................................51
2.14 Modeling human behavior to anticipate of insider attacks................................................52
2.15 Intrinsic and Extrinsic Motivators in Information Security Behavior...............................54
2.16 Insider Misuse and Incident Responses.............................................................................57
Chapter 3: Research Conceptual Framework................................................................................59
3.1 Introduction..........................................................................................................................59
3.2 Conceptual framework of the research study......................................................................59
3.3 Internal threat into Small and medium size enterprise........................................................61
3.4 Human’s behavior and information security system...........................................................63
3.5 Information security countermeasures.................................................................................64
3.6 Human security culture........................................................................................................66
3.7 Human behavior theory.......................................................................................................69
3.8 Summary..............................................................................................................................70
Chapter 4: Research Methodology................................................................................................72
4.1 Introduction..........................................................................................................................72
4.2 Research philosophy............................................................................................................72
4.3 Research approach...............................................................................................................74
4.4 Research design...................................................................................................................75
4.5 Data collection process........................................................................................................76
4.5.1 Data sources..................................................................................................................76

5
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
4.5.2 Data techniques.............................................................................................................77
4.6 Sampling method.................................................................................................................78
4.7 Ethical considerations..........................................................................................................79
4.8 Limitations of the research study.........................................................................................79
4.9 Time horizons......................................................................................................................81
4.10 Summary............................................................................................................................82
References......................................................................................................................................84

6
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
Table of Figures
Figure 1.1: Research plan process.................................................................................................18
Figure 2.1: Theory of reasoned action...........................................................................................29
Figure 2.2: Theory of planned behavior........................................................................................30
Figure 2.3: Protection motivation theory.......................................................................................31
Figure 2.4: General Deterrence Theory.........................................................................................32
Figure 2.5: Technology acceptance theory....................................................................................33
Figure 3.1: Conceptual framework of research study....................................................................60
Figure 3.2: Relations among threat countermeasures and human behavior..................................62

7
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
Table of Tables
Table 2.1: Intrinsic and Extrinsic Motivators in Information Security Behavior..........................56
Table 3.1: Human security culture.................................................................................................68

8
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
Chapter 1: Developing the research agenda/Introduction
1.1 Introduction
The experts of information security should consider human information security behavior
as well as technology in aspects of the information security for secure environment. According to
Malekian, Hayati and Aarts (2017), the users are delayed complying with password change as
they are considered to change unnecessary interruption. Safa, Von Solms and Furnell (2016)
noted that the employees are failed to perform security behaviors which put in place for
protecting the information assets. Kim, Yang and Park (2014) pointed that the users can
understand severe consequences of breach into password protection but it is not changing
attitudes as well as resistance behavior towards implementation of the information security
policy. Kampas et al. (2016) demonstrated that the awareness of information security provide
significant effects on information security attitude towards the positive behavior. Pearlson,
Saunders and Galletta (2016) highlighted importance of the information security awareness to
influence security changes behaviors among the employees. In this research study, the
participants are viewed people’s management as strategy to minimize the threats of information
security on the business performance.
Managing of the information security is a challenge for the IT organizations those use of
information technology as part of the business. Sheeran and Rivis (2017) illustrated that human
work into mitigating the information security issues fall under four categories such as individual,
customer, team and management. The human factors are uncontrollable forces which interact
with the technological elements to secure of the information system. The human errors occur due
to inadequate skills, lack of information security awareness, intentional as well as unintentional

9
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
errors to pose the risks towards the information security. Venkatesh, Thong and Xu (2016)
suggested that there is required to understand the human factors based on their impacts on
effective implementation of the information security management system. The purpose of this
research studies us to review the human factors into the information security as well as discuss of
how the information security becomes major tool to overcome with the human issues
(Katzenbeisser and Petitcolas 2016). There is an increase into threats of the information
technology which brought new solutions, while the human factors related to this research are
being limited. Information security is human factors issue which remains unaddressed (Abbasi,
Sarker and Chiang 2016). The cultural dimensions become important part of strategy of
organization for promotion of performance as well as productivity.
The researcher selected this research topic to develop various theories related to
information security. The researcher also conducted various studies on role of cultural
dimensions on the society. Saunders and Galletta (2016) argued that the organization is required
to make changes into the information security which establish of effective informational security
culture. Crossler et al. (2014) argued that the information security is required to focus on the
human behaviors to mitigate the risks and issues. It is indicated that information security aware
culture reduces the risks to the information assets which reduce the rate of human misbehavior.
The information is being protected by two of the strategies such as use of technology for
protection of valuable information. Second is based on human elements, where the user can
abuse the information by passing to the third party without consent of the informational owners
(Mishra, Akman and Mishra 2014). The research study is focused on role of human elements
culture on the information security. The key significant reason behind role of the human along

10
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
with human factors is challenge to monitor as well as control. Proper control over the human
errors is required to mitigate the risks into information security management system.
1.2 Research Background
Montano and Kasprzyk (2015) stated that the IT organization is implemented of
information security strategies for reducing risks on the information security breaches. Mishra,
Akman and Mishra (2014) indicated that the user’s behavior is required factors to consider
guarantee into secured environment for the information. Kautonen, Gelderen and Fink (2015)
stated that the organization is utilized of various approaches for protecting information system
assets as well as resources. In this particular study, the participants are implemented of different
information security strategies for minimizing consequences of the information security threats
on business sustainability. According to Chen and Tung (2014), human issue is main difficulty
into risk management of the information security. There are some security problems which are
caused due to human behaviors such as act of human error and failure, compromise to the
intellectual property, blackmail of the disclosure of information, unauthorized access to
information and illegal confiscation of the equipments.
Over the last 25 years, the information security management is growing and it is common
as well as regular into the public domains. Most of the information security issues are occurred
due to human errors. Based on the observations, the researcher focuses on human factors of the
information security assurance. Cheng, Zhai and Smyth (2014) stated that despite interest as well
as acceptance into the information security management, the information security appears to be a
gap as well as weakness into the industry. Venkatesh, Thong and Xu (2016) discussed that due to
large number of security breaches as well as data breaches, the main concern is human as errors
are occurred due to lack of awareness of information security. The technology related breaches

11
MINIMIZING THE AFFECT OF HUMAN BEHAVIOUR RISKS RELATED TO
INFORMATION SECURITY
are occurred due to malicious individuals exploit the vulnerabilities into the technology on daily
basis and it is expected to continue as the security hacks are appeared into the media because of
general public interests. Cheng, Zhai and Smyth (2014) argued that there are various information
security standards into existence as well as operations which support towards the cyber security
assurances.
1.2.1 Human factors for information security
People are at centre of the technological design along with use of designed products. It is
an asset as well as threat. The organization addressed the human elements to deal with the
incidents of information security (Katzenbeisser and Petitcolas 2016). The researcher highlighted
it as number of human related security incidents. Into the organizational policies as well as
standards, there are codes of conducts which are being designed for people to follow up. People
are executers of the organizational information security policies. The human factors are major
forces which are behind effectiveness as well as failure of the security systems. Mishra, Akman
and Mishra (2014) stated that the technical solutions are not sufficed as the insider threats are
become fundamental issues. There is evidence that the human factors are undermine in addition
to underdeveloped. The direct factors are those who dependent on the individual’s characteristics
and have significant impact on the information security management system. Sheeran and Rivis
(2017) discussed that the indirect factors are based on external issues like the organizational
issues those have adequate budget as well as enforcement of policies which have proper
influence to the direct factors and the information security system.
The human errors are defined as divergence into the system which works properly. The
incidents of information system will happen with proper hard approaches to the human
behaviors. Tsai et al. (2016) conducted that the security policies are being designed to restraint