ICT615 Information Technology Research Methods: User Security Report

This report presents a literature review on user security behavior, focusing on the importance of user actions in relation to IT systems and devices. It examines the significance of understanding user behavior to mitigate security vulnerabilities and threats, such as phishing attacks. The review synthesizes research from various scholars, highlighting key concepts like self-efficacy, rationalization, and the cost of addressing IT innovation vulnerabilities. It also explores data protection protocols, security policies, and the role of users in energy consumption. Furthermore, the report includes a critical evaluation of a related research paper, analyzing its aim, data generation methods, sampling techniques, and limitations. The evaluation offers recommendations for additional information and identifies potential flaws, providing a comprehensive overview of the topic and its implications for IT security.

Running head: USER SECURITY BEHAVIOR
User security behavior
Name of the Student
Name of the University
Author Note:

1USER SECURITY BEHAVIOR
Part 1: Literature Review
Introduction
The behaviour of the user of different technologies is very much important to deal with
the complexities of the technologies. The paper will be very much useful to understand the role
of the users of the different types of systems and devices from the point of view of different
scholar. Peer reviewed journals will be considered in the paper. The work of the researchers will
be highlighted in the paper along with the effectiveness of the paper in terms of its
implementation.
Importance of User Security
As mentioned by Furnell et al. (2018), there is a need to understand the importance of
user security of the different types of technologies which are developed by the IT experts in the
recent years. The researcher of the paper focuses on the importance of human interaction and
behavioural economics which are needed to follow so that the effectiveness of the technology is
maintained throughout the life cycle of the technology. The paper concludes the importance of
maintaining strong alphanumeric passwords for each of the IT technologies which are used by
the users. The risks associated with weaker passwords have been stated in the paper as well.
However, as discussed by Nguyen et al. (2017), users of the IT technologies need to understand
the action sequence of the technology in the first place in order to protect the technology from
the cybersecurity threats. The researcher focused on the importance of maintaining security
patterns so that the threat to the technology as well as to the users can be avoided.

2USER SECURITY BEHAVIOR
Self-efficacy
The paper also focuses on the importance of self-efficacy and behaviour of the users
regarding the application of the IT technologies. The researcher stated that the components of the
IT devices have to be understood by the users so that the security vulnerabilities associated with
the IT systems can be mitigated. The visual summary of the user behaviour is presented in this
paper with the help of pictorial diagrams.
Behaviour of the users
As discussed by Krol et al. (2016), user behaviour is very much important to mitigate the
security vulnerabilities associated with the IT systems and products. The concept of
rationalisation has been focussed in the paper which can be very much useful to understand the
importance of cost and threats associated with IT technologies such as the Information Systems
which are used in most of the business organizations. The paper concludes with the business
principles and security protocols which has to be maintained by the users of the IT systems.
Cost of addressing vulnerabilities of IT innovations for the users
According to Nguyen et al. (2018), a huge amount of cost is required for maintaining the
security for IT innovations such as the Management Information System which are used in the
most of the global business organization. According to the researchers of this paper, the security
vulnerabilities must be understood by the users of those IT innovations. The researcher stated
that a casual approach of the users can have a significant negative impact on the IT system as
cybercriminals are using the same Information Technology for different types of security issues.
The paper concludes stating the use of the IT governance plan can be very much useful to
mitigate the security vulnerabilities of the IT technologies.

3USER SECURITY BEHAVIOR
Data Protections protocols for the users
As mentioned by Micallef & Arachchilage (2017), the security behaviour of the users of
the IT systems. The paper introduces the importance of the fall-back authentication which is very
much important to retrieve the forgotten passwords of the IT devices. The researcher also
discussed the behaviour of the users of the smartphones is very much important to protect the
sensitive data which are stored in the mobile devices. The persuasive technology principles are
discussed in the paper as well. The prime benefit of the paper is that it focuses on different types
of authentication techniques which are used to retrieve the forgotten passwords. The paper
concludes providing the importance of self-efficacy and self-monitoring to protect IT
technologies.
Security policies for the users
As discussed by Alotaibi, Furnell & Clarke (2016), the security policies are very much
important to contain the privacy and the security issues which are common in most of the
business organizations which are using latest IT technologies in their working environment. The
researcher highlights the security policy management of the end users of the IT technologies.
The researchers stated that updating of the security policies can be very much important to deal
with the challenges coming from the cybersecurity risks. The main benefit of this paper is that it
focuses on the two types of user behaviour such as compliance and non-compliance. The paper
concludes that the behaviour of the employees must be changed so that the effectiveness of IT
innovations can be maintained. However, as discussed by Safa, Von Solms & Futcher (2016), the
human aspects of the information system has to be changed in the first place in order to improve
the security and the efficiency of the mobile devices which are used in the working environment.
The paper focuses on the security issues of Information System due to ignorance and lack of

4USER SECURITY BEHAVIOR
motivation. The researcher of the paper stated that the use of the different types of IT innovations
can have both positive as well as negative impact on our society. The prime benefit of the paper
is that it focuses on each of the vulnerabilities which are the reasons behind the security issues in
the IT innovations. However, there is a significant limitation associated with this paper such as it
does not provide any case study to support the discussions. The paper concludes the importance
of decision making for the security risks for IT innovations. The importance of maintaining
internal security is highlighted in the paper as well.
Role of users in energy consumption of devices
As mentioned by Mwansa et al. (2018), the behavior of the users is very much important
to protect the integrity of the different types of IT innovations such as the internet of things and
big data technologies. The main objective of this paper is to focus on the importance of
maintaining appropriate users for security applications. The researcher of the paper stated that
the consumption of the energy by the IT technologies has to be monitored by the users. The
researcher also suggested that the advanced metering infrastructure can be very much useful for
the two way communication process of the IT systems and technologies. The prime benefit of the
paper is that it focuses on most of the electricity usage of most of the IT technologies which are
directly associated with the behaviour of the users. The paper concludes the importance of data
classification approach by the users of the IT technologies. The importance of consumer
profiling regarding the usage of the IT devices was stated in the paper with primary importance.
Perceived threat from business
As stated by Albladi & Weir (2016), behavior variables, perceptual variables are very
much important to deal with the vulnerabilities of social engineers. The prime benefit of the

5USER SECURITY BEHAVIOR
paper is that it focuses on most of the vulnerabilities of social media platforms such as the
opening a user account in more than one device without logging out on the other. The prime
limitation of the paper is that it does not provide a case study to support the discussion. The
paper concludes the need for maintaining security awareness and self-efficacy for the users of the
social networking platforms. The paper successfully identifies the importance of software
updating and malware protections which has to be focused by users.
Security issues for users in business
As mentioned by Tajuddin, Olphert & Doherty (2015), the business relationship
involving the use of IT innovation is a significant reason behind the security and issues. The
researcher of this paper suggested that each of the stakeholders associated with the business must
be responsible enough to deal with the technologies they are using in their working environment.
The paper concludes the importance of maintaining IT risk management plan so that the internal
threats of the organization can be dealt in a professional manner.
Conclusion
Thus, the literature review helps in understanding the expected behaviour of the users of
IT devices and systems so that the desired results are obtained from these technologies. The
paper also helps in identifying the two types of user behaviour such as compliance and the non-
compliance. The importance of the risk management plan and updating of the software to protect
the system from malware threats. The need for understanding the security due to the ignorance of
the users can be also determined from the above discussions of the literature review. Fall-back
authentication which is useful to maintain the security of the devices can be concluded from the
above unit of the paper as well.

6USER SECURITY BEHAVIOR
Part 2: Critical evaluation of Computers in Human Behavior
Question 1: Aim of the research: The main objective of this paper is to focus on the
importance of conceptual knowledge or procedural knowledge as this knowledge might have a
positive impact on the users of a computer system to deal with security issues such as the
phishing threats.
Question 2: Data generation method of the paper: The reliability and the effectiveness
of the paper are maintained with the help of the primary data collection procedure which is
followed in this paper. Along with the primary data collection method data was also collected
from other sources like Internet. However, it can be said that the data collection from the internet
is not entirely reliable as much as much as the primary data collection procedure.
Question 3: Sampling frame and sampling technique used in the paper: Data was
collected based on a survey from undergraduate students from the Department of Information
Systems and Computing. Probabilistic sampling method was chosen as the sampling technique
for this paper.
Question 4: Sample size: The sample size of this research is 20. The sample size was
enough to contribute to the effectiveness of the paper.
Question 5: Information about response rate: Based on the data collection procedure
of this paper it can be said that there were both positive as well as negative responses when the
participants were asked about their knowledge about the topic.
Question 6: Recommendations for additional information: The primary data
collection procedure could have also included a few IT experts who know the current trends
about the phishing attacks, this could have enhanced the reliability of the paper. Difference

7USER SECURITY BEHAVIOR
between respondents and non- respondents: Participants who understands the concept of
phishing attack are considered among the respondents, they were given a verbal description
about the phishing attack to confirm their understanding about the topic. Participants who does
not understand the concept of phishing mails are considered as the non-respondents, they a
provided with a verbal description of the phishing attack.
Question 7: Justification: The samples of this research is from the students of
Information Systems and Computing department as they have the idea how the behavior of the
users is important to deal with security threats such as phishing attacks and the data can be
considered for larger population also.
Question 8: Limitations of the survey strategy: The main limitation of the paper is the
data collection process, the paper only considered primary data collection procedure however a
combination of the primary as well as secondary data collection procedure could have enhanced
the reliability of the paper.
Question 9: Identification of the flaws: The notable flaw of this paper is that it does not
have any secondary data collection procedure as the opinion of the other scholar could have
identified many new aspects which could have been practiced by the users of computer system in
order to contain or minimize the phishing attacks. The omission of the secondary data collection
method could have had a negative effect on the survey results.
Question 10: Application of survey results: The survey results can be very much useful
to understand the preventive steps of phishing attacks. The motivation and the behaviour which
are expected from the users of the computers systems can be also determined from the survey as
well. Effectiveness of survey strategy: The two-way survey is very much reliable for this paper

8USER SECURITY BEHAVIOR
to deal with the inconsistencies. Multiple regression analysis was also conducted on the
outcomes of the paper which are self-efficacy, avoidance behaviour, avoidance motivation.

9USER SECURITY BEHAVIOR
References:
Albladi, S., & Weir, G. R. (2016, June). Vulnerability to social engineering in social networks: a
proposed user-centric framework. In 2016 IEEE International Conference on Cybercrime
and Computer Forensic (ICCCF) (pp. 1-6). IEEE.
Alotaibi, M., Furnell, S., & Clarke, N. (2016, December). Information security policies: a review
of challenges and influencing factors. In 2016 11th International Conference for Internet
Technology and Secured Transactions (ICITST) (pp. 352-358). IEEE.
Arachchilage, N. A. G., & Love, S. (2014). Security awareness of computer users: A phishing
threat avoidance perspective. Computers in Human Behavior, 38, 304-312.
Furnell, S., Esmael, R., Yang, W., & Li, N. (2018). Enhancing security behaviour by supporting
the user. Computers & Security, 75, 1-9.
Krol, K., Spring, J. M., Parkin, S., & Sasse, M. A. (2016). Towards robust experimental design
for user studies in security and privacy. In The {LASER} Workshop: Learning from
Authoritative Security Experiment Results ({LASER} 2016) (pp. 21-31).
Micallef, N., & Arachchilage, N. A. G. (2017, November). Changing users' security behaviour
towards security questions: A game based learning approach. In 2017 Military
Communications and Information Systems Conference (MilCIS) (pp. 1-6). IEEE.
Mwansa, M., Hurst, W., Chalmers, C., Shen, Y., & Boddy, A. (2018). A study into smart grid
consumer-user profiling for security applications. Cloud Computing, 2018, 17.

10USER SECURITY BEHAVIOR
Nguyen, P. H., Turkay, C., Andrienko, G., Andrienko, N., Thonnard, O., & Zouaoui, J. (2018).
Understanding user behaviour through action sequences: from the usual to the unusual.
IEEE transactions on visualization and computer graphics.
Nguyen, P., Turkay, C., Andrienko, G., Andrienko, N., & Thonnard, O. (2017). A visual
analytics approach for user behaviour understanding through action sequence analysis.
Safa, N. S., Von Solms, R., & Futcher, L. (2016). Human aspects of information security in
organisations. Computer Fraud & Security, 2016(2), 15-18.
Tajuddin, S., Olphert, W., & Doherty, N. (2015, February). Relationship between stakeholders'
information value perception and information security behaviour. In AIP Conference
Proceedings (Vol. 1644, No. 1, pp. 69-77). AIP.