Details
| Original language | English |
|---|---|
| Pages (from-to) | 1049-1092 |
| Number of pages | 44 |
| Journal | Management Research Review |
| Volume | 37 |
| Issue number | 12 |
| Publication status | Published - 11 Nov 2014 |
Abstract
Purpose – This paper aims to provide an overview of theories used in the field of employees’ information systems (IS) security behavior over the past decade. Research gaps and implications for future research are worked out by analyzing and synthesizing existing literature. Design/methodology/approach – This paper presents the results of a literature review comprising 113 publications. The literature review was designed to identify applied theories and to understand the cognitive determinants in the research field. A meta-model that explains employees’ IS security behavior is introduced by assembling the core constructs of the used theories. Findings – The paper identified 54 used theories, but four behavioral theories were primarily used: Theory of Planned Behavior (TPB), General Deterrence Theory (GDT), Protection Motivation Theory (PMT) and Technology Acceptance Model (TAM). By synthesizing results of empirically tested research models, a survey of factors proven to have a significant influence on employees’ security behavior is presented. Research limitations/implications – Some relevant publications might be missing within this literature review due to the selection of search terms and/or databases. However, by conduction a forward and a backward search, this paper has limited this error source to a minimum. Practical implications – This study presents an overview of determinants that have been proven to influence employees’ behavioral intention. Based thereon, concrete training and awareness measures can be developed. This is valuable for practitioners in the process of designing Security Education, Training and Awareness (SETA) programs. Originality/value – This paper presents a comprehensive up-to-date overview of existing academic literature in the field of employees’ security awareness and behavior research. Based on a developed meta-model, research gaps are identified and implications for future research are worked out.
Keywords
- Behavioral theories, GDT, PMT, Security awareness, Security behavior, TAM, TPB
ASJC Scopus subject areas
- Business, Management and Accounting(all)
- General Business,Management and Accounting
Cite this
- Standard
- Harvard
- Apa
- Vancouver
- BibTeX
- RIS
In: Management Research Review, Vol. 37, No. 12, 11.11.2014, p. 1049-1092.
Research output: Contribution to journal › Article › Research › peer review
}
TY - JOUR
T1 - Information security awareness and behavior
T2 - A theory-based literature review
AU - Lebek, Benedikt
AU - Uffen, JöRg
AU - Neumann, Markus
AU - Hohler, Bernd
AU - Breitner, Michael H.
N1 - Funding information: The authors thanks the anonymous referee for his/her useful comments. Partial support by Generalitat de Catalunya (AGAUR, 2004XT 00004) and by the MEC under the project “PROPRIETAS” (SEG2004-04352-C04-02) is acknowledged.
PY - 2014/11/11
Y1 - 2014/11/11
N2 - Purpose – This paper aims to provide an overview of theories used in the field of employees’ information systems (IS) security behavior over the past decade. Research gaps and implications for future research are worked out by analyzing and synthesizing existing literature. Design/methodology/approach – This paper presents the results of a literature review comprising 113 publications. The literature review was designed to identify applied theories and to understand the cognitive determinants in the research field. A meta-model that explains employees’ IS security behavior is introduced by assembling the core constructs of the used theories. Findings – The paper identified 54 used theories, but four behavioral theories were primarily used: Theory of Planned Behavior (TPB), General Deterrence Theory (GDT), Protection Motivation Theory (PMT) and Technology Acceptance Model (TAM). By synthesizing results of empirically tested research models, a survey of factors proven to have a significant influence on employees’ security behavior is presented. Research limitations/implications – Some relevant publications might be missing within this literature review due to the selection of search terms and/or databases. However, by conduction a forward and a backward search, this paper has limited this error source to a minimum. Practical implications – This study presents an overview of determinants that have been proven to influence employees’ behavioral intention. Based thereon, concrete training and awareness measures can be developed. This is valuable for practitioners in the process of designing Security Education, Training and Awareness (SETA) programs. Originality/value – This paper presents a comprehensive up-to-date overview of existing academic literature in the field of employees’ security awareness and behavior research. Based on a developed meta-model, research gaps are identified and implications for future research are worked out.
AB - Purpose – This paper aims to provide an overview of theories used in the field of employees’ information systems (IS) security behavior over the past decade. Research gaps and implications for future research are worked out by analyzing and synthesizing existing literature. Design/methodology/approach – This paper presents the results of a literature review comprising 113 publications. The literature review was designed to identify applied theories and to understand the cognitive determinants in the research field. A meta-model that explains employees’ IS security behavior is introduced by assembling the core constructs of the used theories. Findings – The paper identified 54 used theories, but four behavioral theories were primarily used: Theory of Planned Behavior (TPB), General Deterrence Theory (GDT), Protection Motivation Theory (PMT) and Technology Acceptance Model (TAM). By synthesizing results of empirically tested research models, a survey of factors proven to have a significant influence on employees’ security behavior is presented. Research limitations/implications – Some relevant publications might be missing within this literature review due to the selection of search terms and/or databases. However, by conduction a forward and a backward search, this paper has limited this error source to a minimum. Practical implications – This study presents an overview of determinants that have been proven to influence employees’ behavioral intention. Based thereon, concrete training and awareness measures can be developed. This is valuable for practitioners in the process of designing Security Education, Training and Awareness (SETA) programs. Originality/value – This paper presents a comprehensive up-to-date overview of existing academic literature in the field of employees’ security awareness and behavior research. Based on a developed meta-model, research gaps are identified and implications for future research are worked out.
KW - Behavioral theories
KW - GDT
KW - PMT
KW - Security awareness
KW - Security behavior
KW - TAM
KW - TPB
UR - http://www.scopus.com/inward/record.url?scp=84914117939&partnerID=8YFLogxK
U2 - 10.1108/MRR-04-2013-0085
DO - 10.1108/MRR-04-2013-0085
M3 - Article
AN - SCOPUS:84914117939
VL - 37
SP - 1049
EP - 1092
JO - Management Research Review
JF - Management Research Review
SN - 2040-8269
IS - 12
ER -