Curbing Misbehaviour With Information Security Measures: An Empirical Evidence From A Case Study

Abstract

Organisations generally are still struggling with information security breaches despite various technical protections to secure their valuable information which is especially stored in cloud applications. The fact that human behaviour is the weakest link of the security chain. Security compromise causes substantial financial and nonfinancial losses to the organisations which jeopardise organisations’ reputation. Technical protection alone is seemed insufficient to ensure information safety. Therefore, this research takes it from the socio-technical perspective to strengthen information security. Addressing these factors are significant to help successfully create a healthy security culture in the organisation. Nevertheless, human behaviour is subjective in nature. Their behaviour depends upon the way they think feel and act towards security issues which needs an in depth understanding towards their security behaviour. Hence, adapting the sequential exploratory mixed-method approach, through the theoretical lens of social cognitive theory and security measures from extended deterrence theory, this study examines the information security behaviour of employees at an IT department of a public university, as the case study. Partial least square was used to analyse data collected via survey. Study shows that personal values and behaviour, apart from the effective technical security measures, are important factors towards inculcating information security compliance behaviour.