Studies on Employees’ Information Security Awareness

by Felix Häußinger
Doctoral thesis
Date of Examination:2015-05-13
Date of issue:2015-06-15
Advisor:Prof. Dr. Johann Kranz
Referee:Prof. Dr. Johann Kranz
Referee:Prof. Dr. Lutz M. Kolbe
Referee:Prof. Dr. Jan Muntermann
Persistent Address: http://dx.doi.org/10.53846/goediss-5137

 

 

Files in this item

Name:Dissertation_Haeussinger_FINAL.pdf
Size:3.37Mb
Format:PDF

The following license files are associated with this item:

Abstract

English

Living in a digital age, where all kinds of information are accessible electronically at all times, organizations worldwide struggle to keep their information assets secure. It is assumed that 50 - 70 % of overall information systems security (ISS) incidents in organizations are either directly or indirectly the result of human error. In order to explore how organizations can defend themselves against the harmful ISS behavior of their employees, the topic of information security awareness (ISA) has become a top priority in the community. However, still many questions concerning our understanding of the emergence of information security awareness and its closely related behavior remain unanswered. The purpose of this cumulative dissertation is to expand our body of knowledge according to employees’ ISA by encompassing three interrelated studies, each of which formulates a series of research questions directed at different aspects of the topic. Study 1 represents a synthesized up-to-date review of the current state of ISA literature, with the aim to provide quick, structured access to the accumulated knowledge of ISA research, to give implications for scholars and practitioners and to reveal potential areas for further research. Study 2 builds up on the findings of study 1 and empirically tests a proposed research model that examines specific institutional, individual, and socio-environmental factors that are liable for the emergence of employees’ ISA. Moreover, the research model investigates the important, yet not studied mediating role of ISA on the relationship between ISA’s antecedents and employees’ intention to comply with information security policies (ISPs). Study 3 develops and empirically tests a research model that integrates the concept of ISA with general and situation specific motivational theories, in order to show how ISA, different types of endogenous motivation, personal values, and the internalization of ISPs are linked together to explain employees’ motivation to comply with ISPs. Findings emphasize why deterrence – a principle that dominates the literature to answer this essential question – is not enough. Each of the dissertation’s studies provides extensive theoretical and methodical contributions, reveals implications for practice and policy makers, and points out potential avenues for future research.
Keywords: Information Security Awareness; Information Security Behahavior; Information Systems Security; Antecedents of Information Security; Endogenous Motivation
 
Statistik