A qualitative study of users' view on information security

Abstract

Users play an important role in the information security performance of organisations by their security awareness and cautious behaviour. Interviews of users at an IT-company and a bank were qualitatively analyzed in order to explore users' experience of information security and their personal role in the information security work. The main patterns of the study were: (1) users state to be motivated for information security work, but do not perform many individual security actions; (2) high information security workload creates a conflict of interest between functionality and information security; and (3) documented requirements of expected information security behaviour and general awareness campaigns have little effect alone on user behaviour and awareness. The users consider a user-involving approach to be much more effective for influencing user awareness and behaviour.

Introduction

The information security role of users is an important part of a holistic approach to information security management. Dhillon and Backhouse (2000) have argued that the role, responsibility and integrity of users are important principles of information security management in new forms of organisations, which can be characterized by blurred organisational and geographical borders; use of mobile equipment; and information and knowledge being the organisation's most important resources. Users should play an active part in the information security work by preventing unwanted incidents; protecting an organisation's material and immaterial assets; and reacting to incidents. Users can contribute with several security actions in their daily work, e.g. locking the computer when absent from it; password etiquette; cautious use of e-mail and Internet; avoid using unlicensed software; cautious use of organisational assets when working outside the organisation; and reporting information security breaches. A user can be characterized as a person with legitimate access to the organisation's information systems. This study concentrates itself on users with no management responsibility and low degree of information security awareness and knowledge about information systems.

This paper aims at providing knowledge of users' experience of information security and their individual security role in daily work. This purpose is approached by qualitative interviews of users at a Norwegian bank and a Norwegian IT-company. The following research questions are discussed in the paper:

• How do users experience their own information security role and the administrative information security measures in their work processes?

• Why do users experience the information security work the way they state?

• Are there arguments in the users' views on information security that imply alternative approaches to information security management at the studied companies?

Editorials of this journal have called for more papers on the human factor in information security (Schultz, 2004, Schultz, 2005). Current human related information security research has been categorized into four main directions by Stanton et al. (2005): (1) user interfaces of security-related systems; (2) information security management concerns for risk, business processes and finance; (3) organisational issues related to information security behaviour; and (4) counterproductive computer usage. This paper positions itself into the third line by studying users' understandings of organisational issues related to individual information security behaviour, as the study mainly is about administrative aspects, and does not discuss users' views on technological security measures.

A user's view on information security is created by several interlocking organisational, technological and individual factors. The context of a user's work may, e.g. create information security trade-offs. Furthermore, social norms and interactions at the work place influence individual understanding of information security. The quality of information security management also affects users' awareness, motivation and behaviour in some way. Technological information security solutions influence users by framing what it is possible for users to do in information systems as well as function as a foolproof security mechanism for whatever actions users may do. Individual factors such as motivation, knowledge, attitudes, values and behaviour also influence individual views on information security. How people perceive risk is also a part of the explanation for users' view on information security. The paper mainly explains users' experiences of information security by organisational factors. It is, however, impossible to neglect individual and technological factors in this exploration due to the interwoven relations between organisation, technology and individuals.