Future directions for behavioral information security research

Abstract

Information Security (InfoSec) research is far reaching and includes many approaches to deal with protecting and mitigating threats to the information assets and technical resources available within computer based systems. Although a predominant weakness in properly securing information assets is the individual user within an organization, much of the focus of extant security research is on technical issues. The purpose of this paper is to highlight future directions for Behavioral InfoSec research, which is a newer, growing area of research. The ensuing paper presents information about challenges currently faced and future directions that Behavioral InfoSec researchers should explore. These areas include separating insider deviant behavior from insider misbehavior, approaches to understanding hackers, improving information security compliance, cross-cultural Behavioral InfoSec research, and data collection and measurement issues in Behavioral InfoSec research.

Introduction

Information Security (InfoSec) research is far reaching and includes technical, behavioral, managerial, philosophical, and organizational approaches that address the protection and mitigation of threats to information assets (Zafar and Clark, 2009). Though some of the Information Systems research in the InfoSec field has considered socio-philosophical concerns or socio-organizational concerns, it has primarily focused on technical issues concerning the design and implementation of security subsystems (Choo, 2011; Zafar and Clark, 2009), such as advanced technical approaches to prevent intrusion into organizational systems (Hansen et al., 2007), detection of denial of service attacks (Zhi-jun et al., 2012), and more advanced solutions for firewall protection (Ayuso et al., 2012). Although these technical, externally focused efforts are important, one area that is a predominant weakness in properly securing information assets is the individual user within an organization (Leach, 2003; Posey et al., 2011b; Sasse et al., 2001; Stanton et al., 2005; Vroom and von Solms, 2004; Warkentin and Willison, 2009). This is a particularly important problem because researchers estimate that nearly half of intrusions and security violations occur from within an organization by organizational insiders (Baker et al., 2010; Richardson, 2011). Until recently, research exploring the operational aspect of information security has been lacking.

Behavioral InfoSec research is a subfield of the broader InfoSec field that focuses on the behaviors of individuals which relate to protecting information and information systems assets (Fagnot, 2008; Stanton et al., 2006), which includes computer hardware, networking infrastructure, and organizational information. Recently, a number of studies have been published about the behaviors of individuals in protecting these assets. These studies include those that provide insight into insider abuse of information systems (Siponen and Willison, 2009; Willison, 2006; Willison and Backhouse, 2006), as well as applying General Deterrence Theory (GDT) to understand human behavior as it relates to computer crime and intentional abuse (Straub and Nance, 1990; Straub and Welke, 1998). Further studies have adapted Protection Motivation Theory (PMT) to understand the behaviors of individuals when it comes to the performance of a number of security measures, such as the use of anti-malware software (Johnston and Warkentin, 2010; Lee and Larsen, 2009; Liang and Xue, 2010), compliance with security policies (Herath and Rao, 2009b; Ifinedo, 2012), backing up data (Crossler, 2010), properly securing home wireless networks (Woon et al., 2005), and adoption of anti-plagiarism software (Lee, 2011). Beyond PMT, other empirical studies exist that investigate behavioral factors that affect such areas as security policy compliance (Bulgurcu et al., 2010; Herath and Rao, 2009a; Hu et al., 2011a, Hu et al., 2012; Siponen and Vance, 2010; Warkentin et al., 2011a), information systems misuse (D'Arcy and Hovav, 2007; D'Arcy et al., 2009; Posey et al., 2011b), and computer abuse (Lee et al., 2004; Posey et al., 2011a).

Even with the number of Behavioral InfoSec research studies being published, significant challenges still remain that must be overcome as this research stream moves forward. The ensuing paper identifies these challenges and presents approaches that could be utilized to address them. Resulting from this analysis are future directions that Behavioral InfoSec researchers should explore.