A1 Journal article (refereed)
Toward a stage theory of the development of employees' information security behavior (2020)

Karjalainen, M., Siponen, M., & Sarker, S. (2020). Toward a stage theory of the development of employees' information security behavior. Computers and Security, 93, 101782. https://doi.org/10.1016/j.cose.2020.101782(external link)

JYU authors or editors

Publication details

All authors or editors: Karjalainen, Mari; Siponen, Mikko; Sarker, Suprateek

Journal or series: Computers and Security

ISSN: 0167-4048

eISSN: 1872-6208

Publication year: 2020

Volume: 93

Pages range: 101782

Publisher: Elsevier

Publication country: United Kingdom

Publication language: English

DOI: https://doi.org/10.1016/j.cose.2020.101782(external link)

Publication open access: Openly available

Publication channel open access: Partially open access channel

Publication is parallel published (JYX): https://jyx.jyu.fi/handle/123456789/68531(external link)

Abstract

Existing behavioral information security research proposes continuum or non-stage models that focus on finding static determinants for information security behavior (ISB) that remains unchanged. Such models cannot explain a case where the reasons for ISB change. However, the underlying reasons and motives for users’ ISB are not static but may change over time. To understand the change in reasoning between different antecedents, we examine stage theorizing in other fields and develop the requirements for an emergent theory of the development of employees’ ISB: (1) the content of stages based on the stage elements and their stage-specific attributes; (2) the stage-independent element explaining the instability of ISB; and (3) the temporal order of stages based on developmental progression. To illustrate the stage theory requirements in an information security context, we suggest four stages: intuitive thinking, declarative thinking, agency-related thinking, and routine-related thinking. We propose that learning is a key driver of change between the stages. According to our theorizing, employees start with intuitive beliefs and later develop routine-related thinking. Furthermore, using interview data collected from employees in a multinational company, we illustrate the differences in the stages. For future information security research, we conceptualize ISB change in terms of stages and contribute a theoretical framework that can be empirically validated. In relation to practice, understanding the differences between the stages offers a foundation for identifying the stage-specific challenges that lead to non-compliance and the corresponding information security training aimed at tackling these challenges. Given that users’ ISB follows stages, although not in a specific order, identifying such stages can improve the effectiveness of information security training interventions within organizations.

Keywords: data security; data security policy; organisational behaviour; information behavior; learning

Free keywords: information security; information security behavior; compliance with information security policies; stage theory; learning

Contributing organizations

Ministry reporting: Yes

VIRTA submission year: 2020

JUFO rating: 2