Users may respond to threats with a wide range of coping strategies in addition to protective information security behavior. However, relatively little is known about emotion-focused coping (EFC) responses, and prior work has often considered any non-security behavior to be “maladaptive." We examine EFC in the context of phishing and demonstrate that it can, in fact, have a positive influence on security behavior. Our research model builds on the established foundation of protection motivation theory and incorporates threat devaluation and positive reappraisal as forms of EFC. We collected quantitative data from 518 respondents and tested our model with PLS structural equation modeling to provide empirical insights into how threat and coping appraisals can lead to both emotion-focused and problem-focused responses. We find that EFC responses are nuanced and thus classify them according to whether the individual response is to either approach or avoid the threat. As these coping responses may be shaped by user perceptions, our findings provide opportunities to both protect users and develop a more comprehensive understanding of information security behavior.

Technostress is a growing concern for organisations, given the negative impacts of stress on employees' job satisfaction, productivity, and intention to comply with or violate policies. Security-related stress (SRS), a dimension of technostress, addresses how security-related activities, such as information technology compliance, can impact an individual's stress. Addressing security-related stress research is vital, given it can help identify factors that can both enhance employee well-being and strengthen an organisation's security posture. In this paper, we systematically review the literature from the past two decades addressing security-related stress and identify twenty-seven relevant studies for analysis. We make contributions in three areas. Firstly, we discover the predominant theoretical frameworks and models that address security-related stress while examining key factors and constructs that examine security-related stress. Secondly, we describe how security-related stress is measured and what interventions have proven effective in reducing it. Finally, based on our comprehensive analysis, we present a research agenda to inform future research directions of security-related stress.

Employees are both the first line of defense in organizations and a significant source of vulnerability. Behavioral research in information security (InfoSec) has predominantly studied the compliance of employees with organizational directives. Less understood are ‘shadow security practices’ – a related category of behavior where employees adopt InfoSec workarounds, albeit to still comply with organizational security needs. We develop a model of the antecedents of employees’ intentions to engage in shadow security practices and empirically test our model through a sample of 433 office workers. Results of our structural equation modeling analysis reveal that both InfoSec overload and psychological empowerment increase intentions to adopt shadow security measures, whereas perceived transparency of organizational InfoSec (through InfoSec communication) reduces this intention. Furthermore, we find that these constructs are interrelated and that InfoSec overload can be increased by both psychological empowerment and InfoSec transparency . Our study develops the theoretical understanding of the important yet under-researched concept of shadow security and presents practical recommendations to effectively manage organizational InfoSec through these factors.

Extant information security research is characterized by a focus on problem-focussed security behaviours, while overlooking the internal, and emotion-focussed coping responses that humans exhibit. Threat devaluation, where severity is downplayed, is an established dimension of risk perception, and yet it has not been considered in information security research to date. We address this gap by developing and empirically testing a research model of how threat and coping factors from Protection Motivation Theory influence both problem-focused and emotion-focussed coping responses. Data was collected from 518 users and PLS was used to reveal the determinants of, and the relationship between, problem-focused and emotion-focused coping behaviors. The results demonstrate that threat devaluation is a measurable outcome of all threat and coping appraisals considered, providing evidence that multiple coping strategies may be involved in a security threat situation. We also find that many of the well-established determinants of information security behavior, such as self-efficacy, are significantly related to emotion-focused responses. This has implications for researchers and practitioners who seek to create secure environments where users are more likely to enact constructive and problem-focused security behaviors.

Evidence-based practice in management assigns a high value to research results as a guide to practices that have been rigorously shown to be effective. To emphasize the practical relevance and outcomes for information systems research, statistical research should generally report its effect sizes. Specifying effect sizes not only reveals the utility of our results, but it also enables evidence-based practitioners to easily compare the known effects of different interventions applied in different studies. Effect size reporting has become a standard practice in many fields, however, though information systems researchers have adopted many other elements of statistical rigor, effect sizes are often overlooked. This paper surveys the current use of effect size calculations in information systems research, explains how such effects sizes are calculated, offers recommendations on when each of the different formulae is appropriate, and provides foundational work toward an index of expected effect sizes in information systems research.

Purpose Information technology users often fail to adopt necessary security and privacy measures, leading to increased risk of cybercrimes. There has been limited research on how demographic differences influence information security behaviour and understanding this could be important in identifying users who may be more likely to have poor information security behaviour. This study aims to investigate whether there are any gender differences in security and privacy behaviours and perceptions, to identify potential differences that may have implications for protecting users’ privacy and securing their devices, software and data. Design/methodology/approach This paper addresses this research gap by investigating security behaviours and perceptions in the following two studies: one focussing on information security and one on information privacy. Data was collected in both studies using anonymous online surveys. Findings This study finds significant differences between men and women in over 40% of the security and privacy behaviours considered, suggesting that overall levels of both are significantly lower for women than for men, with behaviours that require more technical skill being adopted less by female users. Furthermore, individual perceptions exhibited some gender differences. Originality/value This research suggests that potential gender differences in some security and privacy behaviours and perceptions should be taken into account when designing information security education, training and awareness initiatives for both organisations and the broader community. This study also provides a strong foundation to explore information security individual differences more deeply.

Purpose It is a widely held belief that users make a rational cost-benefit decision when choosing whether to disclose information online. Yet, in the privacy context, the evidence is far from conclusive suggesting that strong and as-yet unmeasured influences on behaviour may exist. This paper aims to demonstrate one such link – the effect of internet addiction on information disclosure. Design/methodology/approach Data from 216 Web users was collected regarding their perceptions on privacy and information disclosure intentions as well as avoidance behaviour, an element of internet addiction. Using a research model based on the Privacy Calculus theory, structural equation modelling was applied to quantify the determinants of online disclosure under various conditions. Findings The authors show that not all aspects of privacy (a multi-dimensional construct) influence information disclosure. While concerns about data collection influence self-disclosure behaviour, the level of awareness about privacy does not. They next examine the impact of internet addiction on these relationships, finding that internet addiction weakens the influence of privacy concerns to the point of non-significance. Originality/value The authors highlight some of the influences of self-disclosure behaviour, showing that some but not all aspects of privacy are influential. They also demonstrate that there are powerful influences on user behaviour that have not been accounted for in prior work; internet addiction is one of these factors. This provides some of the first evidence of the potentially deleterious effect of internet addiction on the privacy calculus.

The pervasiveness of social media and user-generated content has triggered an exponential increase in global data. However, due to collection and extraction challenges, data in embedded comments, reviews and testimonials are largely inaccessible to a knowledge management system. This article describes a KM framework for the end-to-end knowledge management and value extraction from such content. This framework embodies solutions to unlock the potential of UGC as a rich, real-time data source. Three contributions are described in this article. First, a method for automatically navigating webpages to expose UGC for collection is presented. This is evaluated using browser emulation integrated with automated collection. Second, a method for collecting data without any a priori knowledge of the sites is introduced. Finally, a new testbed is developed to reflect the current state of internet sites and shared publicly to encourage future research. The discussion benchmarks the new algorithm alongside existing techniques, providing evidence of the increased amount of UGC data extracted.

Abstract Though there is a tension between citizens' privacy concerns and their acceptance of government surveillance, there is little systematic research in this space and less still in a cross‐cultural context. We address the research gap by modeling the factors that drive public acceptance of government surveillance, and by exploring the influence of national culture. The research involved an online survey of 242 Australian and Sri Lankan residents. Data were analyzed using partial least squares, revealing that privacy concerns around initial collection of citizens' data influenced levels of acceptance of surveillance in Australia but not Sri Lanka, whereas concerns about secondary use of data did not influence levels of acceptance in either country. These findings suggest that respondents conflate surveillance with the collection of data and may not consider subsequent secondary use. We also investigate cultural differences, finding that societal collectivism and power distance significantly affect the strength of the relationships between privacy concerns and acceptance of surveillance, on the one hand, and adoption of privacy protections, on the other. Our research also considers the role of trust in government, and perceived need for surveillance. Findings are discussed with their implications for theory and practice.

Social media is relied upon as a single portal for entertainment, communication, and news. To understand determinants of new sharing, we empirically evaluate data from 188 Facebook users with PLS structural equation modelling. Results support the significant influence of information sharing and status seeking gratifications on news sharing, and that this significance varies across contexts. We find that status seeking gratification has a stronger effect on news sharing when news quality is more emphasized. In other words, sharing low-quality news can be damaging to an individual’s status and they try to avoid it. However, information sharing gratification has a stronger effect on news sharing for those individuals who rely more on credibility and may be employing more heuristic selection approaches. This work has opened up new opportunities for further research and it is hoped that this may contribute to improving the quality and experience of news sharing in social media.

Since websites are developed and maintained by different cultures, web page design may be influenced by the originating culture. This study examines the usage of design attributes between Australian, Chinese, and Saudi Arabian cultures. This study used automated and manual techniques to investigate design attributes including layout, navigation, links, multimedia, visual representation, colour, and text. Significant differences were found in each of the listed design attributes, suggesting that different interfaces may be needed for successful communication with different cultural groups. The results of this study confirm and extend prior research and anthropological models. The contribution of this study is the scale (460 websites in total) and breadth (seven design attributes) of the research. It also provides revised insights into culture and website design and the concept of cultural translation of web content.

Home users are particularly vulnerable to information security threats as they must make decisions about how to protect themselves, often with little knowledge of the technology. Furthermore, information for home users tends to focus on the traditional PC and may downplay threats faced on mobile devices, transforming well-known and old risks into new challenges for information security. To address the need for more behavioural information security research that focusses on mobile devices, this paper reports on the first large-scale study comparing security perceptions and behaviours on home computer and mobile devices. Data from 629 users revealed that in addition to differences in information security behaviour, the following security-related perceptions all differ significantly between home computer and mobile device use: perceived severity, security self-efficacy, response efficacy, response cost, descriptive norm, psychological ownership and intention to perform security behaviours. In each case, the direction of the difference was such that mobile devices were more likely to be at risk than a home computer. The practical implications of these differences are discussed.