Training for Information Security – A.J. Burns and M. Eric Johnson, Vanderbilt University

A.J. Burns, Vanderbilt

In today’s digital economy, the uses and users of organizational information are growing rapidly. Perhaps in no industry is this more evident than in the health sector. As the chain of custody of personal health information becomes increasingly complex, many organizations are seeking new ways to train employees to increase health data stewardship. The most common channel for organizational influence over employees’ security-related behaviors are the firm’s security education, training and awareness (SETA) initiatives, yet relatively little research has investigated theoretical approaches to understanding SETA’s motivational effectiveness.

M. Eric Johnson, Dean of the Owen School of Management

Recent research presented at the Hawaiian International Conference on Systems Sciences (HICSS 2015) provides a diagnostic approach to SETA’s influence on employee motivation through the lens of expectancy theory (also known as VIE Theory). The findings show that when it comes to motivating security behaviors, proactive and ommisive behaviors are influenced by distinct expectancy dimensions. Interestingly, expectancies (i.e., the perception that one’s effort will lead to behavior) and instrumentalities (i.e., the perception that one’s behavior will lead to a desired outcome) were positively related to information security precaution taking; while security valence (i.e., the perception that it is good to protect one’s firm from security threats) was negatively related to the withdrawal from information security-enhancing behaviors (or security psychological distancing). These results provide a framework for future study and should help organizations dealing with sensitive information develop SETA initiatives by targeting the distinct expectancy dimensions.

See the full paper at http://conferences.computer.org/hicss/2015/papers/7367d930.pdf