Importance Of User Security Behavior In Information Technology

The impact of user behavior on the security of the system

Discuss about the User Security Behaviour.

User security behavior is an important issue for the organization. The organizations give devices to the users through some technology. The organizations are very much aware about the security threats that may arise for their products, but the securities of the products are also dependent on the use of those products. The user behavior is an important parameter to determine the security of the product.  In case if the end users are not aware of the secured use of the system, there may arise some security flaw in the system itself. In this case the example of the email service can be taken into account (AlHogail,2015). The right practice of using the email is to logout from the account after the use of the account (Boss et al.,2015). The users generally do not sign off from the account, which can become the possible threat for the email account itself. The awareness of the user behavior about using a service has thus become important thing to be discussed.

The investigation about the user behavior is important for the field of information technology, because it has been seen in the most cases that the user behavior has affected the internal security of the system as well as organization (Shropshire, Warkentin& Sharma, 2015). The user security behavior can be regarded as the study of technology adaptation. The study of technology adaptation can be done by analysis of the relationship between the behavior and intention of the users (Shropshire, Warkentin& Sharma, 2015). The analysis of this relation can be beneficial for creating or modifying the security framework. The insight of the user behavior can be predicted from the personality contrast. It has been seen from the experience that a slight effect in the change of the personality can greatly affect the change in the user behavior.

Another way, in which the user behavior is causing the security threats, is the way they use social media. Users generally relay on the information which are crowed sourced in different social sites. This has opened up a way for the manipulation. The manipulation can be done by creating the fake account and giving the wrong information to the users. In order to prevent this, the users are needed to be aware of choosing the right source of information. Apart from that the developed technology can be used in order to detect the malicious users among the normal and authorized users. A framework, named Principal Component Analysis can be used in this case (Viswanath et al.,2014). The main objective of this framework is to analysis the normal intention and the behavior of the legal users and any deviation from the characteristics of the normal user behavior can be considered as security threat by a malicious user.

Factors affecting user behavior and security concerns

The main target of the security threat due to the user behavior is Email. The email is increasingly threatened by the sophisticated cybercrime. There is some security measures has been taken in order to improve the security system in the email. However, it is unknown, the way these security measures are received by the users, and their intention towards using these security measures. The Technology Acceptance Model or the Technology Threat Avoidance theory helps to detect the factor that detects the users from accepting the security measures (Herath et al.,2014). The analysis of the situation through the mentioned model has shown that one of the main factors affects the user’s behavior is the use’s perception about the knowledge of the risk associated with the email service. The finding of the study has the contribution towards security behavior, adaptation of the security services and the success of those services.

Phishing is a concerned security threat, which includes the stealing of the password, username of the account holders along with the unauthorized access of the confidential information. User behavior contributes the phishing activity (Arachchilage & Love,2014). The users are not pay much attention while using the information technology services. The theoretical model based on Threat Avoidance Theory it has been seen that the conceptual or the procedural knowledge has positive impact on the user’s intention and awareness during the use of the technical  security. Well planned end user security guide is useful in order to prevent the cyber security threat.

The user behavior regarding the information security into the organization is important in order to evaluate the security of the internal system of the organization. The users here are mostly the workers and the employees of the organization (Kent,Liebrock  & Neil, 2015). The framework can be maintained in order to educate the workers in an organization about the network security and mitigate the risk of security threats in the systems of the organization.

Security mechanisms are widely used for maintaining the security for both hardware and software systems. It has been observes that some of the casual behaviors of the users are making the system inclined to the security threats. Four scales can be used to measures the risk oriented behavior of the consumers or the users. These are -Conservative Behavior Scale, Risky behavior scale, expose to offence scale, risk perception scale (Ö?ütçü, Testik & Chouseinoglou, 2016).A survey is conducted on the users and the evaluation of the user’s behavior has been based on these four scales. The survey result shows the difference between the desired behavior of the users and the actual approach of the users.

Creating or modifying a security framework based on user behavior knowledge

The importance of the end user behavior in maintaining the security of the system makes it important to develop a framework mentioning the roles and regulations of the end user behavior. In order to create this type of framework the intention of the users towards the security is needed to be evaluated. Apart from that the importance of education about maintaining the secured way of using the IT systems are needed to be included in the framework (Egelman & Peer,2015). The users can take decisions about the right doings from the guidance of the framework.

The main security threat in an organization comes from the workers or the employees who are not intended to cooperate with the security policies in the company. In order to prevent this, there is an extensive research needed to identify the cause of this approach for the employee. In order to do that the analysis can be carried out on the basis of Theory of Reasoned Action, and cognitive evaluation theory (Siponen, Mahmood& Pahnila, 2014). The result of the analysis shows that the adaptation of the security policies by the workers of the company is dependent on the acceptance of the policy to the employees. Apart from that , the managers should made aware of the importance of  security policies and the employees should be given trainings regarding the maintenance of the security.

Internet has become a useful commodity nowadays. Most of the people uses internet on daily basis. However, maintaining security is also important while using the internet. In most cases, the users are intentionally or unintentionally providing the important information, such as login details to the hackers. This is happening because of the lack of security awareness of the users. The users are accessing the malicious websites and the links unknowingly. The hackers can attract the users by providing the exciting offer through malicious link (Safa et al.,2015). The users are getting their data exposed to the hackers by clicking the link. To prevent this security awareness should be spread among the users.

The online activities are largely depending on the participation of the users. Any activity regarding the online process such as the crowd sourcing or accessing the social media is dependent on the behavior of the users (Wang et al., 2016). It is important in this case to indentify the cluster of the unauthorized users in the system. There are certain observations which help the expert to identify the illegal users in the online process. Identification of the illegal users can be detected based on the user behavior theories.

Conclusion

The user behavior in case of the information security is an important thing to be discussed. The internal security of the system depends upon the various technical implementation and modification of the system. However, the user behavior is an non technical factor, that affects the security of the system in both negative and positive way.  In case if the user is aware of the security threats of regarding the use of IT system, he or she will abide by the rules and regulations. This kind of behavior will strengthen the security system of the device. The security protocol followed in the system should be used by the users. In this context if the user is not aware of the security tools those can be used in the system, the user can put the system into the security threat. The behavior of the users in this case may be intentional or unintentional. A user may not aware of the importance of security, on the other way, the user is aware of the security, however he or she is not following the security policies. In order to distinguish the individual behaviors certain tools and framework can be used. Te result obtained from using the tool can be used to build a framework regarding the security policy to educate the users about the significance of security behavior in ICT

References

AlHogail, A. (2015). Design and validation of information security culture framework. Computers in Human Behavior, 49, 567-575.

Arachchilage, N. A. G., & Love, S. (2014). Security awareness of computer users: A phishing threat avoidance perspective. Computers in Human Behavior, 38, 304-312.

Boss, S. R., Galletta, D. F., Lowry, P. B., Moody, G. D., & Polak, P. (2015). What do users have to fear? Using fear appeals to engender threats and fear that motivate protective security behaviors.

Da Veiga, A., & Martins, N. (2015). Improving the information security culture through monitoring and implementation actions illustrated through a case study. Computers & Security, 49, 162-176.

Egelman, S., & Peer, E. (2015, April). Scaling the security wall: Developing a security behavior intentions scale (sebis). In Proceedings of the 33rd Annual ACM Conference on Human Factors in Computing Systems (pp. 2873-2882). ACM.

Herath, T., Chen, R., Wang, J., Banjara, K., Wilbur, J., & Rao, H. R. (2014). Security services as coping mechanisms: an investigation into user intention to adopt an email authentication service. Information Systems Journal, 24(1), 61-84.

Kent, A. D., Liebrock, L. M., & Neil, J. C. (2015). Authentication graphs: Analyzing user behavior within an enterprise network. Computers & Security, 48, 150-166.

Ö?ütçü, G., Testik, Ö. M., & Chouseinoglou, O. (2016). Analysis of personal information security behavior and awareness. Computers & Security, 56, 83-93.

Safa, N. S., Sookhak, M., Von Solms, R., Furnell, S., Ghani, N. A., & Herawan, T. (2015). Information security conscious care behaviour formation in organizations. Computers & Security, 53, 65-78.

Shropshire, J., Warkentin, M., & Sharma, S. (2015). Personality, attitudes, and intentions: Predicting initial adoption of information security behavior. Computers & Security, 49, 177-191.

Siponen, M., Mahmood, M. A., & Pahnila, S. (2014). Employees’ adherence to information security policies: An exploratory field study. Information & management, 51(2), 217-224.

Viswanath, B., Bashir, M. A., Crovella, M., Guha, S., Gummadi, K. P., Krishnamurthy, B., & Mislove, A. (2014, August). Towards Detecting Anomalous User Behavior in Online Social Networks. In USENIX Security Symposium (pp. 223-238).

Wang, G., Zhang, X., Tang, S., Zheng, H., & Zhao, B. Y. (2016, May). Unsupervised clickstream clustering for user behavior analysis. In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems (pp. 225-236). ACM.