@SebastianK wrote:
Having put way too much effort into researching security behaviour, and more specifically policy compliance for the last 6 years i must say:
Be VERY careful with the research.
This kind of research derives a model from theory and then tests the theory. But this view is very limited.
If you go out on the street right now, with a certain assumption about people and you walk around you will be able to at least partly confirm this assumption.
Theory based testing is established, and scientifically sound but it only provides plausible generalizable results if:
- The theory has proven its validity over time
- The methodology has proven its validy over time
This is the case in most parts of physics, chemistry, biology, since they have been around long enough to have these discussions. Sociology, socio-psychology, psychology, economics, computer science, information systems, and ultimately information security have not been around that long, and are yet to have these validity discussions in depth.
In 2015 i conducted a meta analysis on security behaviour. A researcher from sweden, Sommestad did the same (independently). We both found that there are no consistently applicable theories in this topic...
Sometimes models check out. Sometimes they don't.
In the meantime and being in applied research in germany, i am also consulting with industry customers (Actually i am "just" a consultant working on a degree, some publications and fancy words 😉 ). There i have found that it makes much more sense to discuss the behavior in light of the employees.
Tl;dr: Shaming CAN work. But that depends on your employees. And as with any approach on behavior control. If you can live with losing your employee, or at least their trust you can of course try approaches such as shaming, deterrents, sanctions, threatening.
But if you can't such things should be a last resort. Not a valid tactic.
Sebastian,
I love your comments here because they support the foundation of my own security compliance research as published in my (open access) dissertation in 2014,
Reasons for non-compliance with mandatory information assurance policies by a trained population
If you had not used it in your 2015 review, I recommend you consider adding it to your reference list now.
My actual research effort was simple to simplistic: I asked respondents why they did not follow some basic security rules, but I did so without priming them or providing pick-list responses based on any single or set of compliance theories. At the time, after extensive literature research, I could find no compliance research in either security or safety that had not been based on, and aimed at, a particular human performance theory.
To make matters worse, I discovered so many human performance theories, listed in my publication and summarized in a couple of other cited works, that it was clear there currently is no validated theory on which to predict likelihood of compliance or reasons for non-compliance.
You may find the tables in my dissertation, to include one used by permission from a previous dissertation, as informative in your own analyses.
I also note your distinction between the "hard" physical sciences and the newer social sciences. As a physical scientist (chemist) I learned the importance of designing experiments to test hypotheses based on theory, as opposed to the scientifically dangerous use of experiments designed to prove such hypotheses. Yet going back as far as an undergraduate course in Adolescent Psychology 201, I have been dismayed by the preponderance of social science research designed to prove hypotheses (and the underlying theories) rather than test them. In recent years I have noted some social science research that does follow the prescription to test rather than prove, but they seem still in the minority.
If you would like to continue our conversations on these topics, please e-mail me directly, so we do not have any social medias site as an interlocutor.
Craig
