Assessing the Human Factor of Cybersecurity: Can Surveys Tell the Truth?

Abstract

Survey-based measuring plays an important role in exploring human behavior. In organizational context, self-reporting of behaviors, attitudes, norms etc. can often lead to people responding in line with expectations rather than reality. Particularly when answering sensitive questions, respondents can disguise the truth for various reasons. This is called a social desirability effect (SDE) and poses a key problem in the field of behavioral studies because it can significantly bias the findings of research. A number of methods to prevent or detect SDE exist. The aim of the paper is to test selected techniques for decreasing SDE in survey-based measuring of information security behavior and to propose an improved scale, minimally susceptible to SDE. We used a cross-sectional survey design with a split-ballot experiment across three companies of critical infrastructure in Slovenia (n = 414). Four groups of employees received versions of information security behavior scale with different combinations of negative, positive and forgiving item wording. No universal group and item type effect of forgiving and alternating item wording was found with testing of the Balanced Inventory of Desirable Responding (BIDR) scale. However, it turns out that the content of items matters because one of methods perform differently for different types of behavioral items. Moreover, the part of analysis showed that combination of forgiving and alternating item wording might be effective in minimizing SDE. Items with best properties were chosen to establish new information security behavior scale. The majority of items were chosen from groups with alternating item wording, especially the one combining positive and forgiving items.