Human Factors and Information Security

Security, including information systems security, is a societal problem, not just a technology problem. Getting people to adopt secure IS practices requires more than traditional ease of use studies and user requirements analysis. It requires users of advanced information systems to adopt a culture of security. We propose a model of organizational security, which includes user security behavior as a key element. Next, we propose a model of user security behavior itself, and discuss how it shows how we have to create this culture of security. Lastly, we discuss directions for future research.