# Factors that Influence Workers' Participation in Unhygienic Cyber Practices: A Pilot Study from Nigeria

Princely Ifinedo, Nigussie Mengesha, Olumide Longe

► To cite this version:

Princely Ifinedo, Nigussie Mengesha, Olumide Longe. Factors that Influence Workers' Participation in Unhygienic Cyber Practices: A Pilot Study from Nigeria. 15th International Conference on Social Implications of Computers in Developing Countries (ICT4D), May 2019, Dar es Salaam, Tanzania. pp.303-315, 10.1007/978-3-030-19115-3_25. hal-02281302

HAL Id: hal-02281302

https://inria.hal.science/hal-02281302

Submitted on 9 Sep 2019

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Factors that Influence Workers' Participation in Unhygienic Cyber Practices: A Pilot Study from Nigeria

Princely Ifinedo<fnref n="1" />[0000-0001-7032-3532], Nigussie Mengesha²[0000-0001-5673-5733], and Olumide Longe<fnref n="3" />[0000-0002-5122-3429]

**Abstract.** Participation or engagement in unhygienic cyber practices could ultimately harm an organization's information and communication technologies, if unchecked. This present study used concepts from the theory of planned behavior and organizational control theory to examine the effects of factors such as attitude, subjective norms, organizational facilitators, monitoring, and self-efficacy on workers' participation in unhygienic cyber practices. A cross-sectional survey of Nigerian professionals was used to test the formulated hypotheses. Partial least squares technique of structural equation modeling (SEM) was used for data analysis. The results indicate that attitude toward cyber hygiene has a negative effect on worker's participation in unhygienic cyber practices; similarly, subjective norms have a negative effect on engagement in such acts. The data did not show that organizational facilitators, self-efficacy, and monitoring had a meaningful impact on Nigerian workers' participation in unhygienic cyber practices. Implications of the study were discussed and contribution to the extant literature noted.

**Keywords:** Cyber Hygiene, Information Security, Employee, Survey, Nigeria.

## 1 Introduction

Information and communication technologies (ICT) enhance societal development and advancement across the globe [1]. Private and public organizations from Accra to Zanzibar have deployed and used ICT and other digital platforms for their activities and operations [2]. When processes and activities hinged on ICT platforms are compromised, either by non-malicious mistakes or malicious attacks, the consequences of such acts can have disastrous effects [3,4]. To ensure the safety of data resources, savvy organizations and business operators often provide workers with guidelines and instructions on how to properly use organizational ICT and other digital assets [3-6]. Prior research has examined employee ICT misuse [5], ICT abuse [4], compliance, and noncompliance with information systems (IS) security procedures [3-8]. These foregoing themes do not specifically focus on employee engagement or involvement in cyber hygiene malpractices [9,10]. Additionally, information on which factors influence or discourage participation in such behavior is not readily available in the noted studies.

The proposed research study contributes to prior research by investigating the effects of attitude, monitoring, subjective norms, organizational facilitators, and self-ef-

<footnote n="1">¹,² Brock University, St Catharines, Canada</footnote>

<footnote n="3">³ American University of Nigeria, Yola, Nigeria</footnote>

<footnote>pifinedo@brocku.ca</footnote>
ficacy on employee participation in unacceptable or ill-sanctioned cyber practices.
Specifically, this study is designed to address the following research questions:

a) What is the effect of attitude toward cyber practices on employees' participation in unacceptable cyber hygiene practices? b) What is the effect of subjective norms on employees' participation in unacceptable cyber hygiene practices? c) What is the effect of organizational facilitators on employees' participation in unacceptable cyber hygiene practices? d) What is the effect of employees' self-efficacy regarding cyber practices on their participation in unacceptable cyber hygiene practices? e) What is the effect of monitoring on employees' participation in unacceptable cyber hygiene practices?

The study is relevant because the majority of previous work in the area of end-user
security behaviors has been conducted in the developed West [3-8]. Not much re-
search has been done in Africa [11-13]. Information systems (IS) issues in advanced
societies should not to be conflated with those in developing parts of the world, in-
cluding Africa [11-13]. Factors that influence employee involvement in unacceptable
cyber practices in Africa, with the Nigerian worker as an exemplar, may not necessar-
ily be the same for a German or American worker. In this study, we provide a per-
spective of IS security management issue from a region of the world that has not been
well-represented in the extant literature. Moreover, findings from a study such as this
one could provide useful insights for the national cyber security frameworks recently
launched in Africa, including Nigeria [14]. As well, the management of such behav-
iors among workers, in the region, also benefits from empirical studies of this nature.
To the best of our knowledge, no previous research has explored the relationships be-
tween the effects of attitude, self-efficacy, subjective norms, organizational facilita-
tors, and monitoring on employee participation in unacceptable cyber practices, as
this present study aims to do.

2 Literature Review

## 2.1 Information on End User Security Behavior and Cyber hygiene

Various taxonomies on individual IS/ICT security behaviors are available in the ex-
tant IS security management literature [15-17]. For example, Magklaras and Furnell
[15] discussed a model for predicting insider threats by focusing on IS misuse and
abuse with examples, including data theft and stress. We build on the study by Loch
et al. [16], who identified sources of information security threats to an organization,
and Stanton et al. [17], who proposed a taxonomy of end-user computer security be-
haviors. The study focuses solely on human sources, e.g., employees and non-mali-
cious acts. Actions of malicious entities, i.e., hackers, are outside the scope of this
study, so are natural disasters, i.e., flood, fire, and so on. Stanton et al. [17] catego-
rized the nature or acts of threats as either malicious or non-malicious. Thus, mali-
cious end-user security behaviors include, for example, an employee who breaks into
an employer's protected IS to steal trade secrets; non-malicious end-user security be-
haviors include items such as responding to spam email. A few researchers have in-
vestigated similar issues in developing countries, e.g., Nigeria [11-13]. For example,
Longe et al. [13] presented an overview of criminal uses of ICTs in Sub-Saharan Africa with special emphasis on the Nigerian 419 scam. Ifinedo et al. [12] reported on top non-malicious, counterproductive computer security behavior engagements among employees in Nigeria. Empirical information on workers' cyber practices and potential determinants of such in Africa are not readily available.

In essence, cyber hygiene refers to the practices, precautions, and steps users of computers and other digital devices take to maintain, safeguard, and secure data re-sources from intrusions and outside attacks. Here, “cyber hygiene practices” refers to the positive or favorable notion of the phenomenon while unhygienic cyber practices connote unfavorable and ill-advised acts. In developing an illustrative list of unhy-gienic cyber practices for the study (see Table 1), we consulted prior academic litera-ture and practitioners’ reports on the subject matter [6,9,10,18].

# 3 Theoretical Foundations

A plethora of theories have been used to explore factors affecting end-user security behaviors [19]. It is not possible to include all relevant theoretical frameworks in this preliminary study. For illustrative purposes, we will fuse common theories such as the theory of planned behavior (TPB) [20] and monitoring from the organizational control theory (OCT) [21], to understand factors that impact employee involvement in unac-ceptable cyber hygiene practices.

## 3.1 Theory of Planned Behavior

Ajzen [20] proposed the theory of planned behavior (TPB). Its three proximal predic-tors of behavioral intention and behavior are attitude, subjective norms, and perceived behavioral control. Attitude refers to an individual's positive or negative feelings to-ward engaging in a specified behavior. Subjective norms refer to an individual's per-ception of what people important to him/her think about a given behavior. Perceived behavioral control (PCB) refers to an individual's beliefs regarding the efficacy and resources needed to facilitate a behavior. Two sub-constructs, i.e., organizational fa-cilitators and self-efficacy, are used to represent PCB as research shows these con-structs are similar to it [8]. The former relates to resources that an organization pro-vides to encourage or discourage engagement in a target behavior. The latter relates to an individual's ability to organize and execute courses of action required to produce/perform a specific behavior [22]. Behavior refers to an individual's observable re-sponse in a given situation with respect to a given target. For the purpose of this study, behavior is represented by unhygienic cyber practices. Several researchers have used TPB to study employee compliance with acceptable IS security behaviors and intention to use protective technologies [19].
## 3.2 Organizational Control Theory

Organizational control theory (OCT) is a multifaceted framework that describes the process by which one party attempts to influence the behavior of another within a given system [21]. Here, it includes management mechanisms through which an organization manages and directs the attention of its members, as well as motivates and encourages them, to act in accordance with its goals and objectives. The specific aspect of OCT considered for this present study is monitoring. Here, monitoring is the observing and checking of workers' computing practices over a regular basis. Other components of OCT, e.g., reward and specification, will be considered in future research inquires. Monitoring was chosen for this initial study because it provides an opportunity to investigate the impact of organizational efforts aimed at checking workers' adherence to prescribed IS security guidelines. Moreover, past researchers [e.g.,5] found monitoring to be relevant in understanding workers' compliance with desired IS security behaviors.

# 4 Research Model and Hypotheses

The study's research model is presented in Figure 1. Discussions on the formulated hypotheses are provided as follows:

<figure><img src="image_2.png" /><figcaption>Fig. 1. The research model.</figcaption></figure>

In tune with the tenets of TPB, positive attitudes influence favorable behavior and conversely, negative attitudes will diminish a target behavior [20]. Past studies show that employees who have positive attitudinal beliefs about their organization's IS security rules are the ones that readily comply with such guidelines [8,19]. Thus, it is expected that employees with positive attitudes toward cyber hygiene will have fewer compulsions to engage in unacceptable cyber hygiene practices.

H1: Attitude toward cyber hygiene negatively affect participation in unhygienic cyber practices.

Evidence exists to support the view indicating that an individual's behavior is influenced or motivated by what he or she observes to be the norm in his or her environment [6,20]. With regard to following acceptable organizational IS security rules, employees are more likely to adhere to their organization's ISSP if they notice that those around them, i.e., superiors, peers, and subordinates, are complying with such guide-
lines [6-8,19]. Past studies [7,8] found that subjective norms significantly affect ISSP
compliance in organizations.

H2: *Subjective norms related to cyber hygiene negatively affect participation in unhygienic cyber practices.*

The availability of organizational resources facilitates a target behavior such as
compliance [20]. Organizational facilitators, e.g., provision of acceptable IS use pol-
icy and the availability of IS security awareness programs, play a significant role in
shaping individual perceptions of acceptable ICT use in organizations [3,5,18]. It is
reasonable to expect that workers, in contexts where adequate organizational re-
sources exist, will have less tendency to engage in ill-sanctioned computing practices
and related acts.

H3: *Organizational facilitators negatively affect participation in unhygienic cyber practices.*

An individual's confidence in their knowledge and skills plays an important role in engaging in a target behavior [20]. With respect to compliance with acceptable IS security guidelines and rules, past studies demonstrated that employees with higher levels of skills and knowledge of IS security issues and consequences related to poor choices are less inclined to indulge in unfavorable ICT use practices [3,8]. Those with lower levels of knowledge do not readily follow IS security rules [23] and may knowingly or unknowingly engage in unhygienic cyber practices.

H4: *Self-efficacy negatively affects participation in unhygienic cyber practices.*

In accordance with OCT, management often evaluates and monitors the actions of employees to ensure compliance with desired goals and objectives [21]. If a worker believes that management does not monitor his/her computing practices (and their use of technologies at work), s/he is more likely to flout acceptable directives. D'Arcy et al. [5] found that when employees know that computer monitoring is in place, incidents of IS misuse drop significantly. Thus, it is expected that employees' participation in unhygienic cyber practices will likely be low if they know their organization monitors their ICT use practices.

H5: *Monitoring negatively affects participation in unhygienic cyber practices.*

# 5 Research Methodology

## 5.1 Study Design, Data Collection, and Subjects

To test the formulated hypotheses, a survey research methodology was adopted. A pi-
lot survey was initially conducted among 25 MBA students in a local university to en-
hance the content and face validities of the items used for the study. Questionnaires
used in the final survey were administered to working MBA students in a university
in Lagos, which is the commercial capital of Nigeria; participation was voluntary. Of
the 125 questionnaires distributed, 76 were returned; thus, the effective response rate
for the study was 60.8%. The response rate is considered adequate for a study such as
this one. Incomplete responses and poorly completed responses were excluded from
subsequent data analysis. In all, 71 responses were used for the study.
Demographic information about the respondents is presented as follows: 37 are males (52.1%) and 20 are females (28.2%); the data has missing entries. Many of them (49%) have bachelor's degrees and 25% have other master's degrees. In the sample, 42.3%, 18.3%, and 15.5% of respondents were in the 21 to 30, 31 to 40, and 41 to 50 age ranges, respectively. The participants' average years of computer use is 11.5 years (standard deviations [S.D.] = 6.8) and they have 4.6 years (S.D. = 3.4) tenure at their current organizations. Some participants noted their job titles as accountant, software engineer, system analyst, project manager, internet scammer, lecturer, and customer service manager. Forty-two (42) are IT professionals and the rest are non-IT personnel. Diverse industries such as IT, manufacturing, banking, education, and so forth were represented in the sample. The data sample included an even distribution of organization size and annual revenue.

The survey collected both independent and dependent data from the same source; this could lead to common method bias (CMB) [24]. The procedures recommended to account for the effects of CMB were followed [24]. For example, respondent anonymity was assured and questions in the survey were ordered in a randomized manner. Additionally, two post-hoc statistical analyses to further reduce concerns related to the presence of CMB were used. First, Harman's one-factor test was conducted for the reflective, independent constructs. The results showed that five factors were extracted; the first factor explained 39.8% of the variance. Second, Pavlou et al. [25] suggest that an inter-construct correlation higher than 0.9 is a possible indicator of CMB. There were no correlations in Table 2 above 0.90 to further show CMB was not a problem for our data. Both tests indicated that CMB was not problematic for the collected data.

## 5.2 Operationalization of the Constructs

Measuring items used to represent the unhygienic cyber practices construct were taken from the following sources [6,9,10,18]. The dependent construct was modeled as a formative construct because its constituting variables measure differing phenomena.

Table 1 shows the questionnaire items used for the formative construct and their descriptive statistics. The study's participants were asked the question: "Please indicate how often you participate in the listed unhygienic cyber practices listed in Table 1." Their responses were assessed on a seven-point scale ranging from "Almost never" (1) to "Almost always" (7). The four (4) measures for attitude toward cyber hygiene, which include "Following the organization's IS security policy is a good idea", were taken constructs that have been validated [8,22]. Four (4) items for the subjective norms construct were adapted from [7,8] as well with an example: "My boss thinks that I should follow the organization's IS security policy". For the four (4) measuring items used for organizational facilitators, we used items such as "My organization has established rules of behavior for use of computer resources and other digital assets"; this was modified from [5,18]. The self-efficacy construct has items adapted from Bandura [22]; items in the construct include "I have basic knowledge on how to avoid unhygienic cyber practices." Five (5) measuring items adapted from
D'Arcy et al. [5] were used to operationalize the monitoring construct. An example includes "I believe that my organization monitors its employees' cyber practices and engagements." As indicated, the measuring items used for the reflective, independent constructs have been validated in prior studies. All the items were assessed on a seven-point scale ranging from "Strongly disagree" (1) to "Strongly agree" (7).

<table><caption>**Table 1.** Questionnaire items used for the formative construct and their descriptive statistics.</caption><thead><tr><th>Item</th><th>Unhygienic cyber practices</th><th>Mean</th><th>SD</th><th>Weight</th><th>P-value</th><th>VIF</th></tr></thead><tbody><tr><td>1</td><td>Responding to spam (i.e., unsolicited emails)</td><td>3.28</td><td>2.29</td><td>+++</td><td>+++</td><td>3.879</td></tr><tr><td>2</td><td>Using weak passwords at work</td><td>3.63</td><td>1.92</td><td>+++</td><td>+++</td><td>4.014</td></tr><tr><td>3</td><td>Not updating work-related passwords regularly</td><td>3.82</td><td>2.08</td><td>0.155</td><td>0.087</td><td>2.078</td></tr><tr><td>4</td><td>Visiting non-related websites at work</td><td>4.05</td><td>1.69</td><td>0.115</td><td>0.015</td><td>1.285</td></tr><tr><td>5</td><td>Not updating anti-virus and/or anti-spyware software at work</td><td>4.15</td><td>1.96</td><td>+++</td><td>+++</td><td>4.569</td></tr><tr><td>6</td><td>Not logging out of secure systems after use</td><td>3.33</td><td>2.16</td><td>0.147</td><td>0.010</td><td>1.911</td></tr><tr><td>7</td><td>Not always treating sensitive data carefully</td><td>3.07</td><td>2.01</td><td>0.109</td><td>0.068</td><td>1.843</td></tr><tr><td>8</td><td>Allowing others (e.g., family) to play with work laptop</td><td>3.34</td><td>2.26</td><td>0.094</td><td>0.021</td><td>1.794</td></tr><tr><td>9</td><td>Downloading unauthorized software (i.e., freeware) onto work computer</td><td>3.80</td><td>2.18</td><td>0.159</td><td>0.081</td><td>1.634</td></tr><tr><td>10</td><td>Pasting or sticking computer passwords on office desks</td><td>2.85</td><td>2.57</td><td>+++</td><td>+++</td><td>4.963</td></tr><tr><td>11</td><td>Disclosing work-related passwords to others</td><td>2.95</td><td>2.38</td><td>+++</td><td>0.086</td><td>1.918</td></tr><tr><td>12</td><td>Leaving one's work laptop unattended</td><td>3.66</td><td>2.27</td><td>+++</td><td>0.081</td><td>2.016</td></tr><tr><td>13</td><td>Not backing up work files</td><td>4.38</td><td>1.81</td><td>+++</td><td>+++</td><td>3.987</td></tr><tr><td>14</td><td>Logging onto unsecure networks outside work, e.g., WIFI</td><td>4.19</td><td>1.90</td><td>0.153</td><td>0.09</td><td>1.666</td></tr><tr><td>15</td><td>Using unauthorized or personal USB at work</td><td>4.16</td><td>2.12</td><td>0.172</td><td>0.065</td><td>2.619</td></tr><tr><td>16</td><td>Storing work files in the cloud without authorization</td><td>3.51</td><td>2.25</td><td>0.163</td><td>0.075</td><td>1.648</td></tr></tbody></table>

Note: +++ represents entries excluded from final data analysis.

## 6 Data Analysis

Data analysis was done using the Partial Least Squares (PLS) technique of structural equation modeling (SEM), which is suitable for theory testing [26]. PLS supports the use of small sample sizes and does not impose data normality requirements [26,27]. WarpPLS 5.0 software was used for this study [27]. PLS supports both formative and
reflective models and recognizes two components of a causal model: the measurement and structural models.

## 6.1 Measurement Model

For the reflective constructs, item reliability, composite reliability, and convergent and discriminant validities were examined. Item loadings above 0.7 are recommended [26] in assessing item reliability. Item loadings from 0.700 to 0.933 were obtained for the study (they were not presented due to space limitations). Composite reliability higher than 0.707 for each construct is preferred [26]; results obtained in this regard are presented in Table 2 to satisfy this criterion. In addition, convergent and discriminant validities were assessed using the following criteria: (a) the average variance extracted (AVE) should be no less than 0.707 (i.e., the AVE should be above the threshold value of 0.50); (b) the square root of AVE should be larger than the correlations between that construct and all other constructs; and (c) the items should load more strongly on their respective constructs than on other constructs. This requirement for “c” was met but not included due to space consideration; however, information relating to the AVEs is provided in Table 2. All AVEs are above the recommended threshold of 0.50.

For the formative construct, i.e., unhygienic cyber practices, the presence of multicollinearity is checked and the item weights evaluated. Excessive collinearity within formative scales is problematic for a construct. To assess multicollinearity among the variables, the variance inflation factors (VIF) are checked. VIFs below the conservative cutoff of 3.33 are considered adequate [28]. Items weights show how significantly linked item indicators are to their specified constructs; weights with statistical significance are preferred [28]. Table 1 shows that VIFs and item weights used to capture the dependent variable are adequate. Namely, all VIFs are below 3.33 and the weights are significant at p <0.10 level.

<table><caption>**Table 1.** Composite Reliability, AVEs, and inter-construct correlations.</caption><thead><tr><th></th><th>COM</th><th>AVE</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th></tr></thead><tbody><tr><td>ATT</td><td>0.85</td><td>0.59</td><td><strong>0.77</strong></td><td>0.63</td><td>0.52</td><td>-0.05</td><td>0.48</td><td>0.28</td></tr><tr><td>SUB</td><td>0.87</td><td>0.62</td><td>0.63</td><td><strong>0.79</strong></td><td>0.52</td><td>-0.05</td><td>0.45</td><td>0.60</td></tr><tr><td>FAC</td><td>0.93</td><td>0.76</td><td>0.52</td><td>0.52</td><td><strong>0.87</strong></td><td>0.06</td><td>0.55</td><td>0.34</td></tr><tr><td>CYB</td><td>na</td><td>na</td><td>-0.05</td><td>-0.05</td><td>0.06</td><td>na</td><td>0.16</td><td>-0.03</td></tr><tr><td>MON</td><td>0.91</td><td>0.66</td><td>0.48</td><td>0.45</td><td>0.55</td><td>0.16</td><td><strong>0.81</strong></td><td>0.12</td></tr><tr><td>SEF</td><td>0.90</td><td>0.76</td><td>0.28</td><td>0.60</td><td>0.34</td><td>-0.03</td><td>0.12</td><td><strong>0.87</strong></td></tr></tbody></table>

Note: a) COM = composite reliability; AVE = average variance extracted; b) Off-diagonal elements are correlations among constructs; c) the bold fonts in the leading diagonals are the square root of AVEs; d) ATT = Attitude, SUB = Subjective norms, FAC = Organizational facilitators, MON = Monitoring, SEF = Self-efficacy, CYB = Unhygienic cyber practice

## 6.2 Structural ModelF

The structural model provides information about the path significance (β) of hypothesized relationships and the coefficient of determination, squared R (R²) [26].
PLS 5.0 results for the βs and the R² are shown in Figure 2 (* indicates significance at p < 0.5 level). The independent variables explained 19% of the variance in the dependent variable to show the model has significant value [26]. WarpPLS 5.0 also provides information on Goodness of Fit (GoF), which is a global fit measure that accounts for both measurement and structural model performance [29]. The GoF obtained for this study is 0.33, which is close to the cut-off value of 0.36 for large effect sizes [30].

<figure><img src="image_3.png" /><figcaption>Fig. 1. The PLS result.</figcaption></figure>

Consistent with H1, attitude toward cyber hygiene has a negative effect on participation in unhygienic cyber practices (β = -0.21, p < 0.05). H2, which predicted that subjective norms would have a negative effect on participation in unhygienic cyber practices (β = -0.12, p < 0.05), was confirmed as well. The data did not support H3; namely, organizational facilitators were not found to have a negative effect on participation in unhygienic cyber practices (β = 0.03, p = 0.41). Support was not found for H4, which predicted that self-efficacy negatively affected participation in unhygienic cyber practices (β = 0.09, p = 0.17). H5 was unconfirmed; monitoring was not found to have a negative effect on participation in unhygienic cyber practices (β = 0.28, p < 0.01). The path is statistically significant; however, the result is inconsistent with the stated prediction.

# 7 Discussions and Conclusion

The study's main objective was to examine the effects of relevant factors taken from TPB and OCT on workers' participation in unhygienic cyber practices. Our result confirmed that Nigerian workers with favorable attitudes toward cyber hygiene were more likely to shun participation in unhygienic cyber practices. This result supports prior studies [6-8] that showed individual attitudes towards end-user security practices are an important factor that modifies engagement in desired IS security behaviors. We found that the sampled Nigerian workers were more likely to avoid participation in unhygienic cyber practices if they believed significant others, i.e., colleagues in their workplaces, did not approve of such practices or acts. This finding is consistent with the espoused viewpoint indicating that group approval of safe and acceptable computing behaviors augurs well for compliance with the sanctioned organization's IS procedures and rules [6-8].

The result indicating that organizational facilitators mattered less for Nigerian workers with respect to their engagements in unhygienic cyber practices could be ex-
plained by contextual factors. The result is at odds with observations in a developed
country that indicated that organizational facilitators help to prevent employee en-
gagement in nonmalicious IS security acts [18]. It is possible that the sampled partici-
pants are employed in organizations where organizational resources are inadequate or
lacking. For example, during an informal discussion with the researchers, one partici-
pant commented that “the attention of my company is on how to increase its market
capitalization; issues like IS security is not [company X] priority.” We found no
meaningful association between Nigerian workers’ self-efficacy and participation in
unhygienic cyber practices. The result in this aspect might indicate that the sampled
workers may not believe they possess sufficient skills and knowledge to help them
deal with cyber issues or related practices. This might be discouraging given that past
studies [6-8,19] from developed countries have shown that adequate levels of skills,
capabilities, and knowledge of end-user IS security issues are pertinent for suppress-
ing involvement in ill-sanctioned computing behaviors. It is somewhat surprising that
the relationship between monitoring and the dependent construct was unsupported in
our research setting. Prior IS security studies that used monitoring found it to be an
important mechanism for shaping behavioral intentions to comply with acceptable
rules [5]. Our result shows that more monitoring seems to lead to more participation
in unhygienic cyber practices. A plausible explanation for the lack of support for H5
might be due to extraneous factors. For example, it is possible that the sampled partic-
ipants are unperturbed by IS security directives and monitoring in their organizations
or are able to circumvent such efforts through neutralization techniques [31]. To some
degree, their profession or occupation might also have an influential role. Recall most
of the study’s participants are IT professionals and four (4) of them candidly indicated
they are internet scammers. Evidence exists to show that employees likely to flout or organi-
zational IS security directives are those with more advanced IT know-how [3].

## 7.1 Contributions to Research and Implications for Practice

This study is one of the first of its kind to investigate worker's participation in unhy-
gienic cyber practices by using perspectives from TPB and OCT. No previous study
has considered the effects of the selected variables on the dependent construct with
data collected from Africa. This study offers support for the applicability of TPB and
OCT in understanding employee participation in unhygienic cyber practices in work
settings. Findings of the study lend credence to prior studies emphasizing the roles of
attitudinal beliefs and subjective norms in shaping desired behaviors. There are impli-
cations of the study's findings for practice, in particular, the management of workers
in Nigeria in relation to their discouraging participation in unhygienic cyber practices
in work environments. Management can better control workers' behaviors with re-
spect to the phenomenon by proactively providing incentives (e.g., campaigns, train-
ing) that can enhance positive attitudes towards favorable cyber hygiene practices.
Well-tailored communication could also influence attitudes toward desired behavior.

Given the importance of subjective norms in reducing employees' engagement in unhygienic cyber practices, management should ensure concerns related to acceptable cyber practices are regularly discussed at department meetings and widely situated in
the social functioning of the enterprise. Influential persons in the organization could be given the responsibility to act as “champions” of the cause of promoting good cyber hygiene practices [7]. It is likely that the amount of variance explained in the research model could increase further if more favorable organizational facilitators are made available to workers. Similarly, identifying specific measures that can enhance worker’s self-efficacy in relation to cyber practices could help produce more fruitful results. Reliance on monitoring mechanisms may not be totally effective in a context where workers possess above average ICT/IS knowledge; deterrence and sanction mechanisms may be needed to ensure compliance [4,7].

## 7.2 Study's Limitations and Future Research Directions

There are several limitations to this study. First, the data came from a cross-sectional field survey; longitudinal data may facilitate more insight. Second, the data was obtained from Nigerian workers. Findings in this preliminary study may not be applicable to workers in other parts of Africa; perceptions may vary across the continent. Third, the sample is small. Fourth, although CMB was not problematic for this study, it is still possible that participants might have provided “socially desirable responses” [24] to some of the issues being investigated. Future studies could overcome the noted shortcomings in this study. Comparative studies on the continent and elsewhere could be conducted. Attention should be paid to other end-user security behaviors such as those related to malicious acts. Other aspects of OCT, e.g., reward, could be explored. Likewise, other relevant theories in the area of IS security management [19] could be used to study the phenomenon and case studies could be used to enhance insights.

## References

1. Niebel, T.: ICT and economic growth – Comparing developing, emerging and developed countries. World Development 104, April 2018, 197-211 (2018).

2. Haftu, G.G.: Information communications technology and economic growth in Sub-Saharan Africa: A panel data approach. Telecommunications Policy, in press (2018).

3. Ifinedo, P.: Roles of organizational climate, social bonds, and perceptions of security threats on IS security policy compliance intentions. Information Resources Management Journal 31(1), 53-82 (2018).

4. Hu, Q., Xu, Z., Dinev, T. and Ling, H.: Does deterrence work in reducing information security policy abuse by employees? Communications of the ACM 54(6), 54-60 (2011).

5. D'Arcy, J. P. and Devaraj, S.: Employee misuse of information technology resources: testing a contemporary deterrence model. Decision Sciences 43(6), 1091-1124 (2012).

6. Guo, K. H., Yufei, Y., Archer, N.P. and Connelly, C.E.: Understanding nonmalicious security violations in the workplace: a composite behavior model. Journal of Management Information Systems 28(2), 203-236 (2011).

7. Ifinedo, P.: Information systems security policy compliance: an empirical study of the effects of socialisation, influence, and cognition. Information & Management 51(1), 69-79. (2014).
8. Bulgurcu, B., Cavusoglu, H. and Benbasat, I.: Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness. MIS Quarterly 34(3), 523-548 (2010).

9. Aldorisio, J., What is Cyber Hygiene? A Definition of Cyber Hygiene, Benefits, Best Practices, and More, https://digitalguardian.com/blog/what-cyber-hygiene-definition-cyber-hygiene-benefits-best-practices-and-more, last accessed Aug 20, 2018.

10. CITI, Clearswift Insider Threat Index (CITI). US Edition. http://pages.clearswift.com/rs/591-QHZ-135/images/Clearswift_Insider_Threat_Index_2015_US.pdf, last accessed Jan 7, 2017

11. Njenga, K. and Brown, I.: Conceptualising improvisation in information systems security. European Journal of Information Systems 21(6), 592-607 (2012).

12. Ifinedo, P., Longe, O. B., and Amaunam, I.: Top exemplars of non-malicious, counterproductive computer security behaviours (CCSB) engagements among employees in Nigeria: recommendations for management. In: the 8th iSTEAMS, pp. 5-12, Lagos, Nigeria (2017).

13. Longe, O., Ngwa, O., Wada, F., Mbarika, V., and Kvasny L.: Criminal uses of information & communication technologies in sub-Saharan Africa: Trends, concerns and perspectives. Journal of Information Technology Impact 9(3), 155-172 (2009).

14. Technology Times, Nigeria adopts framework for national security policy, https://technologytimes.ng/nigeria-adopts-framework-national-cyber-security-policy/, last accessed Aug 20, 2018.

15. Magklaras, G. B., and Furnell, S. M.: Insider threat prediction tool: evaluating the probability of IT misuse. Computers & Security 21(1), 62-73 (2002).

16. Loch, K. D., Carr, H. H. and Warkentin, M. E.: Threats to information systems: today's reality, yesterday's understanding. MIS Quarterly 16(2), 173-186 (1992).

17. Stanton, J.M., Stam, K.R, Mastrangelo, P. and Jolton, J.: Analysis of end user security behaviors. Computers & Security 24(2), 124-133 (2005).

18. Ifinedo, P. and Cashin, J.: Using social cognitive theory to understand employees' counterproductive computer security behaviors (CCSB): A pilot study. In: The 27th International Business Research Conference (IBRC), Toronto, Canada (2014)

19. Sommestad, T., Hallberg, J., Lundholm, K. and Bengtsson, J.: Variables influencing information security policy compliance: a systematic review of quantitative studies. Information Management and Computer Security 22(1), 42-75 (2014).

20. Ajzen, I.: The theory of planned behavior. Organizational behavior and human decision processes 50(2), 179-211 (1991).

21. Eisenhardt, K.M.: Control: Organizational and economic approaches. Management science 31(2), 134-149 (1985).

22. Bandura, A.: Social foundations of thought and action: A social cognitive theory. Prentice-Hall, Englewood Cliffs, NJ (1986).

23. Yazdanmehr, A. and Wang, J.: Employees' information security policy compliance: a norm activation perspective. Decision Support Systems, 92, 36-46 (2016).

24. Podsakoff, P. M., MacKenzie, S. B., Lee, J. Y. and Podsakoff, N. P.: Common method biases in behavioral research: a critical review of the literature and recommended remedies. Journal of Applied Psychology 88(5), 879-903 (2003).

25. Pavlou P.A., Liang H. and Xue Y.: Understanding and mitigating uncertainty in online exchange relationships: a principal-agent perspective. MIS Quarterly 31(1), 105-136 (2007).

26. Hair, J.F., Tomas, G., Hult, M., Ringle, C.M. and Sarstedt, M.: A Primer on Partial Least Squares Structural Equation Modeling (PLS-SEM). Sage, Thousand Oaks, CA (2014).

27. Kock, N.: WarpPLS 5.0 User Manual, ScriptWarp Systems, http://cits.tamiu.edu/WarpPLS/UserManual_v_5_0.pdf, last accessed February 27, 2017.
28. Petter, S., Straub, D., and Rai, A.: Specifying formative constructs in information systems research. MIS Quarterly 31(4), 623-656 (2007).

29. Tenenhaus, M., Vinzi V.E., Chatelin Y-M and Lauro, C.: PLS path modeling. Computational Statistics and Data Analysis 48(1), 159-205 (2005).

30. Wetzels, M., Odekerken-Schröder, G. and Van Oppen, C.: Using PLS path modeling for assessing hierarchical construct models: Guidelines and empirical illustration. MIS Quarterly 33(1), 177-195 (2009).

31. Siponen, M., A. and Vance, A.: Neutralization: New insights into the problem of employee information systems security policy violations. MIS Quarterly 34(3), 487-502 (2010).