# The Influence of Organizational, Social and Personal Factors on Cybersecurity Awareness and Behavior of Home Computer Users

Joëlle Simonet, Stephanie Teufel

► To cite this version:

Joëlle Simonet, Stephanie Teufel. The Influence of Organizational, Social and Personal Factors on Cybersecurity Awareness and Behavior of Home Computer Users. 34th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2019, Lisbon, Portugal. pp.194-208, 10.1007/978-3-030-22312-0_14. hal-03744309

HAL Id: hal-03744309

https://inria.hal.science/hal-03744309v1

Submitted on 2 Aug 2022

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# The Influence of Organizational, Social and Personal Factors on Cybersecurity Awareness and Behavior of Home Computer Users

Joëlle Simonet and Stephanie Teufel

international institute of management in technology (iimt),
University of Fribourg, 1700 Fribourg, Switzerland
{joelle.simonet, stephanie.teufel}@unifr.ch

**Abstract.** With the increased use of computers and network systems in a time of digitalization, the digital connectedness frames our daily life at work and at home. To ensure secure systems, all computer users should safely interact with these systems. Prior research indicates insufficient cybersecurity awareness of home computer users who are also difficult to reach as they are not necessarily part of organizational structures. This study therefore investigates organizational, social and personal determinants of an individual's cybersecurity awareness and its influence on cybersecurity behavior in the home environment, using partial least squares structural equation modeling based on survey data. The results show a low influence of the workplace and weak social influences, while the study confirms a significant effect of personal initiative and a strong effect of information systems knowledge on an individual's cybersecurity awareness. The results suggest that security strategies aimed at the general public should focus on improving the knowledge and understanding instead of making fear. The study provides valuable insights about cybersecurity awareness and its determinants contributing to the field of research. The findings can be used for reviewing cybersecurity strategies.

**Keywords:** Cybersecurity Awareness · Cybersecurity Behavior · Home Computer User

## 1 Introduction

The trends of digitalization and increased interconnectedness have reached most areas of the daily life. These trends enhance the risk of cyber threats such as cybercrime or system failure. Computer users' interactions with such systems are critical to preserving a safe cyber environment as many of them do not possess a deep understanding of computers or cyber threats [2,27,31,39]. While the management of cybersecurity has started in businesses, home users are often not aware of their responsibility [14,41]. Additionally, it demands the user's initiative to act secure [2,29]. The loosening of structures and decentralization, for example in smart grids [21] or with mobile working [7], call for safe user behavior in the home environment. Many studies have been conducted in the
work context [7,12,18,25,33,38], the home user though has not received the same attention in research. Therefore, the present study aims to understand what factors influence a user's decision making for a safe (or unsafe) cyber behavior and to grasp what sources of information impact a computer user's cybersecurity awareness in his home environment.

The next section presents the theoretical background and the research model developed. In section 3, the methodology used is presented, while the results of the analysis are listed in section 4. A discussion of the findings (section 5) and a conclusion (section 6) round off this paper.

## 2 Theoretical Background and Research Model

A home computer user can learn about cybersecurity from various sources. The workplace of a user can function as a source by providing knowledge that the user might transfer to his home environment. Many organizations distribute security policies [18,25] or provide security training and awareness programs [12,18,41] explaining the correct use and interaction with computers and systems connected to the Web covering topics such as password management or phishing. Two streams differentiate how such security measures are implemented. While some authors suggest following the deterrence approach by creating fear-based campaigns [12,22], other researchers call for skills-based measures [18,24,39]. An all-encompassing approach towards cybersecurity in organizations is the promotion of an information security culture. According to [37], an information security culture should change employees' values in order to promote an intrinsic motivation for safe cyber behavior. As an intangible concept, information security culture has an impact on security awareness [34] but is in return nurtured through awareness [11,38]. In line with this, it is assumed that policy provision, security training and an information security culture at the workplace influence the cybersecurity awareness of a home computer user. The corresponding hypotheses are:

H1a: *Information Security Policy Provision (ISPP)* in the individual's workplace is positively related to the individual's *Cybersecurity Awareness (CSA)*.

H1b: *Security Training and Awareness Programs (SETA)* in the individual's workplace is positively related to the individual's *Cybersecurity Awareness*.

H1c: *Information Security Culture (ISC)* in the individual's workplace is positively related to the individual's *Cybersecurity Awareness*.

More informal determinants of a user's cybersecurity awareness can be found in the social environment of a home computer user. Especially since consequences of cybersecurity incidents are not always visible directly or at anytime, stories told by friends and family can act as vicarious examples and enhance a social learning process for cybersecurity issues [5,23,31].
International guidelines such as from the OECD [30] or national cybersecurity strategies target the society and thus include home computer users. It remains difficult though to reach out to those who are in loosely coupled structures [43]. Information provided by the public administration or reports distributed by the mass media can highlight the importance of cybersecurity and deliver security advice [18,29,31].

H2a: *Family and Friends Influence (FFI)* is positively related to the individual's *Cybersecurity Awareness*.

H2b: *Mass Media Influence (MMI)* is positively related to the individual's *Cybersecurity Awareness*.

H2c: *Public Administration Information (PAI)* is positively related to the individual's *Cybersecurity Awareness*.

Compared to the work environment, a home user is required to be self-initiative to learn about cybersecurity topics and take security-enhancing actions [2,29,39]. Being someone generally showing personal initiative is thus assumed to have a positive effect on awareness. In this context, having previous information systems knowledge is expected to be a strong determinant of cybersecurity awareness [14,18,31].

H3a: *Personal Initiative (PI)* is positively related to the individual's *Cybersecurity Awareness*.

H3b: *Information Systems Knowledge (ISK)* is positively related to the individual's *Cybersecurity Awareness*.

Understanding an individual's behavior or the factors influencing a decision to act are hard to grasp. Behavioral models such as the *Theory of Planned Behavior* [1] or the *Protection Motivation Theory* [35,36] have been developed to investigate the cognitive processes involved. In the *Protection Motivation Theory*, the threat appraisal and the coping appraisal represent the two sides of the mediating process of an individual's intention to protect something (or someone) from a threat [36,44]. Originally used for investigating health-related fears, the components of the model have been used to study cybersecurity fears many times [2,17,28,39,45]. Perceived vulnerability and perceived severity are elements of the threat appraisal, while perceived self-efficacy, perceived response efficacy and perceived costs constitute the coping appraisal. In the context of cybersecurity, the elements represent the understanding of a threat and the mental process an individual goes through before deciding to behave securely or not and therefore represent the construct of cybersecurity awareness (H5a-e).

H4: *Cybersecurity Awareness* is positively related to the individuals *Cybersecurity Behavior (CSB)*.

Figure 1 shows the research model summarizing the organizational, social and personal determinants, the multi-dimensional construct of cybersecurity awareness and cybersecurity behavior (for details, see [40]).
<figure><img src="image_3.png" /><figcaption>Fig. 1. Research Model</figcaption></figure>

## 3 Methodology

This study draws on common methods in the domain of cybersecurity awareness and behavior research [2,18,29,39]. For the data collection, a survey was conducted, while the data analysis was performed with partial least squares structural equation modeling. Details about the analysis are given in section 4.

The data collection process encompassed a self-report online questionnaire that was implemented via SoSci Survey, a Germany-based web tool for conducting online questionnaires [26]. Although using self-reported data can provoke a social desirability bias [8,9], it allows to capture the respondents’ cognitive process [4] which was essential for this study. By allowing an anonymous completion of the questionnaire for which the respondent was not required to leave his familiar environment, the risk for social desirability bias was reduced [8].

The survey was sent out to employees of various organizations in Switzerland. This mode of distribution was chosen to ensure that participants work, which was necessary for being able to investigate the influence of the workplace. Organizations contacted are located in the French-, German- and Italian-speaking parts of Switzerland and are active in areas such as educational, health and social, IT-related businesses or public transport. The questionnaire was made available in German, English and French.

After a data collection of about five weeks, a total number of 562 participants started the questionnaire. Removing the unfinished cases and the records with more than 15% of missing data, suspicious response patterns and outliers
as suggested by [16] results in 456 cases used for further analysis. Mean-value replacement is applied for the remaining missing data. Table 1 shows some demographic characteristics of the participants. A more detailed discussion of the sample can be found in [40].

<table><caption>**Table 1.** Demographic Characteristics of the Participants</caption><thead><tr><th>Demographics</th><th>n</th><th>%</th><th></th><th>n</th><th>%</th></tr></thead><tbody><tr><td><strong>Sex</strong></td><td></td><td></td><td><em>Total</em></td><td>456</td><td>100</td></tr><tr><td>Female</td><td>224</td><td>49.1</td><td></td><td></td><td></td></tr><tr><td>Male</td><td>227</td><td>49.8</td><td></td><td></td><td></td></tr><tr><td><strong>Age</strong></td><td></td><td></td><td><strong>Linguistic Region</strong></td><td></td><td></td></tr><tr><td>under 18</td><td>5</td><td>1.1</td><td>German-speaking</td><td>116</td><td>25.4</td></tr><tr><td>18-24</td><td>34</td><td>7.5</td><td>French-speaking</td><td>327</td><td>71.7</td></tr><tr><td>25-34</td><td>131</td><td>28.7</td><td>Italian-speaking</td><td>6</td><td>1.3</td></tr><tr><td>35-44</td><td>101</td><td>22.1</td><td>other / not CH</td><td>7</td><td>1.5</td></tr><tr><td>45-54</td><td>109</td><td>23.9</td><td><strong>Sector</strong></td><td></td><td></td></tr><tr><td>55-64</td><td>72</td><td>15.8</td><td>Public Sector</td><td>410</td><td>89.9</td></tr><tr><td>over 64</td><td>3</td><td>0.7</td><td>Private Sector</td><td>25</td><td>5.5</td></tr><tr><td></td><td></td><td></td><td>Voluntary Sector</td><td>15</td><td>3.3</td></tr></tbody></table>

The survey is organized in eight sections covering the personal, social and organizational determinants, the variables constituting cybersecurity awareness, the construct of cybersecurity behavior as well as additional demographic questions such as age, gender or language region. This results in a total number of 53 items, all constructed as closed questions, corresponding to statements to which respondents indicate their level of agreement on a 5-point Likert scale. For three items, different minimum and maximum values are used.

The measures for the fourteen constructs are all adapted from previously validated constructs. A pretest was conducted to ensure the comprehensibility of the questionnaire. Some items were reworded and others exchanged before being subject of a second pretest. A general approach on cybersecurity actions was chosen to get an all-encompassing point of view and to avoid technology dependency and thus facilitate the repeatability of the study.

*Information Security Culture, Friends and Family Influence, Information Systems Knowledge* are considered reflective. The remaining constructs, *Information Security Policy Provision, Security Training and Awareness Programs, Mass Media Influence, Public Administration Information, Personal Initiative* as well as *Cybersecurity Behavior* are considered formative. *Cybersecurity Awareness* is constructed as a reflective-formative second-order construct composed of the first-order constructs *Perceived Vulnerability, Perceived Severity, Perceived Self-Efficacy, Perceived Response Efficacy* and *Perceived Costs*. All constructs and the corresponding items in their final version can be found in Table 5 in the Appendix.
# 4 Analysis and Results

The model was analyzed with partial least squares structural equation modeling using the software SmartPLS 3.2.5 [32]. The analysis encompasses a first step of assessing the measurement models and a second step of evaluating the structural model. The analysis was conducted by following the guidelines proposed by [15] and [16]. For significance testing, 5000 bootstrap samples were used. Additionally, a mediation analysis was performed to investigate the awareness' mediating role.

## 4.1 Measurement Model Assessment

The proposed research model includes formative and reflective constructs, which require a different assessment. For reflective constructs, internal consistency and indicator reliability and the average variance extracted (AVE) are used to verify convergent validity. A composite reliability (CR) value between 0.7 and 0.9 indicates internal consistency reliability, higher values suggest high item similarity [16]. For the AVE, values above 0.5 are desired. Indicator reliability is assessed with the outer loading (OL) of the items, which indicate the strength of the path and should exhibit values above 0.7. Items with an outer loading between 0.4 and 0.7 can be kept in the model, while indicators with a lower loading should be removed [16]. All values are in the accepted ranges, except for *Information Systems Knowledge* that exhibits values above the desired values (see Table 2). Discriminant validity is assessed with the HTMT criterion as suggested by [15,19]. As all values are below 0.85, discriminant validity is established between all latent variables (see Table 3).

Formative constructs are assessed by looking at the variance inflation factor (VIF) for collinearity issues and the relative importance of each indicator. VIF values should be below five for all indicators. The items should exhibit significant outer weight or, if not, manifest outer loadings above 0.5. Indicators should be removed if neither the outer loading nor the outer weight is significant. The values are shown in Table 2. The items MMI3 and PAI3 were removed for further analyses. The reflective-formative second-order construct *Cybersecurity Awareness* is evaluated in the same manner.

## 4.2 Structural Model Assessment

The structural model should exhibit no collinearity issues, indicated with VIF values below five, which is the case for all latent variables in the model. Estimated path coefficients that take on values between -1 and +1 indicate positive and negative effects one latent construct has on another. In the proposed model, except for the paths from *Information Security Culture* and *Security Training and Awareness Programs* to *Cybersecurity Awareness*, all coefficients are significant but exhibit great differences in strength. *Information Systems Knowledge* has the strongest effect on *Cybersecurity Awareness*, while the other exogenous variables show low to moderate effects (see Figure 2). The path coefficient from
<table><caption>Table 2. Reflective and Formative Constructs</caption><thead><tr><th colspan="4">Reflective</th><th colspan="8">Formative</th></tr><tr><th rowspan="2">Item</th><th rowspan="2">OL<br>l</th><th rowspan="2">CR</th><th rowspan="2">AVE</th><th rowspan="2">Item</th><th rowspan="2">VIF</th><th colspan="3">Outer</th><th colspan="3">Weight</th><th colspan="3">Outer Loading</th></tr><tr><th>w</th><th>t</th><th>p</th><th>l</th><th>t</th><th>p</th></tr></thead><tbody><tr><td>ISC1</td><td>0.728</td><td>0.799</td><td>0.507</td><td>ISPP1</td><td>2.187</td><td>0.258</td><td>1.288</td><td>0.198</td><td>0.843*</td><td>8.413</td><td>0.000</td><td></td><td></td></tr><tr><td>ISC2</td><td>0.476</td><td></td><td></td><td>ISPP2</td><td>2.187</td><td>0.794*</td><td>3.586</td><td>0.000</td><td>0.985*</td><td>26.356</td><td>0.000</td><td></td><td></td></tr><tr><td>ISC3</td><td>0.77</td><td></td><td></td><td>SETA1</td><td>1.871</td><td>0.722*</td><td>2.081</td><td>0.037</td><td>0.965*</td><td>7.834</td><td>0.000</td><td></td><td></td></tr><tr><td>ISC4</td><td>0.825</td><td></td><td></td><td>SETA2</td><td>1.871</td><td>0.356</td><td>1.154</td><td>0.249</td><td>0.849*</td><td>4.508</td><td>0.000</td><td></td><td></td></tr><tr><td>FFI1</td><td>0.758</td><td>0.895</td><td>0.682</td><td>MMI1</td><td>1.503</td><td>0.344</td><td>1.278</td><td>0.201</td><td>0.732*</td><td>3.337</td><td>0.001</td><td></td><td></td></tr><tr><td>FFI2</td><td>0.853</td><td></td><td></td><td>MMI2</td><td>1.791</td><td>0.885*</td><td>2.786</td><td>0.005</td><td>0.863*</td><td>4.706</td><td>0.000</td><td></td><td></td></tr><tr><td>FFI3</td><td>0.821</td><td></td><td></td><td>MMI3<sup>r</sup></td><td>1.280</td><td>-0.471</td><td>1.889</td><td>0.059</td><td>0.033</td><td>0.201</td><td>0.841</td><td></td><td></td></tr><tr><td>FFI4</td><td>0.867</td><td></td><td></td><td>PAI1</td><td>1.752</td><td>0.914*</td><td>4.790</td><td>0.000</td><td>0.976*</td><td>18.604</td><td>0.000</td><td></td><td></td></tr><tr><td>ISK1</td><td>0.954</td><td>0.955</td><td>0.914</td><td>PAI2</td><td>2.230</td><td>0.202</td><td>0.992</td><td>0.321</td><td>0.665*</td><td>4.350</td><td>0.000</td><td></td><td></td></tr><tr><td>ISK2</td><td>0.957</td><td></td><td></td><td>PAI3<sup>r</sup></td><td>1.390</td><td>-0.251</td><td>1.555</td><td>0.120</td><td>0.105</td><td>0.883</td><td>0.377</td><td></td><td></td></tr><tr><td>PV1</td><td>0.83</td><td>0.874</td><td>0.698</td><td>PI1</td><td>1.826</td><td>0.353*</td><td>2.040</td><td>0.041</td><td>0.782*</td><td>8.640</td><td>0.000</td><td></td><td></td></tr><tr><td>PV2</td><td>0.833</td><td></td><td></td><td>PI2</td><td>1.891</td><td>0.538*</td><td>2.866</td><td>0.004</td><td>0.833*</td><td>10.476</td><td>0.000</td><td></td><td></td></tr><tr><td>PV3</td><td>0.844</td><td></td><td></td><td>PI3</td><td>1.629</td><td>0.460*</td><td>2.798</td><td>0.005</td><td>0.775*</td><td>8.175</td><td>0.000</td><td></td><td></td></tr><tr><td>PS1</td><td>0.708</td><td>0.864</td><td>0.682</td><td>PI4</td><td>1.366</td><td>-0.376*</td><td>2.487</td><td>0.013</td><td>0.214</td><td>1.696</td><td>0.090</td><td></td><td></td></tr><tr><td>PS2</td><td>0.929</td><td></td><td></td><td>PV</td><td>1.069</td><td>-0.007</td><td>0.243</td><td>0.808</td><td>-0.136*</td><td>2.034</td><td>0.042</td><td></td><td></td></tr><tr><td>PS3</td><td>0.825</td><td></td><td></td><td>PS</td><td>1.060</td><td>0.047</td><td>1.155</td><td>0.248</td><td>0.161*</td><td>2.217</td><td>0.027</td><td></td><td></td></tr><tr><td>PSE1</td><td>0.817</td><td>0.899</td><td>0.691</td><td>PSE</td><td>1.645</td><td>0.747*</td><td>12.019</td><td>0.000</td><td>0.952*</td><td>49.290</td><td>0.000</td><td></td><td></td></tr><tr><td>PSE2</td><td>0.833</td><td></td><td></td><td>PRE</td><td>1.305</td><td>0.310*</td><td>5.053</td><td>0.000</td><td>0.674</td><td>12.690</td><td>0.000</td><td></td><td></td></tr><tr><td>PSE3</td><td>0.852</td><td></td><td></td><td>PC</td><td>1.355</td><td>-0.125*</td><td>2.063</td><td>0.039</td><td>-0.570</td><td>10.116</td><td>0.000</td><td></td><td></td></tr><tr><td>PSE4</td><td>0.822</td><td></td><td></td><td>CSB1</td><td>1.312</td><td>0.225*</td><td>3.003</td><td>0.003</td><td>0.564*</td><td>7.955</td><td>0.000</td><td></td><td></td></tr><tr><td>PRE1</td><td>0.566</td><td>0.825</td><td>0.546</td><td>CSB2</td><td>1.396</td><td>0.207*</td><td>2.780</td><td>0.005</td><td>0.594*</td><td>9.237</td><td>0.000</td><td></td><td></td></tr><tr><td>PRE2</td><td>0.742</td><td></td><td></td><td>CSB3</td><td>1.310</td><td>0.507*</td><td>7.453</td><td>0.000</td><td>0.811*</td><td>19.250</td><td>0.000</td><td></td><td></td></tr><tr><td>PRE3</td><td>0.819</td><td></td><td></td><td>CSB4</td><td>1.373</td><td>0.160*</td><td>2.091</td><td>0.037</td><td>0.595*</td><td>9.044</td><td>0.000</td><td></td><td></td></tr><tr><td>PRE4</td><td>0.801</td><td></td><td></td><td>CSB5</td><td>1.137</td><td>0.070</td><td>1.246</td><td>0.213</td><td>0.257*</td><td>3.041</td><td>0.002</td><td></td><td></td></tr><tr><td>PC1</td><td>0.808</td><td>0.898</td><td>0.689</td><td>CSB6</td><td>1.108</td><td>0.019</td><td>0.458</td><td>0.647</td><td>0.217*</td><td>2.987</td><td>0.003</td><td></td><td></td></tr><tr><td>PC2</td><td>0.846</td><td></td><td></td><td>CSB7</td><td>1.063</td><td>0.104</td><td>1.645</td><td>0.100</td><td>0.214*</td><td>2.618</td><td>0.009</td><td></td><td></td></tr><tr><td>PC3</td><td>0.894</td><td></td><td></td><td>CSB8</td><td>1.275</td><td>0.249*</td><td>3.254</td><td>0.001</td><td>0.62*</td><td>9.484</td><td>0.000</td><td></td><td></td></tr><tr><td>PC4</td><td>0.768</td><td></td><td></td><td>CSB9</td><td>1.124</td><td>0.136*</td><td>2.079</td><td>0.038</td><td>0.329*</td><td>4.392</td><td>0.000</td><td></td><td></td></tr></tbody></table>

Notes: w = weight, l = loading, t = t-value, p = p-value; ,* p < 0.5, r excluded item

Cybersecurity Awareness to Cybersecurity Behavior exhibits a moderate effect. The R² values for Cybersecurity Awareness and Cybersecurity Behavior indicate moderate explanation of the endogenous variables through the exogenous constructs. By performing multi-group analyses (PLS-MGA [20]), differences for users of different gender or language groups can be found. While women are influenced by Mass Media but not by Public Administration Information, it is the other way around for men (men: P<sub>PAI-&gt;CSA</sub> = 0.159, p = 0.008, P<sub>MMI-&gt;CSA</sub> = 0.003, p = 0.467; women: P<sub>PAI-&gt;CSA</sub> = -0.005, p = 0.44, P<sub>MMI-&gt;CSA</sub> = 0.171, p = 0.004). When comparing the German- and French-speaking people's influences, the German-speaking are influenced by Security Training and Awareness Programs and Public Administration Information, while the French-speaking are not influenced (DE: P<sub>PAI-&gt;CSA</sub> = 0.180, p = 0.008; FR: P<sub>PAI-&gt;CSA</sub> = 0.030, p = 0.228; DE: P<sub>SETA-&gt;CSA</sub> = 0.142, p = 0.041; FR: P<sub>SETA-&gt;CSA</sub> = -0.072, p =
<table><caption>**Table 3.** Discriminant Validity - HTMT criterion</caption><thead><tr><th></th><th>FFI</th><th>ISC</th><th>ISK</th><th>PC</th><th>PRE</th><th>PS</th><th>PV</th><th>PSE</th></tr></thead><tbody><tr><th>FFI</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ISC</th><td>0.387</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ISK</th><td>0.118</td><td>0.079</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>PC</th><td>0.179</td><td>0.104</td><td>0.313</td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>PRE</th><td>0.342</td><td>0.326</td><td>0.338</td><td>0.246</td><td></td><td></td><td></td><td></td></tr><tr><th>PS</th><td>0.191</td><td>0.214</td><td>0.05</td><td>0.067</td><td>0.271</td><td></td><td></td><td></td></tr><tr><th>PV</th><td>0.054</td><td>0.064</td><td>0.123</td><td>0.163</td><td>0.099</td><td>0.175</td><td></td><td></td></tr><tr><th>PSE</th><td>0.265</td><td>0.228</td><td>0.671</td><td>0.593</td><td>0.538</td><td>0.104</td><td>0.198</td><td></td></tr></tbody></table>

0.057). Moreover, the awareness of people who have experienced a cybersecurity incident in the past year (NEX) is significantly influenced by *Mass Media Influence*, whereas people with no bad experiences are not influenced (NEX: $P_{MMI->CSA} = 0.200$, $p = 0.010$; no NEX: $P_{MMI->CSA} = 0.016$, $p = 0.445$).

## 4.3 Mediation Analysis

In order to evaluate the role of cybersecurity awareness as a mediator between the determinants and cybersecurity behavior, a mediation analysis was performed following the guidelines proposed by [46]. The evaluation includes looking at direct and indirect effects from the exogenous variables to the endogenous variable. Table 4 shows the results of the analysis. The results suggest *Cybersecurity Awareness* is only a full or partial mediator for *Information Security Policy Provision, Friends and Family Influence, Personal Initiative* and *Information Systems Knowledge*, while other variables only have a direct (SETA, *MMI*) or no effect (ISC, *PAI*) on *Cybersecurity Behavior*.

<table><caption>**Table 4.** Mediation Analysis</caption><thead><tr><th rowspan="2">Path</th><th colspan="3">Indirect Path Coeff.</th><th colspan="3">Direct Path Coeff.</th><th rowspan="2">Mediation</th></tr><tr><th>P</th><th>t</th><th>p</th><th>P</th><th>t</th><th>p</th></tr></thead><tbody><tr><td>ISSP -&gt;CSB</td><td>0.063*</td><td>2.979</td><td>0.001</td><td>0.002</td><td>0.053</td><td>0.479</td><td>Full Mediation</td></tr><tr><td>SETA -&gt;CSB</td><td>-0.005</td><td>0.394</td><td>0.347</td><td>0.117*</td><td>2.346</td><td>0.009</td><td>No Mediation, Direct-Only</td></tr><tr><td>ISC -&gt;CSB</td><td>0.021</td><td>1.310</td><td>0.095</td><td>-0.033</td><td>0.892</td><td>0.186</td><td>No Mediation, No Effect</td></tr><tr><td>FFI -&gt;CSB</td><td>0.056*</td><td>2.796</td><td>0.003</td><td>0.059</td><td>1.432</td><td>0.076</td><td>Full Mediation</td></tr><tr><td>MMI -&gt;CSB</td><td>0.031</td><td>1.595</td><td>0.055</td><td>-0.074*</td><td>1.720</td><td>0.043</td><td>No Mediation, Direct-Only</td></tr><tr><td>PAI -&gt;CSB</td><td>0.026</td><td>1.591</td><td>0.056</td><td>0.027</td><td>0.815</td><td>0.208</td><td>No Mediation, No Effect</td></tr><tr><td>PI -&gt;CSB</td><td>0.042*</td><td>2.232</td><td>0.013</td><td>0.142*</td><td>2.892</td><td>0.002</td><td>Partial Mediation</td></tr><tr><td>ISK -&gt;CSB</td><td>0.205*</td><td>6.778</td><td>0.000</td><td>0.208*</td><td>3.962</td><td>0.000</td><td>Partial Mediation</td></tr></tbody></table>

Notes: P = Path coefficient, t = t-value, p = p-value; * p < 0.5
<figure><img src="image_4.png" /><figcaption>Fig. 2. Results - Structural Model Evaluation</figcaption></figure>

# 5 Discussion and Implications

The results of this study show diverse levels of impact of organizational, social and personal determinants on a user's cybersecurity awareness in his home environment. The main findings are:

- Weak influence of the workplace

- Weak to moderate social influences

- Personal initiative has a significant effect

- Strongest effect of information systems knowledge

- No significant contribution of threat appraisal to cybersecurity awareness

The limited workplace effects are in line with other studies [31,39]. It is not evident if security training and the information security culture are prevalent but not transferrable to the home environment or if they cannot be found. Mass media and public administration information exhibit disparate effects for men and women and for people who have experienced cybersecurity incidents in the past year. People from the different language groups react differently to various sources of information, emphasizing a potential cultural gap in how cybersecurity topics are handled and perceived in different cultural regions. The strong influence of information systems skills as well as the fact that the threat appraisal does not significantly contribute to cybersecurity awareness highlight the
need for campaigns focusing in improving skills and understanding, confirming results of similar studies [17,39,45].

As with other studies, there are some limitations. The study relies on self-report data, which might contain a social desirability bias [10]. Additionally, the PLS-SEM method allows no goodness-of-fit measure for evaluating the fit of the model and the path estimation contains a measurement error resulting in a bias [16]. Although the sample exhibits a good balance of gender and age, works in diverse job areas, most participants work in the public sector. The influence of the workplace could be different in the private or voluntary sector.

While this study kept a generalized approach on most variables to ensure a holistic view, different types of mass media or the form of security information provided at the workplace should also be researched individually as they might lead to distinct user reactions as shown in [29,39]. Moreover, in order to create individualized and adapted campaigns, cultural differences should be investigated more closely. Considering the high potential in reaching broad masses of people, future research should investigate the reasons that inhibit a transfer of work-provided cybersecurity information to the private environment.

## 6 Conclusion

The human interaction with computer systems becomes increasingly important considering current trends in digitalization. This study investigates organizational, social and personal determinants of a home computer user's cybersecurity awareness and the factors impacting behavior. By providing valuable insights about cybersecurity awareness and behavior creation, the study contributes to research in the field of cybersecurity behavior and can act as a support for security practitioners while reviewing security strategies.

## Appendix

<table><caption>Table 5: Overview Survey Measures</caption><tr><td><strong>Information Security Policy Provision (ISPP)</strong><br>ISPP1: Information security policies are written in a manner that is clear and understandable.<br>ISPP2: Information security policies are readily available for my reference.</td><td>[18]</td></tr><tr><td><strong>Security Training and Awareness Programs (SETA)</strong><br>SETA1: My organization provides training to help employees improve their assessment and knowledge of computer and information security issues.<br>SETA2: My organization educates employees on their computer security responsibilities.</td><td>[12,18]</td></tr><tr><td><strong>Information Security Culture (ISC)</strong><br>ISC1: My colleagues and I would warn each other if we saw one of us taking risks (e.g. insecure use of email, downloading malicious software, or risky password practices).<br>ISC2: I have a good relationship with my colleagues and other members of my organization.<br>ISC3: My organization takes the view that information security is a collective responsibility.<br>ISC4: My colleagues and I have the same ambitions and visions in terms of protecting our information assets from cyber threats (e.g. unauthorized access to information assets, becoming infected with malicious software).</td><td>[34]</td></tr><tr><td><strong>Family and Friends Influence (FFI)</strong><br>FFI1: My family members would approve of me practicing a safe cyber behavior.<br>FFI2: My family members expect me to practice a safe cyber behavior.</td><td>[29,42]</td></tr></table>
<table><tr><td>FFI3: My friends would approve of me practicing a safe cyber behavior.</td><td></td></tr><tr><td>FFI4: My friends expect me to practice a safe cyber behavior.</td><td></td></tr><tr><td><strong>Mass Media Influence (MMI)</strong><br>MMI1: The mass media suggest that I should practice a safe cyber behavior.</td><td>[29]</td></tr><tr><td>MMI2: Mass media reports influence me to practice a safe cyber behavior.</td><td></td></tr><tr><td>MMI3: I feel under pressure from the mass media to practice a safe cyber behavior.</td><td></td></tr><tr><td><strong>Public Administration Information (PAI)</strong><br>PAI1: The public administration suggests that I should practice a safe cyber behavior.</td><td>[6,29]</td></tr><tr><td>PAI2: The public administration influences me to practice a safe cyber behavior.</td><td></td></tr><tr><td>PAI3: I feel under pressure from the public administration to practice a safe cyber behavior.</td><td></td></tr><tr><td><strong>Personal Initiative (PI)</strong><br>PI1: In general, I actively attack problems (of any kind).</td><td>[13]</td></tr><tr><td>PI2: Whenever something goes wrong, I search for a solution immediately.</td><td></td></tr><tr><td>PI3: I take initiative immediately when others don't.</td><td></td></tr><tr><td>PI4: Usually I do more than I am asked to.</td><td></td></tr><tr><td><strong>Information Systems Knowledge (ISK)</strong><br>ISK1: What is your general knowledge of computers?</td><td>[18]</td></tr><tr><td>ISK2: What is your general knowledge of the Internet (e.g. Web, email systems)?</td><td></td></tr><tr><td><strong>Perceived Vulnerability (PV)</strong><br>PV1: I believe that I am at risk of becoming a victim of a cyber security incident (e.g. phishing, malware).</td><td>[9,17]</td></tr><tr><td>PV2: I believe that it is likely that I will become a victim of a cyber security incident (e.g. phishing, malware).</td><td></td></tr><tr><td>PV3: I believe that it is possible that I will become a victim of a cyber security incident (e.g. phishing, malware).</td><td></td></tr><tr><td><strong>Perceived Severity (PS)</strong><br>PS1: Having my computer infected by a virus as a result of opening a suspicious email attachment is a serious problem for me.</td><td>[3,28]</td></tr><tr><td>PS2: Having my confidential information accessed by someone without my consent or knowledge is a serious problem for me.</td><td></td></tr><tr><td>PS3: Loss of data resulting from hacking is a serious problem for me.</td><td></td></tr><tr><td><strong>Perceived Response Efficacy (PRE)</strong><br>PRE1: I believe that protective software would be useful for detecting and removing malware.</td><td>[17,39]</td></tr><tr><td>PRE2: I believe that having passwords that are hard to guess and different for each of my accounts will help improve my security protection.</td><td></td></tr><tr><td>PRE3: I believe that keeping my operating systems and software updated will help improve my security protections.</td><td></td></tr><tr><td>PRE4: I believe that following online safety practices will help protecting me from online safety threats.</td><td></td></tr><tr><td><strong>Perceived Costs (PC)</strong><br>PC1: Practicing safe cyber behavior is inconvenient.</td><td>[28,45]</td></tr><tr><td>PC2: Practicing safe cyber behavior is time-consuming.</td><td></td></tr><tr><td>PC3: Practicing safe cyber behavior would require considerable investment of effort other than time.</td><td></td></tr><tr><td>PC4: Practicing safe cyber behavior would require starting a new habit, which is difficult.</td><td></td></tr><tr><td><strong>Perceived Self-Efficacy (PSE)</strong><br>PSE1: I feel comfortable practicing safe cyber security behavior.</td><td>[39,42]</td></tr><tr><td>PSE2: Practicing safe cyber security behavior is entirely under my control.</td><td></td></tr><tr><td>PSE3: I have the resources and knowledge to practice safe cyber security behavior.</td><td></td></tr><tr><td>PSE4: Practicing safe cyber security behavior is easy.</td><td></td></tr><tr><td><strong>Cybersecurity Behavior (CSB)</strong><br>CSB1: I use different passwords for my different online accounts (e.g., social media, online banking).</td><td>[3,28]</td></tr><tr><td>CSB2: I usually review privacy/security settings on my online accounts (e.g., social media, online banking).</td><td></td></tr><tr><td>CSB3: I keep the software and operating system on my computer up-to-date.</td><td></td></tr><tr><td>CSB4: I watch for unusual computer behaviors/responses (e.g., computer slowing down or freezing, pop-up windows, etc.).</td><td></td></tr><tr><td>CSB5: I do not open email attachments from people whom I do not know.</td><td></td></tr><tr><td>CSB6: I have never sent sensitive information (such as account numbers, passwords, social security number, etc.) via email or using social media.</td><td></td></tr><tr><td>CSB7: I make backups of important files on my computer.</td><td></td></tr><tr><td>CSB8: I always respond to any malware alerts that I receive.</td><td></td></tr><tr><td>CSB9: I do not click on short URLs unless I know where the links will really take me.</td><td></td></tr></table>
References

1. Ajzen, I.: From intentions to actions: A theory of planned behavior. In: Kuhl, J., Beckmann, J. (eds.) Action Control: From Cognition to Behavior, pp. 11–39. Springer, Berlin, Heidelberg (1985). https://doi.org/10.1007/978-3-642-69746-3_2

2. Anderson, C.L., Agarwal, R.: Practicing safe computing: A multimedia empirical examination of home computer user security behavioral intentions. MIS Quarterly 34(3), 613–643 (Sep 2010). https://doi.org/10.2307/25750694

3. Anwar, M., He, W., Ash, I., Yuan, X., Li, L., Xu, L.: Gender difference and employees' cybersecurity behaviors. Computers in Human Behavior 69, 437 – 443 (2017). https://doi.org/10.1016/j.chb.2016.12.040

4. Baldwin, W.: Information no one else knows: The value of self-report. In: Stone, A., Bachrach, C., Jobe, J., Kurtzman, H., Cain, V. (eds.) The science of self-report, pp. 15–20. Psychology Press, Mahwah, NJ, 1 edn. (1999)

5. Bandura, A.: Social learning theory. General Learning Press, New York, NY (1971)

6. Belanche Gracia, D., Casaló Ariño, L., Flavián Blanco, C.: Understanding the influence of social information sources on e-government adoption. Information Research 17(3) (2012)

7. Blythe, J.: Cyber security in the workplace: Understanding and promoting behaviour change. Proc. of CHItaly 2013 Doctoral Consortium 1065, 92–101 (2013)

8. Bortz, J., Döring, N.: Forschungsmethoden und Evaluation für Human- und Sozialwissenschaftler. Springer, Berlin, Heidelberg, 4th ed. edn. (2006). https://doi.org/10.1007/978-3-540-33306-7

9. Crossler, R.E.: Protection motivation theory: Understanding determinants to backing up personal data. In: System Sciences (HICSS), 2010 43rd Hawaii International Conference on. pp. 1–10. IEEE (Jan 2010). https://doi.org/10.1109/HICSS.2010.311

10. Crossler, R.E., Johnston, A.C., Lowry, P.B., Hu, Q., Warkentin, M., Baskerville, R.: Future directions for behavioral information security research. Computers & Security 32, 90 – 101 (2013). https://doi.org/10.1016/j.cose.2012.09.010, http://www.sciencedirect.com/science/article/pii/S0167404812001460

11. Da Veiga, A., Eloff, J.H.: A framework and assessment instrument for information security culture. Computers & Security 29(2), 196–207 (2010). https://doi.org/10.1016/j.cose.2009.09.002

12. D'Arcy, J., Hovav, A., Galletta, D.: User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach. Information Systems Research 20(1), 79–98 (03 2009). https://doi.org/10.1287/isre.1070.0160

13. Frese, M., Fay, D., Hilburger, T., Leng, K., Tag, A.: The concept of personal initiative: Operationalization, reliability and validity in two German samples. Journal of Occupational and Organizational Psychology 70(2), 139–161 (1997). https://doi.org/10.1111/j.2044-8325.1997.tb00639.x

14. Furnell, S., Bryant, P., Phippen, A.: Assessing the security perceptions of personal internet users. Computers & Security 26(5), 410 – 417 (2007). https://doi.org/10.1016/j.cose.2007.03.001

15. Hair, J., Hollingsworth, C.L., Randolph, A.B., Chong, A.Y.L.: An updated and expanded assessment of PLS-SEM in information systems research. Industrial Management & Data Systems 117(3), 442–458 (2017). https://doi.org/10.1108/IMDS-04-2016-0130

16. Hair, J.F., Hult, T., Ringle, C., Sarstedt, M.: A Primer on Partial Least Squares Structural Equation Modeling. Sage, Thousand Oaks, CA, 2 edn. (2017)
17. Hanus, B., Wu, Y.A.: Impact of users' security awareness on desktop security behavior: A protection motivation theory perspective. Information Systems Management **33**(1), 2–16 (2016). https://doi.org/10.1080/10580530.2015.1117842

18. Häussinger, F.J., Kranz, J.J.: Information security awareness: Its antecedents and mediating effects on security compliant behavior. International Conference on Information Systems (ICIS) 2013 (2013)

19. Henseler, J., Ringle, C.M., Sarstedt, M.: A new criterion for assessing discriminant validity in variance-based structural equation modeling. Journal of the Academy of Marketing Science **43**(1), 115–135 (2015). https://doi.org/10.1007/s11747-014-0403-8

20. Henseler, J., Ringle, C.M., Sinkovics, R.R.: The use of partial least squares path modeling in international marketing. In: Sinkovics, R.R., Ghauri, P.N. (eds.) New challenges to international marketing, vol. 20, pp. 277–319. Emerald Group Publishing Limited (2009). https://doi.org/10.1108/S1474-7979(2009)0000020014

21. Hertig, Y., Teufel, S.: Prosumer communities: Electricity as an interpersonal construct. In: Smart Grid and Clean Energy Technologies (ICSGCE), 2016 International Conference on. pp. 89–94. IEEE (2016). https://doi.org/10.1109/ICSGCE.2016.7876032

22. Hickmann Klein, R., Mezzomo Luciano, E.: What influences information security behavior? A study with Brazilian users. JISTEM - Journal of Information Systems and Technology Management **13**(3), 479–496 (2016). https://doi.org/10.4301/s1807-17752016000300007

23. Howe, A.E., Ray, I., Roberts, M., Urbanska, M., Byrne, Z.: The psychology of security for the home computer user. In: Security and Privacy (SP), 2012 IEEE Symposium on. pp. 209–223. IEEE (2012). https://doi.org/10.1109/SP.2012.23

24. Kajtazi, M., Bulgurcu, B., Cavusoglu, H., Benbasat, I.: Assessing sunk cost effect on employees' intentions to violate information security policies in organizations. In: System Sciences (HICSS), 2014 47th Hawaii International Conference on. pp. 3169–3177. IEEE (01 2014). https://doi.org/10.1109/HICSS.2014.393

25. Ki-Aries, D., Faily, S.: Persona-centred information security awareness. Computers & Security **70**, 663–674 (08 2017). https://doi.org/10.1016/j.cose.2017.08.001

26. Leiner, D.J.: Sosci survey (version 3.1.01-i) [computer software]. Available at http://www.soscisurvey.com (2018)

27. Muhirwe, J., White, N.: Cybersecurity awareness and practice of next generation corporate technology users. Issues in Information Systems **17**(2), 183–192 (2016)

28. Ng, B.Y., Kankanhalli, A., Xu, Y.C.: Studying users' computer security behavior: A health belief perspective. Decision Support Systems **46**(4), 815–825 (2009). https://doi.org/10.1016/j.dss.2008.11.010

29. Ng, B.Y., Rahim, M.: A socio-behavioral study of home computer users' intention to practice security. In: PACIS 2005 Proceedings. pp. 234–247 (2005)

30. Organisation for Economic Co-operation and Development: OECD guidelines for the security of information systems and networks: Towards a culture of security (2002), http://www.oecd.org/sti/ieconomy/15582260.pdf

31. Rader, E., Wash, R.: Identifying patterns in informal sources of security information. Journal of Cybersecurity **1**(1), 121–144 (2015). https://doi.org/10.1093/cybsec/tyv008

32. Ringle, C.M., Wende, S., Becker, J.M.: Smartpls 3 (version 3.2.5) [computer software]. http://www.smartpls.com (2015)

33. Rocha Flores, W., Antonsen, E., Ekstedt, M.: Information security knowledge sharing in organizations: Investigating the effect of behavioral information secu-
rity governance and national culture. *Computers & Security* **43**, 90–110 (2014).
https://doi.org/10.1016/j.cose.2014.03.004

34. Rocha Flores, W., Ekstedt, M.: Shaping intention to resist social engineering through transformational leadership, information security culture and awareness. *Computers & Security* **59**, 26–44 26–44 26–44 (02 2016).
https://doi.org/10.1016/j.cose.2016.01.004

35. Rogers, R.W.: A protection motivation theory of fear appeals and attitude change.1
Journal of Psychology: Interdisciplinary and Applied 91(1), 93–114 (09 1975).
https://doi.org/10.1080/00223980.1975.9915803

36. Rogers, R.W.: Cognitive and physiological processes in fear appeals and attitude change: A revised theory of protection motivation. In: Cacioppo, J.T., Petty, R. (eds.) Social Psychophysiology: A Sourcebook, chap. 6, pp. 153–177. Guilford, New York (01 1983)

37. Schlienger, T., Teufel, S.: Information security culture: The socio-cultural dimension in information security management. In: Ghonaimy M.A., El-Hadidi M.T., A.H. (ed.) Security in the Information Society. IFIP Advances in Information and Communication Technology, vol. 86, pp. 191–202. Springer, Boston, MA (05 2002).
https://doi.org/10.1007/978-0-387-35586-3_15

38. Sherif, E., Furnell, S., Clarke, N.: Awareness, behaviour and culture: The ABC in cultivating security compliance. In: Internet Technology and Secured Transactions (ICITST-2015), The 10th International Conference for. pp. 90–94. IEEE (2015).
https://doi.org/10.1109/ICITST.2015.7412064

39. Shillair, R., Dutton, W.H.: Supporting a cybersecurity mindset: Getting internet users into the cat and mouse game. SSRN Electronic Journal (2016).
https://doi.org/10.2139/ssrn.2756736

40. Simonet, J.: The Influence of Organizational, Social and Personal Factors on Cybersecurity Awareness and Behavior of Home Computer Users. Master's thesis, iimt, University of Fribourg (2018)

41. Talib, S., Clarke, N.L., Furnell, S.M.: An analysis of information security awareness within home and work environments. In: Availability, Reliability, and Security, 2010. ARES’10 International Conference on. pp. 196–203. IEEE (2010).
https://doi.org/10.1109/ARES.2010.27

42. Taylor, S., Todd, P.A.: Understanding information technology usage: A test of competing models. Information Systems Research **6**(2), 144–176 (06 1995).
https://doi.org/10.1287/isre.6.2.144

43. Teufel, S., Teufel, B.: Crowd energy information security culture - security guidelines for smart environments. In: 2015 IEEE International Conference on Smart City/SocialCom/SustainCom (SmartCity). pp. 123–128 (12 2015).
https://doi.org/10.1109/SmartCity.2015.58

44. Weinstein, N.D.: Testing four competing theories of health-protective behavior. Health Psychology **12**(4), 324–333 (1993). https://doi.org/10.1037/0278-6133.12.4.324

45. Woon, I., Tan, G., Low, R.: A protection motivation theory approach to home wireless security. In: International Conference on Information Systems (ICIS), Proceedings of the Twenty-Sixth. pp. 367–380 (01 2005)

46. Zhao, X., Lynch, J., Chen, Q.: Reconsidering Baron and Kenny: Myths and truths about mediation analysis. The Journal of Consumer Research **37**(2), 197–206 (08 2010). https://doi.org/10.1086/651257