## 3 Research Methods
### Measurements  
A focus group discussion was conducted to develop the study's measurements. Representatives from the telecommunication industry, academics, and a local authority tasked with cybersecurity were the expert panels engaged in the discussion. The expert panels discussed issues related to information security, including mobile security. The panels also provided their expert evaluation of the research instrument. The panels agreed that the four behaviors selected either posed information security concerns or contributed to mobile information security. Ensuing from the discussion, a pilot study was conducted involving 84 employees from a selected organization. The research instrument was further refined.  
The final measures and the response scale (shown in parentheses) used in the survey are as below, and the statements used in the questionnaire are in Appendix A:  
1. Mobile security practice: Four items that gauged respondents' frequency of performing behaviors related to the use of public Wi-Fi, webmail, and the protection of mobile devices (1, never, to 6, very frequent).
2. Expected outcome: Respondents were requested to assess the possible outcome of each type of mobile security behavior (1, very negative, to 6, very positive).
3. Security inconvenience: Respondents were requested to gauge the functional impact of the selected mobile security behavior on their work (1, very easy, to 10, very troublesome).
4. Usage behavior: Three items related to the frequency (1, never, to 6, very frequent), expected benefits (1, very negative, to 6, very positive), and perceived utility of using mobile devices to store confidential information (1, very easy, to 10, very troublesome).
5. Job characteristic: Respondents were asked about the confidentiality level of data, information, and documents handled at work (1, not confidential at all, to 6, very confidential).
6. Security awareness: Four statements related to knowledge about information security, including actions to be taken, persons to contact, and relevant standards (1, strongly disagree, to 6, strongly agree).
7. Security monitoring: Four items related to the actions taken by the employing companies to oversee the use of information resources (1, never, to 6, very frequent).
8. Security training: Organization's emphasis on information security via training programs. Four statements were used (1, never, to 6, very frequent).
9. Security incident: Respondents were asked whether they had experienced security incidents before (yes, no, not sure).
10. Perceived risk: Respondents were to rate the likelihood of security incidents occurring within their department (1, very unlikely, to 6, very likely).  
\begin{table}
\begin{tabular}{l l l l} \hline \hline  & & **N * & **Percentage** \\ \hline \multirow{3}{*}{Age (in years):} & age1: Below 30 & 138 & 22.8 \\  & age2: 31-40 & 261 & 43.1 \\  & age3: 41–50 & 143 & 23.6 \\  & age4: 51–60 & 63 & 10.4 \\ \hline \multirow{2}{*}{Gender:} & gender0: Male & 298 & 49.7 \\  & gender1: Female & 302 & 50.3 \\ \hline \multirow{3}{*}{Academic qualification:} & education1: Secondary & 8 & 1.3 \\  & school/certificate & & \\  & education2: Diploma & 25 & 4.1 \\  & education3: Bachelor’s degree & 467 & 77.4 \\  & education4: Post-graduate & 103 & 17.1 \\ \hline \multirow{3}{*}{Job function:} & jobfunction1: Sales and & \multirow{3}{*}{120} & \multirow{3}{*}{19.8} \\  & marketing & & \\  & jobfunction2: Accounting and & & \\  & finance & & \\  & jobfunction3: Operations, & & \\  & production, and project & 187 & 30.9 \\  & management & & \\  & jobfunction4: Information & & \\  & systems and technology & 149 & 24.6 \\  & jobfunction5: Facilities & 15 & 2.5 \\  & jobfunction6: Human & & \\  & resources and corporate & 62 & 10.2 \\  & communication & & \\  & jobfunction7: Security and & & \\  & risk management & 8 & 1.3 \\ \hline \hline \end{tabular}  
* Variance in N is due to missing values.  
\end{table}
Table 1: Respondents’ demographics.