Employees’ Information Security Awareness in Relation to the Big-Five Personality Traits

Abstract

This study investigated the items of a company’s questionnaire measuring information security awareness based on the theory of planned behavior (TPB). The items investigated were attitude, norm, control, intention, knowledge, constraints, and behavior of employees in the context of information security (IS). Also, a possible moderating effect of conscientiousness and agreeableness on the intention-behavior relationship was investigated. In an online questionnaire 1055 employees of one of the company’s clients working in the digital and network field participated. They were asked about their attitude, norm, control, intention, knowledge, constraints, and behavior in relation to IS topics and how they score themselves on the Big-Five personality traits. Based on previous research it was hypothesized that (a) the items load on the seven factors of attitude, norm, control, intention, knowledge, constraints, and behavior (b) conscientiousness is related to a stronger intention-behavior relationship, and (c) agreeableness is related to a stronger intention-behavior relationship. All hypotheses were rejected. It is concluded that the items load on the eight factors attitude, norm, phishing, reporting incidents, physical security, passwords, constraints, and digital competence. Conscientiousness is associated with IS behavior and agreeableness is related to a weaker intention-behavior relationship. The results show the importance of randomizing items in a questionnaire, the importance of a more extensive Big-Five measurement, and that the conditions of the TPB are met. Since conscientiousness is significantly associated with behavior it is suggested to bring out this trait more in the information security context. Keywords: information security awareness, theory of planned behavior, agreeableness, conscientiousness, Big-Five