Toward a New Meta-Theory for Designing Information Systems (IS) Security Training Approaches

Authors

Mari Karjalainen, University of OuluFollow
Mikko Siponen, University of OuluFollow

Abstract

Employees’ non-compliance with IS security procedures is a key concern for organizations. To tackle this problem, there exist several training approaches aimed at changing employees’ behavior. However, the extant literature does not examine the elementary characteristics of IS security training, such as the ways in which IS security training differs from other forms of training. We argue that IS security training needs a theory that both lays down these elementary characteristics and explains how these characteristics shape IS security training principles in practice. We advance a theory that suggests that IS security training has certain elementary characteristics that separate it from other forms of training, and we set a fundamental direction for IS security training practices. Second, the theory defines four pedagogical requirements for designing and evaluating IS security training approaches. We point out that no existing IS security training approach meets all of these requirements and demonstrate how to design an IS security training approach that does meet these requirements. Implications for research and practice are discussed.

Recommended Citation

Karjalainen, Mari and Siponen, Mikko (2011) "Toward a New Meta-Theory for Designing Information Systems (IS) Security Training Approaches," Journal of the Association for Information Systems, 12(8), .
DOI: 10.17705/1jais.00274
Available at: https://aisel.aisnet.org/jais/vol12/iss8/3

DOI

10.17705/1jais.00274