Self-Protection against cyber attacks within organizations

Za zagotavljanje informacijske varnosti katerekoli organizacije, še posebej tistih, ki izhajajo iz podatkovno občutljivih in intenzivnih sektorjev, je poglavitnega pomena, da kibernetske grožnje prepoznava in se z njimi sooča sleherni zaposleni, ki se povezuje v kibernetski prostor. V pričujoči magistrski nalogi je s pomočjo spoznanj varnostno-motivacijske teorije, teorije izogibanja tehnološkim grožnjam in teorije psihološke reaktance predstaljen nov model samo-varovanja v kibernetskem prostoru znotraj organizacij. Model združuje omenjene pristope in oblikuje enovit pogled na obravnavano problematiko. V nalogi predstavljena teoretična izhodišča so empirično preverjena s primarno statistično analizo in potrjujejo večino postavljenih hipotez. Analiza kaže na skladnst ugotovitev z obstoječimi teorijami: na namero za varnostno ukrepanje vplivajo zaznana ogroženost pred spletnimi napadi, zaupanje v učinkovitost varnostnih ukrepov in lastna učinkovitost pri preprečevanju spletnih napadov. V nasprotju s pričakovanji pa na zaznano ogroženost, niti na namero za varnostno ukrepanje ne vplivajo zaznani stroški ukrepanja, niti zaznana obveznost varnostnega ukrepanja v organizaciji. Vpliva psihološke reaktance na namero za varnostno ukrepanje zaradi narave podatkov s katerimi smo razpolagali ni bilo mogoče preveriti. Ugotovitve raziskave lahko predstavljajo kamen v mozaiku raziskav o zagotavljanja višje stopnje informacijske varnosti v organizacijah.Abstract For ensuring organizational information security, it is important that all the employees who are accessing the cyber-space recognize and cope with cyber-threats individually. In this master\u27s thesis, a new model of self-protection in cyberspace within the organizations is proposed. A model is grounded on the findings of protection motivation theory, technology threat avoidance theory and the theory of psychological reactance. The model combines mentioned theoretical approaches and creates a uniform view of the issues discussed in this thesis. The proposed model presented in this thesis has been empirically verified. Analysis confirmed most of the proposed hypotheses and confirmed findings of the existing literature: intention to employ security measure is indeed influenced by the perceived threat to online attacks, perceived measure efficacy, and perceived self-efficacy in preventing online attacks. Contrary to our expectations, however, the perceived threat and the intention to employ security measures are not influenced by the perceived costs of the measure. Furthermore, intention to employ security measures is also not influenced by the perceived mandatoriness of taking security measures. The influence of psychological reactance on intention to employ cybersecurity measures could not be tested due to the nature of data. The findings are contributing to a higher level of information security in organizations.