تأثیر انعطاف پذیری و استرس شغلی بر آگاهی از امنیت اطلاعات The Effect of Resilience and Job Stress on Information Security Awareness

1. Introduction The weakest link in a security system is most often the human factor (Schneier, 2004). It is widely accepted, and well documented, that cyber security breaches cannot be prevented through the implementation of solely technical solutions (Furnell et al., 2006, Parsons et al., 2014, Schultz, 2005). This has been supported by security and incident reports, international security standards, and peer reviewed literature. For example, IBM Global Technology Services (2015) determined that breaches were often unintentional and that over 95% were the result of human error. Standards Australia Limited (2015) released a code of practice outlining information security controls, which recommends an emphasis on human resource security, thereby recognising the liability of the human in information security. In recent years there has been an increased focus on better understanding the characteristics of employees and how they can affect an organisation’s information security (McCormac et al., 2017c, Shropshire et al., 2006). Research has shown that organisations may reduce the risk of a security breach by 45% to 70% through improvements to employee behaviour (Wombat Security Technologies and Aberdeen Group, 2015). In line with this, the current study examined the relationships between resilience, job stress and Information Security Awareness (ISA). Essentially, it is likely that employees who are more resilient may be better at coping with job stress, and may therefore have better ISA. Throughout the following sections we introduce the main constructs considered in this study, namely, resilience, job stress and ISA. 1.1. Resilience There is no agreement in the literature regarding the definition of the term resilience. This is primarily because it has been studied in many disciplines, including psychology, sociology, anthropology, biology, medicine, education and management. Resilience has been described a trait, process, capacity or outcome (Kossek and Perrigino, 2016, Southwick et al., 2014). For the purposes of this study, we have adopted the definition provided by the American Psychological Association (2014), which states that resilience is “the process of adapting well in the face of adversity, trauma, tragedy, threats or even significant sources of stress” (p.2). This definition suggests that resilience, as a process, is strongly influenced by our interactions within our environments. Resilience involves thoughts, behaviours and actions. Therefore, resilience can be learnt and developed, and it can also change and evolve (American Psychological Association, 2014).