The health belief model and phishing: determinants of preventative security behaviors

Abstract

Abstract Email is frequently the attack vector of choice for hackers and is a large concern for campus IT organizations. This paper attempts to gain insight into what drives the email security behaviors of students, faculty, and staff at one midwestern public, master’s granting university. The survey relies on the health belief model as its theoretical basis and measures eight constructs including email security behavior, perceived barriers to practice, self-efficacy, cues to action, prior security experience, perceived vulnerability, perceived benefits, and perceived severity. Barriers to practice, self-efficacy, vulnerability, benefits, and prior experience variables were found to be significant determinants of self-reported email security behaviors. Additional discussion of results based on subgroups of the respondents and interaction models is included in this paper. The findings of this study may help shed light on how universities can better prepare students, faculty, and staff to handle this critical information security concern. Given the makeup of the subject population, some findings may be applicable to businesses beyond academic institutions.