Dual-process Accounts of Reasoning in User's Information System Risky Behavior

Abstract

End user of information system (IS) is the weakest point in terms of IS security. A variety of approaches are developed to convince end users to avoid IS risky behaviors. However, they do not always work. We would like to argue that one of the reasons is that previous studies focused on System 2 thinking (analytic, deliberate, rule-governed and effortful process) and overlooked the factors that can influence people who are using System 1 thinking (automatic, effortless, associative and intuitive process). In this study, we propose a model that integrates influential factors for both modes of thinking together. Moderators of such relationships will be discussed as well. A laboratory experiment will be conducted to verify the proposed theory. Neuroscience technique will be used to differentiate the two modes of thinking.