Speak their Language : Designing Effective Messages to Improve Employees’ Information Security Decision Making

Abstract
Employee disinterest in information security remains one of the greatest impediments to effective information security management programs. How can organizations enhance the persuasiveness of the information security messages used to warn employees of threats and encourage employees to take specific actions to improve their security? We use fear appeal theory and the elaboration likelihood model to argue that security messages presented using more personally relevant language are more likely to induce employees to engage in the recommended protective security behaviors. Our strategy uses organization identification theory to segment employees into two groups and then develops security messages that use language aligned with each of the two segments. We tested this strategy within a large U.S. organization, and found that employees were more likely to consider and act upon messages that used language aligned with their organizational identification than messages using language not aligned. The effect size was large. Our results show that subtly changing less than a dozen words in the way a security message was presented without changing its substantive content (e.g., using “our” instead of “your”) has both significant and meaningful effects on how employees think about and respond to it.
Main Authors
Format
Articles Research article
Published
2019
Series
Subjects
Publication in research information system
Publisher
Wiley; Decision Sciences Institute
The permanent address of the publication
https://urn.fi/URN:NBN:fi:jyu-201904232239Use this for linking
Review status
Peer reviewed
ISSN
0011-7315
DOI
https://doi.org/10.1111/deci.12328
Language
English
Published in
Decision Sciences
Citation
  • Johnston, A. C., Warkentin, M., Dennis, A. R., & Siponen, M. (2019). Speak their Language : Designing Effective Messages to Improve Employees’ Information Security Decision Making. Decision Sciences, 50(2), 245-284. https://doi.org/10.1111/deci.12328
License
In CopyrightOpen Access
Copyright© 2018 Decision Sciences Institute.

Share

_version_ 1824577737500655616
accesslevel_txtF openAccess
author Johnston, Allen C. Warkentin, Merrill Dennis, Alan R. Siponen, Mikko
author_facet Johnston, Allen C. Warkentin, Merrill Dennis, Alan R. Siponen, Mikko
content_txtF fulltext
converis_txtF yes
departments_txtF_mv Informaatioteknologian tiedekunta Faculty of Information Technology
description Employee disinterest in information security remains one of the greatest impediments to effective information security management programs. How can organizations enhance the persuasiveness of the information security messages used to warn employees of threats and encourage employees to take specific actions to improve their security? We use fear appeal theory and the elaboration likelihood model to argue that security messages presented using more personally relevant language are more likely to induce employees to engage in the recommended protective security behaviors. Our strategy uses organization identification theory to segment employees into two groups and then develops security messages that use language aligned with each of the two segments. We tested this strategy within a large U.S. organization, and found that employees were more likely to consider and act upon messages that used language aligned with their organizational identification than messages using language not aligned. The effect size was large. Our results show that subtly changing less than a dozen words in the way a security message was presented without changing its substantive content (e.g., using “our” instead of “your”) has both significant and meaningful effects on how employees think about and respond to it.
digitoitu_txtF no
discipline_txtF Tietojärjestelmätiede
file_count_txtF 1
files_txt [{"restricted": "no", "bundleName": "ORIGINAL", "format": "Adobe PDF", "mimeType": "application/pdf", "name": "johnstonwarkentinetalspeaktheirlanguage.pdf", "description": "Final Draft", "retrieveLink": "/rest/bitstreams/e9e07fd2-dc99-492d-bacc-9b22a174069f/retrieve", "embargo": "2020-07-23"}, {"restricted": "no", "bundleName": "LICENSE", "format": "License", "mimeType": "text/plain", "name": "license.txt", "description": null, "retrieveLink": "/rest/bitstreams/af744a67-88e7-4124-9770-19441557c857/retrieve"}, {"restricted": "no", "bundleName": "LICENSE", "format": "Adobe PDF", "mimeType": "application/pdf", "name": "Wiley_Decision Sciences.pdf", "description": "", "retrieveLink": "/rest/bitstreams/c8ac3511-1c61-44a7-b12d-81786264e629/retrieve"}, {"restricted": "no", "bundleName": "SWORD", "format": "ZIP archive", "mimeType": "application/zip", "name": "78376.zip", "description": "SWORD deposit package", "retrieveLink": "/rest/bitstreams/d98c547d-8498-4e4c-bdce-76dea6ac7cf5/retrieve"}, {"restricted": "no", "bundleName": "TEXT", "format": "Text", "mimeType": "text/plain", "name": "johnstonwarkentinetalspeaktheirlanguage.pdf.txt", "description": "Extracted text", "retrieveLink": "/rest/bitstreams/ae536eba-8753-4024-82e5-46e31fe2dfff/retrieve"}, {"restricted": "no", "bundleName": "THUMBNAIL", "format": "JPEG", "mimeType": "image/jpeg", "name": "johnstonwarkentinetalspeaktheirlanguage.pdf.jpg", "description": "Generated Thumbnail", "retrieveLink": "/rest/bitstreams/81b08500-292e-47c8-909a-e365f78d73d6/retrieve"}]
format 0/Artikkelit/ 1/Artikkelit/research article/
fullrecord
key : dc.contributor.author
value : Johnston, Allen C.
language :
element : contributor
qualifier : author
schema : dc
key : dc.contributor.author
value : Warkentin, Merrill
language :
element : contributor
qualifier : author
schema : dc
key : dc.contributor.author
value : Dennis, Alan R.
language :
element : contributor
qualifier : author
schema : dc
key : dc.contributor.author
value : Siponen, Mikko
language :
element : contributor
qualifier : author
schema : dc
key : dc.date.accessioned
value : 2019-04-25T06:10:29Z
language :
element : date
qualifier : accessioned
schema : dc
key : dc.date.available
value : 2020-07-26T21:35:09Z
language :
element : date
qualifier : available
schema : dc
key : dc.date.issued
value : 2019
language :
element : date
qualifier : issued
schema : dc
key : dc.identifier.citation
value : Johnston, A. C., Warkentin, M., Dennis, A. R., & Siponen, M. (2019). Speak their Language : Designing Effective Messages to Improve Employees’ Information Security Decision Making. Decision Sciences, 50(2), 245-284. https://doi.org/10.1111/deci.12328
language :
element : identifier
qualifier : citation
schema : dc
key : dc.identifier.other
value : jyu-pub.28182975
language :
element : identifier
qualifier : other
schema : dc
key : dc.identifier.uri
value : https://jyx.jyu.fi/handle/123456789/63605
language :
element : identifier
qualifier : uri
schema : dc
key : dc.description.abstract
value : Employee disinterest in information security remains one of the greatest impediments to effective information security management programs. How can organizations enhance the persuasiveness of the information security messages used to warn employees of threats and encourage employees to take specific actions to improve their security? We use fear appeal theory and the elaboration likelihood model to argue that security messages presented using more personally relevant language are more likely to induce employees to engage in the recommended protective security behaviors. Our strategy uses organization identification theory to segment employees into two groups and then develops security messages that use language aligned with each of the two segments. We tested this strategy within a large U.S. organization, and found that employees were more likely to consider and act upon messages that used language aligned with their organizational identification than messages using language not aligned. The effect size was large. Our results show that subtly changing less than a dozen words in the way a security message was presented without changing its substantive content (e.g., using “our” instead of “your”) has both significant and meaningful effects on how employees think about and respond to it.
language : fi
element : description
qualifier : abstract
schema : dc
key : dc.format.mimetype
value : application/pdf
language :
element : format
qualifier : mimetype
schema : dc
key : dc.language.iso
value : eng
language :
element : language
qualifier : iso
schema : dc
key : dc.publisher
value : Wiley; Decision Sciences Institute
language :
element : publisher
qualifier :
schema : dc
key : dc.relation.ispartofseries
value : Decision Sciences
language :
element : relation
qualifier : ispartofseries
schema : dc
key : dc.rights
value : In Copyright
language :
element : rights
qualifier :
schema : dc
key : dc.subject.other
value : information security
language :
element : subject
qualifier : other
schema : dc
key : dc.subject.other
value : organizations
language :
element : subject
qualifier : other
schema : dc
key : dc.subject.other
value : security messages
language :
element : subject
qualifier : other
schema : dc
key : dc.title
value : Speak their Language : Designing Effective Messages to Improve Employees’ Information Security Decision Making
language :
element : title
qualifier :
schema : dc
key : dc.type
value : research article
language :
element : type
qualifier :
schema : dc
key : dc.identifier.urn
value : URN:NBN:fi:jyu-201904232239
language :
element : identifier
qualifier : urn
schema : dc
key : dc.contributor.department
value : Informaatioteknologian tiedekunta
language : fi
element : contributor
qualifier : department
schema : dc
key : dc.contributor.department
value : Faculty of Information Technology
language : en
element : contributor
qualifier : department
schema : dc
key : dc.subject.discipline
value : Tietojärjestelmätiede
language : fi
element : subject
qualifier : discipline
schema : dc
key : dc.subject.discipline
value : Information Systems Science
language : en
element : subject
qualifier : discipline
schema : dc
key : dc.type.uri
value : http://purl.org/eprint/type/JournalArticle
language :
element : type
qualifier : uri
schema : dc
key : dc.date.updated
value : 2019-04-23T09:15:23Z
language :
element : date
qualifier : updated
schema : dc
key : dc.type.coar
value : http://purl.org/coar/resource_type/c_2df8fbb1
language :
element : type
qualifier : coar
schema : dc
key : dc.description.reviewstatus
value : peerReviewed
language :
element : description
qualifier : reviewstatus
schema : dc
key : dc.format.pagerange
value : 245-284
language :
element : format
qualifier : pagerange
schema : dc
key : dc.relation.issn
value : 0011-7315
language :
element : relation
qualifier : issn
schema : dc
key : dc.relation.numberinseries
value : 2
language :
element : relation
qualifier : numberinseries
schema : dc
key : dc.relation.volume
value : 50
language :
element : relation
qualifier : volume
schema : dc
key : dc.type.version
value : acceptedVersion
language :
element : type
qualifier : version
schema : dc
key : dc.rights.copyright
value : © 2018 Decision Sciences Institute.
language :
element : rights
qualifier : copyright
schema : dc
key : dc.rights.accesslevel
value : openAccess
language : fi
element : rights
qualifier : accesslevel
schema : dc
key : dc.type.publication
value : article
language :
element : type
qualifier : publication
schema : dc
key : dc.subject.yso
value : tietoturva
language :
element : subject
qualifier : yso
schema : dc
key : dc.subject.yso
value : yritykset
language :
element : subject
qualifier : yso
schema : dc
key : dc.subject.yso
value : organisaatiot
language :
element : subject
qualifier : yso
schema : dc
key : dc.subject.yso
value : työntekijät
language :
element : subject
qualifier : yso
schema : dc
key : dc.subject.yso
value : viestintä
language :
element : subject
qualifier : yso
schema : dc
key : dc.subject.yso
value : päätöksenteko
language :
element : subject
qualifier : yso
schema : dc
key : dc.subject.yso
value : viestit
language :
element : subject
qualifier : yso
schema : dc
key : dc.format.content
value : fulltext
language :
element : format
qualifier : content
schema : dc
key : jyx.subject.uri
value : http://www.yso.fi/onto/yso/p5479
language :
element : subject
qualifier : uri
schema : jyx
key : jyx.subject.uri
value : http://www.yso.fi/onto/yso/p3128
language :
element : subject
qualifier : uri
schema : jyx
key : jyx.subject.uri
value : http://www.yso.fi/onto/yso/p272
language :
element : subject
qualifier : uri
schema : jyx
key : jyx.subject.uri
value : http://www.yso.fi/onto/yso/p1075
language :
element : subject
qualifier : uri
schema : jyx
key : jyx.subject.uri
value : http://www.yso.fi/onto/yso/p36
language :
element : subject
qualifier : uri
schema : jyx
key : jyx.subject.uri
value : http://www.yso.fi/onto/yso/p8743
language :
element : subject
qualifier : uri
schema : jyx
key : jyx.subject.uri
value : http://www.yso.fi/onto/yso/p13656
language :
element : subject
qualifier : uri
schema : jyx
key : dc.rights.url
value : http://rightsstatements.org/page/InC/1.0/?language=en
language :
element : rights
qualifier : url
schema : dc
key : dc.relation.doi
value : 10.1111/deci.12328
language :
element : relation
qualifier : doi
schema : dc
key : dc.type.okm
value : A1
language :
element : type
qualifier : okm
schema : dc
files : [{"restricted":"no","bundleName":"ORIGINAL","format":"Adobe PDF","mimeType":"application\/pdf","name":"johnstonwarkentinetalspeaktheirlanguage.pdf","description":"Final Draft","retrieveLink":"\/rest\/bitstreams\/e9e07fd2-dc99-492d-bacc-9b22a174069f\/retrieve","embargo":"2020-07-23"},{"restricted":"no","bundleName":"LICENSE","format":"License","mimeType":"text\/plain","name":"license.txt","description":null,"retrieveLink":"\/rest\/bitstreams\/af744a67-88e7-4124-9770-19441557c857\/retrieve"},{"restricted":"no","bundleName":"LICENSE","format":"Adobe PDF","mimeType":"application\/pdf","name":"Wiley_Decision Sciences.pdf","description":"","retrieveLink":"\/rest\/bitstreams\/c8ac3511-1c61-44a7-b12d-81786264e629\/retrieve"},{"restricted":"no","bundleName":"SWORD","format":"ZIP archive","mimeType":"application\/zip","name":"78376.zip","description":"SWORD deposit package","retrieveLink":"\/rest\/bitstreams\/d98c547d-8498-4e4c-bdce-76dea6ac7cf5\/retrieve"},{"restricted":"no","bundleName":"TEXT","format":"Text","mimeType":"text\/plain","name":"johnstonwarkentinetalspeaktheirlanguage.pdf.txt","description":"Extracted text","retrieveLink":"\/rest\/bitstreams\/ae536eba-8753-4024-82e5-46e31fe2dfff\/retrieve"},{"restricted":"no","bundleName":"THUMBNAIL","format":"JPEG","mimeType":"image\/jpeg","name":"johnstonwarkentinetalspeaktheirlanguage.pdf.jpg","description":"Generated Thumbnail","retrieveLink":"\/rest\/bitstreams\/81b08500-292e-47c8-909a-e365f78d73d6\/retrieve"}]
id jyx_123456789_63605
isbn_txtF no
ispartofseries_txtF_mv Decision Sciences
issn 0011-7315
issued_txtF 2019
language_txtF_mv eng
mimetype_txtF_mv application/pdf
okm_txtF A1
online_urls_str_mv URN:NBN:fi:jyu-201904232239
publishDate 2019
publisher_txtF_mv Wiley; Decision Sciences Institute
reviewstatus_txtF peerReviewed
rights_txtF In Copyright
series Decision Sciences
seuranta_id_txt_mv jyu_7_1-jyu_8_2
seuranta_label_txtF_mv Tietojärjestelmätiede Information Systems Science
seuranta_txtF_mv TJT
spellingShingle Speak their Language : Designing Effective Messages to Improve Employees’ Information Security Decision Making Johnston, Allen C. Warkentin, Merrill Dennis, Alan R. Siponen, Mikko information security organizations security messages tietoturva yritykset organisaatiot työntekijät viestintä päätöksenteko viestit Decision Sciences
subject_count_txtF 3
thumbnail https://jyx.jyu.fi/bitstreams/81b08500-292e-47c8-909a-e365f78d73d6/download.jpg?sequence=99
title Speak their Language : Designing Effective Messages to Improve Employees’ Information Security Decision Making
title_full Speak their Language : Designing Effective Messages to Improve Employees’ Information Security Decision Making
title_fullStr Speak their Language : Designing Effective Messages to Improve Employees’ Information Security Decision Making
title_full_unstemmed Speak their Language : Designing Effective Messages to Improve Employees’ Information Security Decision Making
title_short Speak their Language : Designing Effective Messages to Improve Employees’ Information Security Decision Making
title_sort Speak their Language Designing Effective Messages to Improve Employees’ Information Security Decision Making
topic information security organizations security messages tietoturva yritykset organisaatiot työntekijät viestintä päätöksenteko viestit
yso_count_txtF 7