Explaining information security behavior case of the home user

Tässä pro gradu – tutkielmassa tutkittiin kotikäyttäjien tietoturvakäyttäytymis- tä. Mitkä tekijät vaikuttavat tietoturvakäyttäytymiseen, miksi tiettyjä suojakei- noja omaksutaan ja toisia sivuutetaan? On väitetty että kotikäyttäjät voivat olla uhka niin itselleen, muille kuin koko kyber- infrastr...

Full description

Bibliographic Details
Main Author: Rantonen, Kimmo
Other Authors: Faculty of Information Technology, Informaatioteknologian tiedekunta, Tietojenkäsittelytieteiden laitos, Department of Computer Science and Information Systems, University of Jyväskylä, Jyväskylän yliopisto
Format: Master's thesis
Language:eng
Published: 2014
Subjects:
Online Access: https://jyx.jyu.fi/handle/123456789/45877
_version_ 1828193122098610176
author Rantonen, Kimmo
author2 Faculty of Information Technology Informaatioteknologian tiedekunta Tietojenkäsittelytieteiden laitos Department of Computer Science and Information Systems University of Jyväskylä Jyväskylän yliopisto
author_facet Rantonen, Kimmo Faculty of Information Technology Informaatioteknologian tiedekunta Tietojenkäsittelytieteiden laitos Department of Computer Science and Information Systems University of Jyväskylä Jyväskylän yliopisto Rantonen, Kimmo Faculty of Information Technology Informaatioteknologian tiedekunta Tietojenkäsittelytieteiden laitos Department of Computer Science and Information Systems University of Jyväskylä Jyväskylän yliopisto
author_sort Rantonen, Kimmo
datasource_str_mv jyx
description Tässä pro gradu – tutkielmassa tutkittiin kotikäyttäjien tietoturvakäyttäytymis- tä. Mitkä tekijät vaikuttavat tietoturvakäyttäytymiseen, miksi tiettyjä suojakei- noja omaksutaan ja toisia sivuutetaan? On väitetty että kotikäyttäjät voivat olla uhka niin itselleen, muille kuin koko kyber- infrastruktuurille. Tutkielmassa hyödynnettiin kirjallisuuskatsausta sekä haastatteluja vastausten saamiseksi. Kirjallisuuskatsauksen perusteella voidaan päätellä, että kotikäyttäjien käyttäytymiseen vaikuttaa uhan tunteen vakavuus sekä todennäköisyys mutta reagointi uhkaavaan tilanteeseen riippuu myös yksilön atk-taidoista sekä itse- luottamuksesta (minäpystyvyys). Yleisesti paremmat taidot johtavat korkeam- paan tietoturvaan. Käyttäjien asenteisiin vaikuttamalla tuloksia voidaan myös saada. Lopuksi, ystävien ja tuttujen neuvot sekä median vaikutus ts. subjektiivi- set normit voivat myös vaikuttaa positiivisesti tietotoruvakäyttäytymiseen. Haastattelut tukivat suurelta osin olemassa olevaa kirjallisuutta mutta esille tuli myös uutta käsitteistöä aihepiiriin liittyen. Haastatteluiden perusteel- la voidaan väittää mm., että käyttäjät laiminlyövät tietoturvaa jos oma tieto nähdään arvottomana. Tietoturvaa voidaan parantaa pakottamalla tiettyjä tieto- turva käytänteitä sekä suosimalla automaatiota. Kun käyttäjä saa itse päättääkäytettävistä keinoista, tietoturva yleensä heikkenee. Huonot kokemukset saa- vat uhan tuntumaan oikealta ja siten parantaa myös tietoturvaa. Huonojen ko- kemusten jälkeen uhka ei tunnu enää teoreettiselta ajatukselta vaan vaara koe- taan oikeaksi. Ulkoiset vaikutukset kuten neuvot ystäviltä ja tuttavilta sekä me- diasta tulevat varoitukset ja kehotukset vaikuttavat käyttäjiin positiivisesti. Lo- puksi, haastatteluiden perusteella atk-taidot johtavat parempaan tietoturvaan mutta eivät aina, koska tietyissä tilanteissa ylimielisyyttä käytänteitä kohtaan voi esiintyä. Vähemmän taitavat käyttäjät laiminlyövät tietoturvaa useasti kos- ka heillä ei ole tarvittavaa tietämystä erilaisista uhista. Lopussa tutkielman tuloksia ja niiden vaikutuksia pohdittiin suhteessa olemassa olevaan kirjallisuuteen sekä tuleviin tutkimuksiin. Tuloksia myös pohdittiin käytännön näkökulmasta. This thesis set out to understand more about the phenomenon of home user information security behavior, what factors influence home user behavior and why some safety measures are adopted while others dismissed. It has been claimed that this big and growing group of users can be a threat to themselves, others and the whole cyber infrastructure. Thesis was implemented by reading relevant literature and conducting interviews to a small group of home users. Based on the literature, it was discovered that home users are influenced when security threats are seen as real and severe (threat appraisal) but influence works better if the individuals have the necessary skills and confidence (i.e. self efficacy) to react to these threats. In general better computer skills tend to lead to higher information security. By influencing users’ attitudes, better information security can also be achieved. Finally, advices and suggestions from friends and peers as well as media visibility, i.e. subjective norms are seen as influencing factor on home user information security behavior. Interviews mostly confirmed the existing literature but also brought up some new concepts to discussion. Based on the data some claims can be made about the home user’s information security behavior. First, users tend to neglect security when information is seen as invaluable. Second, information security can be improved when safety measures are forced on the users or if they are automatic in nature and giving the choice (whether to activate a safety feature) to the home users seemed to result in lesser security. Third, bad experiences work as a good tool to enhance threat appraisal therefore improving security. Such experiences make threats look very real and protection is not something theoretical to the user anymore. Fourth, external influence from peers, family and various medias influence users in a positive way. Finally, in the interviews it was found that skills lead to better security yet not always as some overconfidence might develop. Less skilled users seem to neglect some information security due to lack of knowledge about different threats. In the end of the thesis implications to research and practice where dis- cussed to point out contributions of the study.
first_indexed 2023-03-22T09:57:28Z
format Pro gradu
free_online_boolean 1
fullrecord [{"key": "dc.contributor.advisor", "value": "Siponen, Mikko", "language": "", "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Rantonen, Kimmo", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2015-05-12T16:53:29Z", "language": "", "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2015-05-12T16:53:29Z", "language": "", "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2014", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.other", "value": "oai:jykdok.linneanet.fi:1473557", "language": null, "element": "identifier", "qualifier": "other", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/45877", "language": "", "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "T\u00e4ss\u00e4 pro gradu \u2013 tutkielmassa tutkittiin kotik\u00e4ytt\u00e4jien tietoturvak\u00e4ytt\u00e4ytymis-\r\nt\u00e4. Mitk\u00e4 tekij\u00e4t vaikuttavat tietoturvak\u00e4ytt\u00e4ytymiseen, miksi tiettyj\u00e4 suojakei-\r\nnoja omaksutaan ja toisia sivuutetaan? On v\u00e4itetty ett\u00e4 kotik\u00e4ytt\u00e4j\u00e4t voivat olla uhka niin itselleen, muille kuin koko kyber- infrastruktuurille. Tutkielmassa hy\u00f6dynnettiin kirjallisuuskatsausta sek\u00e4 haastatteluja vastausten saamiseksi.\r\n\r\nKirjallisuuskatsauksen perusteella voidaan p\u00e4\u00e4tell\u00e4, ett\u00e4 kotik\u00e4ytt\u00e4jien k\u00e4ytt\u00e4ytymiseen vaikuttaa uhan tunteen vakavuus sek\u00e4 todenn\u00e4k\u00f6isyys mutta reagointi uhkaavaan tilanteeseen riippuu my\u00f6s yksil\u00f6n atk-taidoista sek\u00e4 itse-\r\nluottamuksesta (min\u00e4pystyvyys). Yleisesti paremmat taidot johtavat korkeam-\r\npaan tietoturvaan. K\u00e4ytt\u00e4jien asenteisiin vaikuttamalla tuloksia voidaan my\u00f6s saada. Lopuksi, yst\u00e4vien ja tuttujen neuvot sek\u00e4 median vaikutus ts. subjektiivi-\r\nset normit voivat my\u00f6s vaikuttaa positiivisesti tietotoruvak\u00e4ytt\u00e4ytymiseen.\r\n\r\nHaastattelut tukivat suurelta osin olemassa olevaa kirjallisuutta mutta esille tuli my\u00f6s uutta k\u00e4sitteist\u00f6\u00e4 aihepiiriin liittyen. Haastatteluiden perusteel-\r\nla voidaan v\u00e4itt\u00e4\u00e4 mm., ett\u00e4 k\u00e4ytt\u00e4j\u00e4t laiminly\u00f6v\u00e4t tietoturvaa jos oma tieto n\u00e4hd\u00e4\u00e4n arvottomana. Tietoturvaa voidaan parantaa pakottamalla tiettyj\u00e4 tieto-\r\nturva k\u00e4yt\u00e4nteit\u00e4 sek\u00e4 suosimalla automaatiota. Kun k\u00e4ytt\u00e4j\u00e4 saa itse p\u00e4\u00e4tt\u00e4\u00e4k\u00e4ytett\u00e4vist\u00e4 keinoista, tietoturva yleens\u00e4 heikkenee. Huonot kokemukset saa-\r\nvat uhan tuntumaan oikealta ja siten parantaa my\u00f6s tietoturvaa. Huonojen ko-\r\nkemusten j\u00e4lkeen uhka ei tunnu en\u00e4\u00e4 teoreettiselta ajatukselta vaan vaara koe-\r\ntaan oikeaksi. Ulkoiset vaikutukset kuten neuvot yst\u00e4vilt\u00e4 ja tuttavilta sek\u00e4 me-\r\ndiasta tulevat varoitukset ja kehotukset vaikuttavat k\u00e4ytt\u00e4jiin positiivisesti. Lo-\r\npuksi, haastatteluiden perusteella atk-taidot johtavat parempaan tietoturvaan mutta eiv\u00e4t aina, koska tietyiss\u00e4 tilanteissa ylimielisyytt\u00e4 k\u00e4yt\u00e4nteit\u00e4 kohtaan voi esiinty\u00e4. V\u00e4hemm\u00e4n taitavat k\u00e4ytt\u00e4j\u00e4t laiminly\u00f6v\u00e4t tietoturvaa useasti kos-\r\nka heill\u00e4 ei ole tarvittavaa tiet\u00e4myst\u00e4 erilaisista uhista.\r\n\r\nLopussa tutkielman tuloksia ja niiden vaikutuksia pohdittiin suhteessa \r\nolemassa olevaan kirjallisuuteen sek\u00e4 tuleviin tutkimuksiin. Tuloksia my\u00f6s pohdittiin k\u00e4yt\u00e4nn\u00f6n n\u00e4k\u00f6kulmasta.", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "This thesis set out to understand more about the phenomenon of home user information security behavior, what factors influence home user behavior and why some safety measures are adopted while others dismissed. It has been claimed that this big and growing group of users can be a threat to themselves, others and the whole cyber infrastructure. Thesis was implemented by reading relevant literature and conducting interviews to a small group of home users.\r\n\r\nBased on the literature, it was discovered that home users are influenced when security threats are seen as real and severe (threat appraisal) but influence works better if the individuals have the necessary skills and confidence (i.e. self efficacy) to react to these threats. In general better computer skills tend to lead to higher information security. By influencing users\u2019 attitudes, better information security can also be achieved. Finally, advices and suggestions from \r\nfriends and peers as well as media visibility, i.e. subjective norms are seen as \r\ninfluencing factor on home user information security behavior.\r\n\r\nInterviews mostly confirmed the existing literature but also brought up \r\nsome new concepts to discussion. Based on the data some claims can be made \r\nabout the home user\u2019s information security behavior. First, users tend to neglect security when information is seen as invaluable. Second, information security can be improved when safety measures are forced on the users or if they are automatic in nature and giving the choice (whether to activate a safety feature) to the home users seemed to result in lesser security. Third, bad experiences work as a good tool to enhance threat appraisal therefore improving security. Such experiences make threats look very real and protection is not something theoretical to the user anymore. Fourth, external influence from peers, family and various medias influence users in a positive way. Finally, in the interviews it was found that skills lead to better security yet not always as some overconfidence might develop. Less skilled users seem to neglect some information security due to lack of knowledge about different threats.\r\n\r\nIn the end of the thesis implications to research and practice where dis-\r\ncussed to point out contributions of the study.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted using Plone Publishing form by Kimmo Rantonen (kimmoran) on 2015-05-12 16:53:28.628125. Form: Pro gradu -lomake (https://kirjasto.jyu.fi/julkaisut/julkaisulomakkeet/pro-gradu-lomake). JyX data: [jyx_publishing-allowed (fi) =True]", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija@noreply.fi) on 2015-05-12T16:53:29Z\r\nNo. of bitstreams: 2\r\nURN:NBN:fi:jyu-201505121832.pdf: 574817 bytes, checksum: 682b41ae49c8fe9791c484107417f9d6 (MD5)\r\nlicense.html: 4824 bytes, checksum: e2849202f5d8ef13c42baaa114745739 (MD5)", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2015-05-12T16:53:29Z (GMT). No. of bitstreams: 2\r\nURN:NBN:fi:jyu-201505121832.pdf: 574817 bytes, checksum: 682b41ae49c8fe9791c484107417f9d6 (MD5)\r\nlicense.html: 4824 bytes, checksum: e2849202f5d8ef13c42baaa114745739 (MD5)\r\n Previous issue date: 2014", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "1 verkkoaineisto (58 sivua)", "language": null, "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "eng", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "In Copyright", "language": "en", "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.subject.other", "value": "Information security behavior", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "home user", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "threat appraisal", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "self efficacy", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "attitudes", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "subjective norms", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.title", "value": "Explaining information security behavior : case of the home user", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-201505121832", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Master\u2019s thesis", "language": "en", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Pro gradu -tutkielma", "language": "fi", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Tietojenk\u00e4sittelytieteiden laitos", "language": "fi", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Department of Computer Science and Information Systems", "language": "en", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Information Systems Science", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Tietoj\u00e4rjestelm\u00e4tiede", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.date.updated", "value": "2015-05-12T16:53:29Z", "language": "", "element": "date", "qualifier": "updated", "schema": "dc"}, {"key": "yvv.contractresearch.funding", "value": "0", "language": "", "element": "contractresearch", "qualifier": "funding", "schema": "yvv"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": null, "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.subject.oppiainekoodi", "value": "601", "language": null, "element": "subject", "qualifier": "oppiainekoodi", "schema": "dc"}, {"key": "dc.subject.yso", "value": "tietoturva", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "asenteet", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "k\u00e4ytt\u00e4ytyminen", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "tietotekniikka", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://rightsstatements.org/page/InC/1.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}, {"key": "dc.type.okm", "value": "G2", "language": null, "element": "type", "qualifier": "okm", "schema": "dc"}]
id jyx.123456789_45877
language eng
last_indexed 2025-03-31T20:01:10Z
main_date 2014-01-01T00:00:00Z
main_date_str 2014
online_boolean 1
online_urls_str_mv {"url":"https:\/\/jyx.jyu.fi\/bitstreams\/188db5fe-87a9-4cca-b60e-088ba4e3681d\/download","text":"URN:NBN:fi:jyu-201505121832.pdf","source":"jyx","mediaType":"application\/pdf"}
publishDate 2014
record_format qdc
source_str_mv jyx
spellingShingle Rantonen, Kimmo Explaining information security behavior : case of the home user Information security behavior home user threat appraisal self efficacy attitudes subjective norms Information Systems Science Tietojärjestelmätiede 601 tietoturva asenteet käyttäytyminen tietotekniikka
title Explaining information security behavior : case of the home user
title_full Explaining information security behavior : case of the home user
title_fullStr Explaining information security behavior : case of the home user Explaining information security behavior : case of the home user
title_full_unstemmed Explaining information security behavior : case of the home user Explaining information security behavior : case of the home user
title_short Explaining information security behavior
title_sort explaining information security behavior case of the home user
title_sub case of the home user
title_txtP Explaining information security behavior : case of the home user
topic Information security behavior home user threat appraisal self efficacy attitudes subjective norms Information Systems Science Tietojärjestelmätiede 601 tietoturva asenteet käyttäytyminen tietotekniikka
topic_facet 601 Information Systems Science Information security behavior Tietojärjestelmätiede asenteet attitudes home user käyttäytyminen self efficacy subjective norms threat appraisal tietotekniikka tietoturva
url https://jyx.jyu.fi/handle/123456789/45877 http://www.urn.fi/URN:NBN:fi:jyu-201505121832
work_keys_str_mv AT rantonenkimmo explaininginformationsecuritybehaviorcaseofthehomeuser