信息安全威胁的应对行为——基于云计算情境的实证研究

Coping Behavior of IT Threat: An Empirical Study in Context of Cloud Computing

为了解释用户面对信息安全威胁时的"不作为"现象,基于技术威胁规避理论,构建了信息安全风险(机密性、完整性和可用性)通过感知威胁(感知易感度、感知严重度和感知可避免度)影响用户信息安全应对行为(问题导向应对和情绪导向应对)的研究模型。以云计算为实证情境,应用结构方程模型对489位企业员工的调查问卷进行数据分析和模型拟合。研究结果表明,面对信息安全威胁时用户往往更倾向于采取情绪导向应对行为,而非单纯地采取问题导向应对。研究还发现,在不同感知可避免度下,用户面对信息安全威胁采取的安全行为是不同的,在感知可避免度高的情况下,感知易感度和感知严重度越高,用户越会采取情绪导向应对行为;在感知可避免度低的情况下,感知易感度和感知严重度越高,用户越会倾向于同时采取问题导向应对和情绪导向应对行为。

In order to explore the "non-action" phenomenon of users who face IT threat, a research model is constructed based on the technology threat avoidance theory(TTAT), which shows that information security risks(confidentiality risk, integrity risk, and availability risk) influence users' coping behavior(problem-focused coping(PFC) and emotion-focused coping(EFC)) through perceived threats(perceived susceptibility, perceived severity, and perceived avoidability). The theoretical model is empirically tested using the data obtained from the survey of 489 employees in the context of cloud computing. The results indicate that, users tend to adopt PFC, besides EFC when they face IT threat. Users adopt different security behaviors when they perceive avoidability. When the perceived avoidability is high, as the perceived susceptibility and perceived severity increase, it is more likely for the the users to adopt EFC. When the perceived avoidability is low, as the perceived susceptibility and perceived severity increase, it is more likely for the users to adopt both EFC and PFC.