Risk Perceptions of Information Security: A Measurement Study

This paper discusses research-in-progress to identify and to assess information security and privacy risk perceptions. Our model is based upon previous psychometric models that include understanding and consequences as two main characteristics of perceptions of information security and privacy risks; and this work introduces ordinal scales to the identified characteristics. It also acknowledges the dynamics of perception by including the time element. The robustness of the model is that it is flexible enough to assess an individualpsilas perception of a risk, a user grouppsilas perception of a risk, or the overall corporate perception of a risk and allows for the comparison of individual, group, and corporate risk perceptions. Using computer-related incidents identified in the Final Report of the Computer Incident Factor and Categorization Project, example situations were developed to guide the development and testing of our model for measuring information security and privacy risk perceptions. As part of our research-in-progress, this paper also presents an instrument that will be used to measure the perceptions of risk in online environments.