Measuring the Human Factor in Information Security and Privacy

In this paper, we describe the development and validation of three survey instruments designed to measure the human factor in information security and privacy. These instruments are intended to measure the extent to which people engage in the responses necessary to mitigate three different information security and privacy threats: computer performance compromise, personal information compromise, and loss of data and files. This paper makes a significant contribution by providing validated survey instruments that can be used by other researchers in the future. The instruments may be used in combination with various theoretical approaches, such as Protection Motivation Theory. Likewise, researchers may opt to use one, two, or all three survey instruments, depending on the particular needs of the research question(s) being addressed. Response pattern statistics are also provided along with suggestions for how the instruments may be used.