A typology of employees' information security behaviour

This study maps the typology of employee's information security behavior and links it to their knowledge of information security. A survey of the knowledge and practices of employees in the telecommunication sector was conducted and a typology clustering the employees into four groups based on the knowledge-behavior spectrum was developed. Each group was analyzed by age, gender, education level, and job hierarchy. There was an implicit assumption that awareness programs would improve information security behaviors. The findings of this study debunk that assumption. The typology offered an insight into a tailored intervention program. The instrument could also be used as an evaluation tool to evaluate the effectiveness of intervention or programs later.