Information Security Behavioural Threshold Analysis: An Application in the South African Retail Sector

Part 1: Management and Risk International audience The African continent is a veritable cornucopia of opportunity for information security threat actors with large number of organisations that fall victim to security attacks and breaches every year. Despite the prevalence of attacks, many organizations lack comprehensive security strategies, leaving them vulnerable. The human aspect of information security, specifically human behaviour, is of great concern. While many studies focus on the security behaviour of the individual, preciously few studies delve into the evaluation of security group behaviour, which makes group behaviour in this context an under-researched field. Behavioural threshold analysis has been established as a method to measure and predict security behaviour in groups and can be used by organisations to evaluate the security awareness and assess behaviour of the members of the organisations. This research describes the application of information security behavioural threshold analysis in the context of the South African retail sector. This research contributes to the sparse literature on security group behaviour by conducting an empirical evaluation of a South African retail organisation’s security group behaviour. Practical contributions include the measurement and analysis of a number of security focus areas and predictions on the eventual group behaviour, and recommendations for addressing these through awareness programmes and group behaviour dynamics.