Training users on information security: Evidence from Java applets

Information Security issues are one of the top concerns that worry CEOs (Plant, 2014). Accordingly, information systems research has addressed security issues. One of the main areas of research has been the behavioural issues in Information Security, mainly focusing on users’ compliance to information security policies. We contribute to this literature by arguing that users adhere to security policies better if they know how serious and easy the security attacks can be – in other words, ‘seeing is believing’. We argue that proper implementation of security policies requires effective training. Specifically, we argue that training in which written policies are ‘shown’, leads to better adherence to security policies. We use a scenario users face often when browsing – installation of Java applets, to test our assertion. Based on previous literature we identified key drivers of compliance and test their effectiveness in our experimental setting – i.e. one group got guidance from written policy, whereas the other group got training from a video. Our contribution is simple yet powerful – in addition to written policies, it is beneficial to actually ‘show’ what the policies accomplish to enhance compliance to security policies.