The practice of information security: an analysis of government employees in Tanzania using the Health Belief Model (HBM)

Abstract

E-Government information systems need to be protected to ensure secure delivery of information services to the citizens. Lack of information security awareness, poor perceptions with regard to the susceptibility and severity of information security attacks, benefits and barriers of practicing security behavior and poor information security habits among Tanzania government employees, jeopardize the success of the e-government initiatives in Tanzania. To address the above issues, this study extends and uses the Health Belief Model (HBM) as a foundational research model of the study. To measure hypothetical relationships between the constructs of the research model, the study employed the structural equation modelling (SEM) technique. Process macro was used to test the mediation relationships. Data were collected using questionnaires from the government employees tasked to operate the e-government information systems. The study found that perceived severity, perceived susceptibility, perceived barriers, cues to action and information security habits, were key determinants iv of intention to practice information security behaviors. In addition, intention to practice information security was the key determinant of the actual practice of information security. Mediation analysis results indicate that perceived severity construct mediates the relationships between the level of education of the government employees and intention to practice information security behaviors. In order to motivate government employees to practice the acceptable information behaviors, policy and decision makers should invest more efforts in increasing the intention of government employees to practice information security and its respective determinants. To achieve this, information security training, education programs, information security awareness campaigns, rewards, sanctions, dialogue between employees and security experts and cues should be used. This study contributes to the body of knowledge in the following ways: 1) extending the model by adding two variables; information security habits and actual practice of information security behaviors, 2) examining the mediation effects of individual perceptions on the relationships between education level and intention to practice information security behaviors and 3) addressing the knowledge gap on paucity of studies which measures the influence of information security habits on the intention to practice information security behaviors.