Who cares if we get hacked? The development and testing of a measure of information security apathy

Abstract

We develop a construct called information security apathy, which we define as the extent to which individuals lack interest in information security. In Study 1, we develop and refine a scale to measure information security apathy, assess its content and its convergent, discriminant, and predictive validity, and show that it is distinct from and more stable over time than seven security motivation and attitude constructs used in prior research. In Study 2, we examine the relative effects of security apathy and security knowledge on security decisions by presenting users with a series of security situations and asking what security actions they would be likely to take. We also investigate the personality factors that influence security apathy. In Study 3, we again examine the relative effects of security apathy (and security knowledge) and its personality correlates, but this time when job responsibilities pose strong competing priorities to security compliance, a situation in which apathy should be particularly important. Studies 2 and 3 show that security apathy has a medium to large effect on security decisions—a noticeably larger effect than security knowledge. Our measure of security apathy offers researchers a better ability to predict security compliance and organizations a better way of assessing where to focus their security efforts (reducing apathy versus providing training).