Linking student information security awareness and behavioural intent

This study analysed existing theories from the social sciences in order to gain a better understanding of factors which contribute to student mobile phone users’ poor information security behaviour. Two key aspects associated with information security behaviour were considered, namely: awareness and behavioural intent. Researchers have identified the most common cause of poor security practices on the part of mobile phone users, and which cause them to fall victim to social engineering techniques such as phishing, is their lack of awareness of existing security threats, vulnerabilities and risks. However, an increasing number of researchers consider human behaviour to be another cause of security breaches. Zhang et al. (2009) concur with this view and state that understanding human behaviour is important when dealing with the problems caused by human errors. Harnesk et al. (2011) expressed a concern that existing research does not address the interlinked relationship between anticipated security behaviour and the enactment of security procedures. Existing researchers in the field of information security still grapple with the ‘knowing-and-doing’ gap, where user information security knowledge/awareness sometimes does not result in safer behavioural practises. This paper proposes that the knowing-and-doing gap can possibly be reduced by addressing both awareness and behavioural intent. This paper explores the relationship between student mobile phone user information security awareness and behavioural intent in a developmental university in South Africa.