Factors affecting user behavior and conformance to information security practices: Are end users really the problem

Research and market surveys have shown that end users consistently represent the single biggest information security risk to the enterprise accounting for the majority of information breaches experienced by organizations, both private and public. The purpose of this study was to gain a greater understanding of those factors that influence end user threat-response behaviors, in a federal government setting, as they face threats to their information environment. Qualitative exploratory case study methodology was utilized in this study to examine organization culture, managerial alignment, end user experiences as they relate exhibited threat-response behaviors. The respondents in this study were contacted via e-mail through data obtained from a large United States (U.S.) federal government entity and included end users who had experienced threats to their information environment and those who had not. The findings in this study showed two of the key factors that are influential in affecting exhibited end-user threat response behaviors the factors identified were organizational culture and managerial alignment. End users were observed in a challenging situation where they were forced to choose a particular threat-response behavior in an environment that often was in conflict between the stated organizational goals and managerial alignment with those goals. Neutralization and general deterrence theory was observed in end-user threat-response behaviors within the examined federal government agency, providing a basis for expanded research in this critical area of information security.