Enhancing cyber security behavior: an internal social marketing approach

• Published in: Information and computer security 2019-10, Vol.28 (2), p.133-159
• Main Authors: Pham, Hiep Cong, Brennan, Linda, Parker, Lukas, Phan-Le, Nhat Tram, Ulhaq, Irfan, Nkhoma, Mathews Zanda, Nhat Nguyen, Minh
• Format: Article
• Language: English
• Subjects: Compliance; Cybersecurity; Employees; Infrastructure; Marketing; Quality of service; Security management; Social marketing; SWOT analysis; User behavior
• ISSN: 2056-4961; 2056-497X; 2056-4961
• DOI: 10.1108/ICS-01-2019-0023

Purpose Understanding the behavioral change process of system users to adopt safe security practices is important to the success of an organization’s cybersecurity program. This study aims to explore how the 7Ps (product, price, promotion, place, physical evidence, process and people) marketing mix, as part of an internal social marketing approach, can be used to gain an understanding of employees’ interactions within an organization’s cybersecurity environment. This understanding could inform the design of servicescapes and behavioral infrastructure to promote and maintain cybersecurity compliance. Design/methodology/approach This study adopted an inductive qualitative approach using in-depth interviews with employees in several Vietnamese organizations. Discussions were centered on employee experiences and their perceptions of cybersecurity initiatives, as well as the impact of initiatives on compliance behavior. Responses were then categorized under the 7Ps marketing mix framework. Findings The study shows that assessing a cybersecurity program using the 7P mix enables the systematic capture of users’ security compliance and acceptance of IT systems. Additionally, understanding the interactions between system elements permits the design of behavioral infrastructure to enhance security efforts. Results also show that user engagement is essential in developing secure systems. User engagement requires developing shared objectives, localized communications, co-designing of efficient processes and understanding the “pain points” of security compliance. The knowledge developed from this research provides a framework for those managing cybersecurity systems and enables the design human-centered systems conducive to compliance. Originality/value The study is one of the first to use a cross-disciplinary social marketing approach to examine how employees experience and comply with security initiatives. Previous studies have mostly focused on determinants of compliance behavior without providing a clear platform for management action. Internal social marketing using 7Ps provides a simple but innovative approach to reexamine existing compliance approaches. Findings from the study could leverage proven successful marketing techniques to promote security compliance.