Managing the organizational and people-related issues in information security is recognized as an essential element of the effective management of information security. The heavy reliance of individuals and organizations on Information Systems (IS) requires them to deal with the risks associated with those systems. Hence, information security is one of the top priorities of managers in many organizations, as well as for the individual IS users, since risks related to information security may result in consequences ranging from monetary damage to loss of credibility. While technology-based solutions are important to ensure information security, they are not sufficient to deal with ever changing security threats. As the focus in information security has shifted towards individual and organizational perspectives, information security awareness has emerged as one of the key socio-organizational resources. Although these observations are prevalent in all security related discussions in practice, academic literature has not yet studied information security awareness systematically. There is still a lack of theorizing about, and empirical support for the conceptualization and the impacts of information security awareness in the literature.
My research aims to create a deeper understanding on the role of Information Security Awareness as a tool to manage information security. My first goal is to develop a better understanding of Information Security Awareness by proposing a definition for the construct as well as identifying its dimensions and drivers. Second, I aim to understand the impact of Information Security Awareness on individual IS users’ behaviors regarding information privacy and security. I believe that the findings of these studies would particularly be important to develop the foundations of IS security and privacy education of the future.