A Novel Framework to Enhance End-User Security Compliance

Protecting assets within organizations through technological measures continues to remain an ongoing problem in the cyber security domain.There is extensive literature pointing to the "humanelement" being a significant factor in security breacheswhether than be intentional or unintentional.Current endeavors to raise the level of information security awareness within individuals have arguably not been effective as requiredevidenced by the ongoing breaches caused by people.Indeed, enhancing user's security practice and behavior is a multifaceted problem and remains a challenging issue.The paper first presents the results of a survey whose findings revealed there is a lack of knowledge, and security barriers among a notable portion of respondents.The findings also revealed a discrepancy that while respondents claimed to do and know, do not represent their actual security knowledge and behaviours/practices.The paper then proposes a framework and focuses on enhancing individual user's security compliance in real-time through an intervention-based approach.The proposed framework continuously identifies users' security behaviours in relation to their individual role/job responsibilities and prior training to provide an intelligent, targeted and tailored intervention.The framework comprises various interconnected components and utilizes several sources including active evaluation, monitoring, role/job responsibilities, and manager observations to feed into an assessment of the individual users' needs.Different mechanisms seek to identify the reasons behind their non-compliance; and provide a targeted and tailored series of interventions to maximize the likelihood of improved security behaviours and compliance.