Duy Dang-Pham

Organizations are increasingly prioritizing the management of information security (InfoSec) to facilitate their data-driven business. There are densely connected organizational networks in modern organizations, where both formal and informal leaders influence other employees’ InfoSec behaviors. We analyzed the organizational networks in a large organization and investigated the interactions that made employees appear as influential InfoSec opinion leaders to their colleagues. The findings indicate that influential InfoSec opinion leaders were perceived by colleagues as knowledgeable in InfoSec and capable of rewarding and sanctioning InfoSec behaviors. Other traits such as formal seniority, age, tenure, and department membership were also found to increase InfoSec leadership.

While digital transformation creates opportunities across all industries, many organisations and practitioners struggle to grasp what conducting digital transformation entails and seek directions for how digital transformation programs, especially large and complex ones, can be executed. In response, recent studies have offered such directions and models for guiding digital transformation and put forward suggestions for steps and phases of digital transformation, as well as drivers, enablers, and inhibitors. Many of these proposals are based on the dynamic capabilities framework as a theoretical foundation and invite more research to develop further and/or to refine existing models for digital transformation, especially investigating how dynamic capabilities contribute to digital transformation. In this case study, we explore Digital Kaizen, a systematic approach to conduct large-scale digital transformation developed and applied at our case organisation FPT Software. This approach integrates the Kaizen philosophy into digital transformation practices that lead to digital improvements and transformation of some of the company’s human resource management processes and its business model. Our analysis and our reflections on our findings lead us to propose a novel Digital Kaizen process model for digital transformation informed by the dynamic capabilities framework.

IT consumerization, or the end-user’s adoption of consumer IT for work purpose, is an emerging topic which recently attracted the attention of researchers and practitioners. This research adopted social network analysis techniques to investigate the determinants of the social influence that resulted in IT consumerization, as well as the structural features of such influence’s network. By testing theoretically-based hypotheses with the exponential random graph modeling approach, our findings suggested that IT consumerization’s influence tended to occur between employees in the same department, coming especially from those who frequently gave work advice, life advice, and organizational updates to others, as well as those who were trusted for expertise by colleagues. The research revealed that IT consumerization’s influence was highly transitive, hierarchical, and non-reciprocal. The research concluded by elaborating future directions about the adoption of social network analysis techniques in technology adoption research, as well as practical recommendations about harnessing the determinants of such influence to manage IT consumerization.

Behavioural information security (InfoSec) research has studied InfoSec at workplaces through the employees’ perceptions of InfoSec climate, which is determined by observable InfoSec practices performed by their colleagues and direct supervisors. Prior studies have identified the antecedents of a positive InfoSec climate, in particular socialisation through the employees’ discussions of InfoSec-related matters to explain the formation of InfoSec climate based on the employees’ individual cognition. We conceptualise six forms of socialisation as six networks, which comprise employees’ provisions of (1) work advice, (2) organisational updates, (3) personal advice, (4) trust for expertise, (5) InfoSec advice, and (6) InfoSec troubleshooting support. The adoption of a longitudinal social network analysis (SNA), called stochastic actor-oriented modelling (SAOM), enabled us to analyse the changes in the socialising patterns and the InfoSec climate perceptions over time. Consequently, this analysis explains the forming mechanisms of the employees’ InfoSec climate perceptions as well as their socialising process in greater detail. Our findings in relation to the forming mechanisms of InfoSec-related socialisation and InfoSec climate, provide practical recommendations to improve organisational InfoSec. This includes identifying influential employees to diffuse InfoSec knowledge within a workplace. Additionally, this research proposes a novel approach for InfoSec behavioural research through the adoption of SNA methods to study InfoSec-related phenomena.

As organisations are developing people-centric security workplaces, where proactive security behaviours are fostered, it is important to understand more about the sources of security influence. This research applied social network analysis methods to investigate security influence within a large interior contractor in Vietnam. The findings revealed that security influence occurs between employees in the same department, particularly those in senior positions, have longer tenure or younger age. Engagement in daily work and security-related activities can also increase the likelihood of influencing security behaviours. Moreover, the security influence network is transitive and has a hierarchical structure.

Malware have been regarded as a persistent threat to both individuals and organisations due to its wide spread via various means of infection. With the increasing use of personal mobile devices and the trending adoption of Bring Your Own Device (BYOD) practices, this threat has become even more versatile and dreadful as it could hide behind the users’ typical and daily Internet activities. The importance of investigating whether the user’s intention to perform malware avoidance behaviours would change across multiple contexts is emphasised. Consequently, this study determines the contributing factors and compares their impacts on such intention by extending Protection Motivation Theory in two different contexts. A total of 252 Australian higher education students were surveyed when using mobile devices such as smartphone, laptop and tablet at home and at a BYOD-enabled university. Paired t-test, Bayesian structural equation modelling, and revised z-test were employed for data analysis. The empirical findings reveal that intention to perform malware avoidance behaviours differed across the contexts. Furthermore, the researchers found perceptions of self-efficacy and vulnerability to have different impacts on such intention and other variables in the model. As a result, such findings suggested developing community of practice and repeated trainings to maintain the users’ confidence in their own abilities to cope with malware threats. Message that focuses on the threats’ consequences was suggested to improve home users’ intention to avoid malware, along with a number of factors that could be critical to designing information security education programs. Moreover, these implications particularly address information security management at educational institutions that adopt BYOD policy. Finally, theoretical contributions include an extended model based on Protection Motivation Theory that reflects the users’ intention to avoid malware threats in BYOD context, from which directions for future research were also provided.