Comportamento humano em segurança da informação: estudo aplicado às Universidades Federais do Brasil

Abstract

As an essential element for the development of the society, responsible for technological, administrative and organizational transformations, information has been considered one of the most important assets for organizations. Due to the importance of these information assets, organizations, in general, need to protect them against destruction, temporary unavailability, tampering or unauthorized disclosure. In this sense, the management of information assets, an important pilar of organizational progress, needs to consider the applicability of information security as one of the essential procedures of its strategy, based on a complete approach where technologies, organizational norms and human are dimensions contemplated, in view of the urgent need to apply an interdisciplinary approach in which the human factor must play a fundamental role. In this context, this research aimed to analyze the behavior in information security of public employees of federal universities in Brazil, from the perspective of the Theory of Protection Motivation. Therefore, the research was characterized as applied, whose objectives classify it as descriptive and correlational with support in the quali-quantitative approach, where interviews with specialists and the application of online questionnaires to public employees, managers of information security, as well as public employees in general were used (technicians and professors) from federal universities all over Brazil. And, for data analysis, we applied descriptive and inferential statistics. The results indicated that, of the controls related to human behavior, the information security policy, the physical access control and the e-mail usage policy are the most used. Information security awareness and training are still poorly addressed by universities. With regard to the quantitative aspect, the correlation analysis between the variables of this research made it possible to understand the relationship between the Theory of Protection Motivation and the intention of the employees' prevention behavior, since both the primary variables of the Theory of Motivation of Protection (perceived vulnerability, perceived threat severity, response effectiveness and self-efficacy), with the exception of response cost, as well as the variables added to the model (perceived severity of sanctions, injunctive norms, descriptive norms, awareness, capacity building and policy strengthening) both showed a significant relationship with prevention behavior. The identification of the variables that showed a significant relationship with the intention of information security prevention behavior shows a direction to achieve an increase in this behavioral intention and, thus, contribute to the reduction of the number of security incidents in federal public universities of Brazil. Therefore, this study not only expands our theoretical understanding of the intention of prevention behavior, but also provides practical guidance to universities on strategic actions aimed at the behavior of the employees at these institutions.