Information Technology Reference
In-Depth Information
technical know-how. We distributed a total of seventy-five surveys and received forty-nine com-
pleted surveys for a response rate of 65 percent. Respondents for this second phase of the study
were forty-nine students in information technology bachelor's and master's degree programs.
Because our primary interest lay in the list of behaviors rather than in individuals' responses,
we began our analysis of these data by aggregating category assignments and ratings across all
forty-nine respondents. To aggregate the categorical variable that designated the six categories of
behavior we took the modal response. In the case of three behaviors, there were ties (i.e., bimodal-
ity): In these cases, we chose one of the two modal categories at random. To aggregate the two rat-
ing variables, we calculated both the mean and the standard deviation across all forty-nine
responses. The mean provided a single index of each behavior's standing on the intentionality
scale and the expertise scale. The standard deviation provided an index of disagreement among
raters about the status of intentionality and the degree of required expertise for each behavior.
We ran a two-factor MANOVA on the aggregated mean ratings, using individual behaviors as
cases and mean scores on expertise and intentionality as the dependent variables. The multivari-
ate omnibus tests were statistically significant for the expertise categorization factor, F(2,87)
92.5, p
.001. The
alert reader will recognize that the F-values for the main effects signify substantial effect sizes.
Indeed, the eta-squared value for the main effect of expertise categorization was .68 and the eta-
squared value for the main effect of intentionality was .69: Both values can be interpreted as large
effect sizes (Cohen, 1992). These effect sizes support the success of the categorization scheme by
demonstrating that the means for the two conditions of expertise appeared at substantially different
points on our five-point scale and that the three conditions of intentionality did likewise. Further,
the ordering of the means was, in all cases, as one would expect, with the means for low expertise
and malicious intent near the bottom of their respective scales and the means for high expertise
and benevolent intent near the top of their respective scales.
Possibly more interesting are the contents of Table 12.1. This table provides a view of the
items that generated the most disagreements (i.e., a high standard deviation among the set of
forty-nine ratings provided by the respondents on a particular item), with the top five items focus-
ing on disagreements on expertise and the bottom five items focusing on disagreements on inten-
tionality. Note that the smallest standard deviation for any item was .47, so the values in this table
(up to three times as large) suggest substantial disagreements on the items highlighted here. Note
that the three out of five expertise items pertain to training. Possibly, raters were unsure whether
they should rate the actor's expertise prior to the training or following it. For intentionality, it is
interesting to note that the stated behaviors may in some cases be legitimate for incumbents in certain
roles (e.g., security specialists) while being inappropriate for other roles (e.g., regular employ-
ees), and the absence of information about the actor's position in the organization may have made
judging intentionality more difficult in these cases. Another note of interest about the last five
behaviors in Table 12.1 is that they are all actions with serious import: Their ultimate results or
implications could have substantial negative effects on the organization.
To recap, our goal in this second phase of research was to transform a raw list of security-
related behaviors into a more manageable taxonomy with recognizable dimensions that had logical
and definitional appeal. Our results suggest that we achieved a degree of success in this goal. While
just three of the ninety-four behaviors failed to generate a clear majority vote, for the remaining
ninety-one behaviors a consensus emerged on where that behavior belonged in our six-element
taxonomy. Further, when we used this consensus as a basis for comparing ratings of expertise and
intentionality (the two dimensions of our taxonomy) statistical analysis of mean ratings clearly
showed that as a group our raters assigned normative levels of expertise and intentionality
.001, and for the intentionality categorization factor, F(4,174)
98.8, p
Search WWH ::
Custom Search