A comparative study on structure of the motivation for information security by security incident experiences

Clarifying information security motivation factors and their structure helps to promote information security. In this study, we conducted a questionnaire survey about drives and disincentives that affect the implementation of information security measures. Using the answers from the 932 respondents, we conducted Exploratory Factor Analysis. The result showed a number of motivation factors for information security, including six drives and five disincentives. We also verified the validity of the structural model of those factors using Structural Equation Modeling (SEM) and came up with a motivation structure concerning information security. We further examined commonality and differences in motivation structures for those who have had security incidents, those who haven't, and those who have had near-but-not-real incidents. Regardless of having such experience or not, the three groups had commonality in their motivation structures but there were some differences in individual factors.