Explaining small business InfoSec posture using social theories

Eli Rohn, Gilad Sabari, Guy Leshem

Research output: Contribution to journalArticlepeer-review

5 Scopus citations


Purpose - This study aims to investigate information technology security practices of very small enterprises. Design/methodology/approach - The authors perform a formal information security field study using a representative sample. Using the Control Objectives for IT (COBIT) framework, the authors evaluate 67 information security controls and perform 206 related tests. The authors state six hypotheses about the findings and accept or reject those using inferential statistics. The authors explain findings using the social comparison theory and the rare events bias theory. Findings - Only one-third of all the controls examined were designed properly and operated as expected. About half of the controls were either ill-designed or did not operate as intended. The social comparison theory and the rare events bias theory explain managers's reliance on small experience samples which in turn leads to erroneous comprehension of their business environment, which relates to information security. Practical implications - This information is valuable to executive branch policy makers striving to reduce information security vulnerability on local and national levels and small business organizations providing information and advice to their members. Originality/value - Information security surveys are usually over-optimistic and avoid self-incrimination, yielding results that are less accurate than field work. To obtain grounded facts, the authors used the field research approach to gather qualitative and quantitative data by physically visiting active organizations, interviewing managers and staff, observing processes and reviewing written materials such as policies, procedure and logs, in accordance to common practices of security audits.

Original languageEnglish
Pages (from-to)534-556
Number of pages23
JournalInformation and Computer Security
Issue number5
StatePublished - 1 Jan 2016


  • Auditing
  • Business continuity
  • Computer security
  • Data protection
  • Disaster recovery
  • Resilience

ASJC Scopus subject areas

  • Management Information Systems
  • Software
  • Information Systems
  • Computer Networks and Communications
  • Information Systems and Management
  • Management of Technology and Innovation


Dive into the research topics of 'Explaining small business InfoSec posture using social theories'. Together they form a unique fingerprint.

Cite this