1. Introduction
The weakest link in a security system is most often the human factor (Schneier, 2004). It is widely accepted, and well documented, that cyber security breaches cannot be prevented through the implementation of solely technical solutions (Furnell et al., 2006, Parsons et al., 2014, Schultz, 2005). This has been supported by security and incident reports, international security standards, and peer reviewed literature. For example, IBM Global Technology Services (2015) determined that breaches were often unintentional and that over 95% were the result of human error. Standards Australia Limited (2015) released a code of practice outlining information security controls, which recommends an emphasis on human resource security, thereby recognising the liability of the human in information security.
In recent years there has been an increased focus on better understanding the characteristics of employees and how they can affect an organisation’s information security (McCormac et al., 2017c, Shropshire et al., 2006). Research has shown that organisations may reduce the risk of a security breach by 45% to 70% through improvements to employee behaviour (Wombat Security Technologies and Aberdeen Group, 2015). In line with this, the current study examined the relationships between resilience, job stress and Information Security Awareness (ISA). Essentially, it is likely that employees who are more resilient may be better at coping with job stress, and may therefore have better ISA. Throughout the following sections we introduce the main constructs considered in this study, namely, resilience, job stress and ISA.