Comparing intention to avoid malware across contexts in a BYOD-enabled Australian university: A Protection Motivation Theory approach.

Malware have been regarded as a persistent threat to both individuals and organisations due to its wide spread via various means of infection. With the increasing use of personal mobile devices and the trending adoption of Bring Your Own Device (BYOD) practices, this threat has become even more versatile and dreadful as it could hide behind the users' typical and daily Internet activities. The importance of investigating whether the user's intention to perform malware avoidance behaviours would change across multiple contexts is emphasised. Consequently, this study determines the contributing factors and compares their impacts on such intention by extending Protection Motivation Theory in two different contexts. A total of 252 Australian higher education students were surveyed when using mobile devices such as smartphone, laptop and tablet at home and at a BYOD-enabled university. Paired t-test, Bayesian structural equation modelling, and revised z-test were employed for data analysis. The empirical findings reveal that intention to perform malware avoidance behaviours differed across the contexts. Furthermore, the researchers found perceptions of self-efficacy and vulnerability to have different impacts on such intention and other variables in the model. As a result, such findings suggested developing community of practice and repeated trainings to maintain the users' confidence in their own abilities to cope with malware threats. Message that focuses on the threats' consequences was suggested to improve home users' intention to avoid malware, along with a number of factors that could be critical to designing information security education programs. Moreover, these implications particularly address information security management at educational institutions that adopt BYOD policy. Finally, theoretical contributions include an extended model based on Protection Motivation Theory that reflects the users' intention to avoid malware threats in BYOD context, from which directions for future research were also provided.