[Paper Review] Factors Influencing the Adoption of Cloud Incident Handling Strategy: A Preliminary Study in Malaysia

Nurul Hidayah Ab Rahman, Kim‐Kwang Raymond Choo|arXiv (Cornell University)|May 12, 2015

Information and Cyber Security34 references9 citations

TL;DR

This study investigates factors influencing cloud incident handling strategy adoption in Malaysian organizations using Protection Motivation Theory (PMT) and Situation Awareness (SA) models. Surveying 40 users and interviewing four organizations, it finds that perceived vulnerability, self-efficacy, response efficacy, and perceived severity significantly predict strategy adoption, highlighting their critical role in successful implementation.

ABSTRACT

This study seeks to understand the factors influencing the adoption of an incident handling strategy by organisational cloud service users. We propose a conceptual model that draws upon the Situation Awareness (SA) model and Protection Motivation Theory (PMT) to guide this research. 40 organisational cloud service users in Malaysia were surveyed. We also conduct face-to-face interviews with participants from four of the organisations. Findings from the study indicate that four PMT factors (Perceived Vulnerability, Self-Efficacy, Response Efficacy, and Perceived Severity) have a significantly influence on the adoption of cloud incident handling strategy within the organisations. We, therefore, suggest a successful adoption cloud incident handling strategy by organisational cloud service users involves the nexus between these four PMT factors. We also outline future research required to validate the model.

Motivation & Objective

• To identify factors influencing the adoption of cloud incident handling strategies among organizational cloud service users in Malaysia.
• To examine how psychological motivations, as defined by Protection Motivation Theory (PMT), affect organizational decisions to adopt incident handling strategies.
• To explore the role of situation awareness in shaping organizational responses to cloud security incidents.
• To develop a conceptual model integrating PMT and SA for understanding cloud incident handling adoption.

Proposed method

• A mixed-methods approach combining quantitative surveys with qualitative face-to-face interviews was employed.
• The study surveyed 40 organizational cloud service users across various sectors in Malaysia.
• Semi-structured interviews were conducted with participants from four organizations to gain deeper insights into incident handling practices.
• A conceptual model was developed by integrating Protection Motivation Theory (PMT) and Situation Awareness (SA) framework.
• Data analysis focused on identifying significant predictors of incident handling strategy adoption using PMT constructs.
• The model was validated through thematic analysis of interview data and statistical evaluation of survey responses.

Experimental results

Research questions

• RQ1 What factors significantly influence the adoption of cloud incident handling strategies among organizational cloud service users in Malaysia?
• RQ2 How do perceived vulnerability, self-efficacy, response efficacy, and perceived severity (from PMT) affect the likelihood of adopting an incident handling strategy?
• RQ3 To what extent does situation awareness influence organizational readiness for cloud incident handling?
• RQ4 How do organizational perceptions and behaviors align with PMT-based psychological motivations in cloud security contexts?

Key findings

• Perceived vulnerability significantly influences the likelihood of adopting a cloud incident handling strategy among Malaysian organizations.
• Self-efficacy—confidence in the ability to implement incident handling—was a key driver of strategy adoption.
• Response efficacy, or belief in the effectiveness of incident handling measures, significantly predicted adoption behavior.
• Perceived severity of potential cloud incidents was a strong motivator for adopting formal incident handling strategies.
• The integration of PMT factors into a unified model effectively explains variations in incident handling strategy adoption across organizations.
• The study confirms that psychological motivations, particularly those from PMT, are central to organizational decisions on cloud security preparedness.