Segurança da informação entre sêniores: aspectos de afastamento a boas práticas em uma organização sergipana

Abstract

In a scenario where estimates indicate a greater participation of senior people, or individuals over 55 years of age, in the labour market in the coming years, possible risks to information security arising from an aging workforce with less technical knowledge about threats and defense techniques are a point of attention for organizations, increasingly dependent on digital information systems (IS). That said, the present study aimed to investigate the perception of seniors regarding aspects of information security awareness (ISA) in a corporate environment, identifying factors that keep these people away from the best information protection practices in a public sector company in the state of Sergipe. The ISA is divided into cognitive, behavioral and processes aspects, which represent the dimensions that constitute the safe use of technology in an organizational environment. A single, case-cohort qualitative case study was conducted, with a descriptive and exploratory approach, with data collected through interviews, guided by a semi-structured script and by observation of the company's daily activities. Data were analyzed via content analysis. The results of the research indicate the following among the factors that separate seniors from the best practices in IS: limited contact with the company's information technology specialists, practice that tends to provide a greater exchange of technical quality knowledge; a reduced technical perception of threats to information security, not being aware of the extent of damage from unsafe behavior; a lower degree of commitment to the organization's information security objectives, represented by the lack of concern with possible harm to the company, with concerns limited to personal harm; a poor communication by the organization's information technology management, due to the lack of sending alert messages and reminders to employees; the lack of involvement of managers and directors of the organization, either in the incentive, giving example or charge/accountability in case of unsafe behavior; and a low adherence to training, possibly influenced by low interest and a low sense of self-efficacy in operating digital devices.