In congruent with SM practitioners and researchers, SM is often defined as “a group of internet-based applications built on ideological and technological foundation of Web 2.0 concepts, which enables creation, modification, and sharing of user-generated contents online” [10] [11]. In this case, SM usage domain entails the social dimension, and technical dimension, respectively [1] [6]. Generally, the key roles of SM usage include relationship development, information sharing, self-presentation, and entertainment [12] [13] [14] [15]. For instance, Facebook, Twitter, and LinkedIn are mainly used for relationship development, while Instagram, YouTube, and Snapchat are known for sharing multimedia contents online [16]. Notably, the unique characteristics of SM usage are its ability to enable individual users to subjectively create, modify, and share user-generated contents online. Relatively, the design of the traditional information security systems is characterized by objectivity, while SM usage embraces both objectivity, and subjectivity principles [1] [10]. Therefore, with respect to information security management, the subjective, liberal and transparence nature of SM operations propagates new information security challenges associated with mainly the social (behavioral) aspect of SM usage [5] [6]. According to [6], the main information security challenges associated with SM usage include; confidentiality, litigation, and information overload [6].

Nevertheless, from the technical (objective) perspective, various SM platforms are enhanced with customizable security functions to support SM users in managing information security [6] [17]. For instance, Facebook and Twitter use two-factor verification principles: passwords as well as verification codes established using mobile devices. This authentication process helps to diminish the risk of compromising user accounts, and could avert attackers from appropriating an authentic account [17]. Furthermore, Facebook users can adjust security configurations and select users who can view their contents, and sensitive information. It can also authorize the users to allow or deny accessibility to a third party to their private contents. On the other hand, WhatsApp communication is end-to-end encrypted between two parties. The other key information security settings include: firewall settings, anti-virus, anti-spam filter, VPN setting, intrusion detection, etc. [6]. This, therefore, could imply that much of the reported risks and breaches associated with SM usage could emanate from the social (behavioral) aspect of SM usage, such as lack of knowledge, weak policy, education/training in SM usage, etc. [2] [5] [6] [18]. Since the technical aspect are enhanced with capabilities to manage and mitigate some of the dominant information security risks associated with SM usage [17].

The phrase “socio-technical information system” embraces and mainly two dimensions of information systems: the social (people, and structures) dimension and technical (technology, and tasks) dimension [4] [7] [8]. In this case, the social dimension consists of SM users, and organizational structures including; responsibilities, rules, and policies that guide SM users in achieving the intended tasks [19]. Synonymously, the technical dimension entails the technology artifact, and knowledge required to translate system inputs into outputs [20]. On the other hand, the term usable security refers to the technical aspect of information security functions, and the usability (visibility, learnability, satisfaction, etc.) of those functions [7] [8]. Ferreira et al. (2014) define a usable-security information system as “one that is secure technically, even when used by people”. In this case, information security system which is secure technically, but difficult to use is less secure. Therefore, with respect to usable-security principles, the social, and technical dimensional factors could be identified as usability factors, and security factors, respectively [4] [7]. Altogether, the relevant factors were then identified, examined and validated, accordingly.

The study followed literature search techniques, using mainly web of science databases. The strategy used in literature search includes Boolean keyword search, and citation guide. The relevant literatures were identified, and their contents scrutinized, in line with study objective. Afterwards, the key factors were verified and sanctioned for validation process. Both theoretical and empirical methods of validation were used. Thus, Theoretical validity test was conducted on 45 Likert scale items, using validity form, and involving 10 subject experts (reviewers). The expert was selected from Mbarara University of Science and Technology (MUST), and Kampala International University (KIU), all in Uganda. The validity process focused on “relevancy”, and “clarity” of the items. From the score ratings of the reviewers, Content Validity Index (CVI) was calculated using mean score values, at acceptable levels of CVI ≥ 0.78 [21]. On the other hand, empirical method was employed in reliability test conducted on 45 Likert scale items, using questionnaire, and involving 32 respondents. The respondents were selected from MUST and KIU, accordingly. Afterwards, Cronbach’s alpha coefficient (α-values) was then generated on SPSS, at acceptable range of 0.70 ≤ α ≤ 0.90 [22]. Overall, the results for both literature search and validation process (validity test, and reliability test) are presented in section 3, accordingly.

The strategies used in literature search include; keyword search, and citation guides, employing mainly web of science databases. Relatively, the criteria settings in web of science search engine match with the study theme, and objectives [23]. To optimize the accuracy and relevancy of search results, Boolean search criteria were used to configure the searches. The main sets of Boolean keywords used to initiate the search process include; “Social Media usage AND information security”; “socio-technical”; “usable-security”. The other search criteria used to filter and streamline the search results further include; sort by relevance (keywords), availability of source (online, open access, and peer reviewed), resource type (article, and books), subject area (keywords), literature date range (2012 to 2022), and language used (English) [23]. The relevant literatures were then filtered, scrutinized, and presented using literature summary table. The main attributes used to summarize the literatures include; the author, country, research purpose, methodology used, type of source, and summary points (factors). Subsequently, the key SM socio-technical information security factors were identified from the relevant literatures, and sanctioned for validation process. However, some of the relevant literatures excluded by search criteria were scrutinized to substantiate some of the relevant facts mentioned in the literatures.

Validation process was then conducted to evaluate the key factors identified. The process used included theoretical validity test, and reliability test methods. Thus validity test was conducted on 45 Likert scale items, using validity form, and involving 10 subject experts (reviewers). The validity form was developed based on 4-points Likert scale rating, focusing on the “relevancy”, and “clarity” of the items. The form contained section on instructions to reviewers, demographic profiles, and the factors. Each item for “relevancy” was developed with responses (rating) ranging from “not relevant—1, item need some revision—2, relevant but need minor revision—3, very relevant—4”. Similarly, for “clarity”, the measures ranges from “not clear—1, item need some revision—2, clear but need minor revision—3, very clear—4” [21]. The experts used were experienced lecturers, and researchers from MUST and KIU, with MSc, and PhD qualifications. From the score ratings of the experts, Content Validity Index (CVI) was calculated using mean score values, at acceptable levels of CVI ≥ 0.78 [21]. The detailed CVIs results, are presented in Section 3, accordingly.

On the other hand, reliability test was conducted on 45 Likert scale items, using questionnaire, and involving 32 respondents. Each questionnaire item was developed with a 5-point Likert scale, with measures ranging from “strongly disagree—1, disagree—2, neutral—3, agree—4, and strongly agree—5” [21] [24]. The respondents used were students, and staff from Mbarara University of Science and Technology (MUST), and Kampala International University (KIU), accordingly. The study selected higher institutions of learning because SM usage is more prevalent in higher education, than the other formal settings in Uganda [25] [26]. Data were then collected, processed, and captured into SPSS for analysis. Cronbach’s alpha coefficient (α-values) was generated, at acceptable range of 0.70 ≤ α ≤ 0.90 [22] [24]. Overall, the detailed results are presented in section 3, accordingly.

The main sets of Boolean keywords used to initiate the search process include; “Social Media usage AND information security”; “socio-technical”; and “usable-security”. The other search criteria used to filter and streamline the results further included; sort by relevance (keywords), availability of source (peer reviewed journals), resource type (journal articles), subject area (keywords), literature date range (2012 to 2022), and language used (English). At the onset of literature search process, the Boolean keywords; “Social Media usage AND information security”, search results retrieved 170 literatures. However, after applying the other search criteria, the results were reduced to 99 literatures. Afterwards, the 99 literatures were scrutinized using citation guide and 13 literatures were found relevant to the study. The other sets of keywords used in the search process include; “socio-technical”, and “usable-security”. For each set of the keyword, the relevant literatures were 4 out 15 literatures retrieved, and 3 out of 14 literatures retrieved, respectively.

However, after applying search criteria using Boolean keywords; “Social Media usage AND socio-technical factors”, in line with the study gap, only 1 literature was retrieved, even after adjusting the date range criteria from 2012 to 2000 [3]. With respect to study gap, no literature was returned with the Boolean keywords; “Social Media usage AND socio-technical AND usable-security”. Overall, the key factors identified from the relevant literatures include; SM usage and information security factors (SMISF), socio-technical information security factors (STF), and information system usable-security factors (USF). TableA1 (Appendix A) presents the set of 20 relevant literatures, indicating the authors, country, study purpose, methodology used, type of source, and summary of key points (factors).

From TableA1 (Appendix A), factors appearing in all the 3 main sets of Boolean key words search (SMISF, STF and USF) were considered appropriate, and relevant for inclusion into the list of SM socio-technical information security factors. In this case, the key factors identified and examine under social dimension include; 1) usability factors—visibility, learnability and satisfaction, 2) training and education factors—help and documentation [9] [26] [27] [28]. On the other hand, the key factors identified under technical dimension include; 3) SM technology development factors—error handling, and process revocability; 4) information security factors—security, privacy and expressiveness [4] [9]. Therefore, with respect to SM usage, the relevant factors would be the common factors of the set elements represented by intersection of the 3 sets, (SMISF Ո STF Ո USF) [4]. Figure 1 below present a venn-diagram indicating the common factors of the set elements denoted by the 3 sets (SMISF Ո STF Ո USF); SM information security factors (SMISF), socio-technical factors (STF), and useable-security factors (USF), accordingly.

After identifying the relevant SM socio-technical information security factors, questionnaire and validity forms, were developed. The questionnaire items were adopted from validated information security principles developed by [4] Mujinga, Eloff & Kroeze (2019), and moderated to suit the study objectives. Each questionnaire item was developed with a 5-point Likert scale measures, with responses ranging from “strongly disagree—1, disagree—2, neutral—3, agree—4, and strongly agree—5”. The items were then revised to conform to positively worded questions. Thus, factors with “agree” and “strongly agree” would therefore mean better information security compliance, while low agreement levels such as “disagree” and “strongly disagree” would mean vulnerable or weak information security compliance. On the other hand, the 4-point Likert scale measures on the “relevancy” of the items include; “not relevant—1, item need some revision—2, relevant but need minor revision—3, very relevant—4”. Similarly, for “clarity”, the measures ranges from “not clear—1, item need some revision—2, clear but need minor revision—3, very clear—4”. Afterwards, the contents (factors and items) of the questionnaire instrument, and validity forms were then developed, and operationalized on separate templates. However, TableB1 (Appendix B) present the contents of the questionnaire, and validity form on a single template.

The experts used in this study were information security lecturers, including ICT professionals from Mbarara University of Science and Technology (MUST), and Kampala International University (KIU), all in Uganda. The main attributes that guided the selection of the experts were qualifications (MSc. and PhD.), area of specialty, and year of experience in academics, and research [21]. Altogether, 10 experts were identified, and individually given validity forms with clear instruction, to independently complete the form. More so, they were verbally briefed, and guided on the study purpose, and how to complete the form, and they all consented. Table 1 presents the demographic profiles of the experts.

The respondents used in this study were mainly students, including few staff from Mbarara University of Science and Technology (MUST), and Kampala International University (KIU), accordingly. The study preferred higher institutions of learning because SM usage is more prevalent in higher education, than the other formal settings in Uganda [25] [26]. Table 2 below summarizes and presents the demographic profiles of the respondents, showing the representativeness of the sample characteristics within the category divides. Thus, indicating the frequency counts, and the corresponding percentage distributions, respectively.

Altogether, 32 respondents were given questionnaire to complete. Afterwards, the questionnaires were collected, processed, and captured into SPSS for analysis. In this case, the 10 experts were used in validity test, which was concerned with “how the measures sufficiently represent the construct that it was supposed to measure”. While the 32 respondents were used in reliability test, which was mainly concerned with “the extent to which the measure of the construct is consistent and dependable” [21]. Table 3 below summarizes and presents the results for the key factors, indicating percentage level of agreement on the items for each factor, accordingly. (n = 32; MUST n = 14, KIU n = 18).

From Table 3, the level of percentage agreement on each factor, combining “agree” + “strongly agree”, include; visibility (MUST 40%; KIU 37%), learnability (MUST 40%; KIU 41%), satisfaction (MUST 42%; KIU 41%), errors handling (MUST 35%; KIU 37%), revocability (MUST 42%; KIU 32%), help and documentations (MUST 42%; KIU 37%), security (MUST 41%; KIU 35%), privacy (MUST 42%; KIU 40%), expressiveness (MUST 42%; KIU 38%). Relatively, MUST response shows slight over-edge in percentage agreement level compared to KIU, which could imply slightly better SM usage security compliance at MUST compared to KIU. However, the validity, and reliability test results explain the consistency levels within the datasets, as presented in the subsequent sections below.

Validity test was conducted on data generated through validity form, using 45 Likert scale items, and involving 10 subject experts. From the score ratings of the experts, Content Validity Index (CVI) was calculated using mean score values, at acceptable level of CVI ≥ 0.78 [21]. Table 4 presents validity test results for the 9 factors, based on the relevancy, and clarity of the items.

From Table 4, factors with strong validity index include; 1) usability factors —learnability and satisfaction. 2) SM technology development factors—error handling, and process revocability; 3) information security factors—security, and privacy. On the other hand, factors with weak validity index include; 1) usability factors—visibility, 2) training and education factors—help and documentation, and 3) Information security factors—expressiveness. Notably, all the factors with weak validity items were recorded under “clear but need minor revision—3” option. Therefore, as guided by the experts, the question statements were reviewed and revised accordingly. The revised items include; 1) Visibility: Social Media help function is visible, for instance, a key branded with the word “HELP” instead of “HELP or a special menu”. 2) Help and documentation: Social Media system visibly “shows” instead of “displays” the current selection/data input field. 3) Expressiveness: Social Media system can “prompt the user with” instead of “tell” the security state of the system and the alternatives for security-related actions if needed. Altogether, 9 factors were reasonable considered valid, and were sanctioned for reliability test based on the data collected from 32 respondents.

Reliability test was conducted on 45 Likert scale items, using questionnaire, involving 32 respondents. The respondents used were students, and staff from Mbarara University of Science and Technology (MUST), and Kampala International University (KIU), accordingly. Each item was developed with a 5-point Likert scale, with measures ranging from “strongly disagree—1, disagree—2, neutral—3, agree—4, and strongly agree—5” [21] [24]. Subsequently, Cronbach’s alpha (α) values were then generated to reveal the consistency in the responses within the dataset. Items with Cronbach’s Alpha values (α ≥ 0.70) were considered strong reliability items, while those with Cronbach’s Alpha values between 0.50 to 0.70 were considered moderate reliability items, and those with Cronbach’s Alpha values (α < 0.50) were considered weak reliability items [29] [21] [24]. Table 5 below presents the summary of reliability test results for the items under each factor, indicating the Cronbach’s alpha (α) values for each factor, and the conclusion thereof.

From Table 5 above, all the 9 factors attained the acceptable level of reliability. However, the reliability result for revocability factor did not meet the minimum value range of 0.70 ≤ α ≤ 0.90. Altogether, the validated and maintained factors under social dimension include; 1) usability factors—visibility, learnability and satisfaction, 2) training and education factors—help and documentation. Meanwhile, the factors identified under technical dimension include; 3) SM technology development factors—error handling, and process revocability; 4) information security factors—security, privacy and expressiveness [4] [9] [30]. Overall, the relevance of the 9 factors is based on the process followed in this study, notwithstanding the study limitations. However, the following sections cover discussion of the results.