Many organizations recognize that their employees, who are often considered the weakest link in information security, can also be great assets in the effort to reduce risk related to information security. Since employees who comply with the information security rules and regulations of the organization are the key to strengthening information security, understanding compliance behavior is crucial for organizations that want to leverage their human capital.

This research identifies the antecedents of employee compliance with the information security policy (ISP) of an organization. Specifically, we investigate the rationality-based factors that drive an employee to comply with requirements of the ISP with regard to protecting the organization's information and technology resources. Drawing on the theory of planned behavior, we posit that, along with normative belief and self-efficacy, an employee's attitude toward compliance determines intention to comply with the ISP. As a key contribution, we posit that an employee's attitude is influenced by benefit of compliance, cost of compliance, and cost of noncompliance, which are beliefs about the overall assessment of consequences of compliance or noncompliance. We then postulate that these beliefs are shaped by the employee's outcome beliefs concerning the events that follow compliance or noncompliance: benefit of compliance is shaped by intrinsic benefit, safety of resources, and rewards, while cost of compliance is shaped by work impediment; and cost of noncompliance is shaped by intrinsic cost, vulnerability of resources, and sanctions. We also investigate the impact of information security awareness (ISA) on outcome beliefs and an employee's attitude toward compliance with the ISP.

Our results show that an employee's intention to comply with the ISP is significantly influenced by attitude, normative beliefs, and self-efficacy to comply. Outcome beliefs significantly affect beliefs about overall assessment of consequences, and they, in turn, significantly affect an employee's attitude. Furthermore, ISA positively affects both attitude and outcome beliefs. As the importance of employees' following their organizations' information security rules and regulations increases, our study sheds light on the role of ISA and compliance-related beliefs in an organization's efforts to encourage compliance.

Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness

http://homepages.se.edu/cvonbergen/files/2013/01/Fifty-Years-of-the-Barratt-Impulsivenss-Scale_An-Update-and-Review.pdf

Fifty years of the Barratt Impulsiveness Scale: An update and review

As corporate scandals proliferate, practitioners and researchers alike need a cumulative, quantitative understanding of the antecedents associated with unethical decisions in organizations. In this meta-analysis, the authors draw from over 30 years of research and multiple literatures to examine individual ("bad apple"), moral issue ("bad case"), and organizational environment ("bad barrel") antecedents of unethical choice. Findings provide empirical support for several foundational theories and paint a clearer picture of relationships characterized by mixed results. Structural equation modeling revealed the complexity (multidetermined nature) of unethical choice, as well as a need for research that simultaneously examines different sets of antecedents. Moderator analyses unexpectedly uncovered better prediction of unethical behavior than of intention for several variables. This suggests a need to more strongly consider a new "ethical impulse" perspective in addition to the traditional "ethical calculus" perspective. Results serve as a data-based foundation and guide for future theoretical and empirical development in the domain of behavioral ethics.

Bad Apples, Bad Cases, and Bad Barrels: Meta-Analytic Evidence About Sources of Unethical Decisions at Work

Enterprises establish computer security policies to ensure the security of information resources; however, if employees and end-users of organisational information systems (IS) are not keen or are ...

https://link.springer.com/content/pdf/10.1057%2Fejis.2009.6.pdf

Protection motivation and deterrence: a framework for security policy compliance in organisations

Intentional insider misuse of information systems resources (i.e., IS misuse) represents a significant threat to organizations. For example, industry statistics suggest that between 50%--75% of security incidents originate from within an organization. Because of the large number of misuse incidents, it has become important to understand how to reduce such behavior. General deterrence theory suggests that certain controls can serve as deterrent mechanisms by increasing the perceived threat of punishment for IS misuse. This paper presents an extended deterrence theory model that combines work from criminology, social psychology, and information systems. The model posits that user awareness of security countermeasures directly influences the perceived certainty and severity of organizational sanctions associated with IS misuse, which leads to reduced IS misuse intention. The model is then tested on 269 computer users from eight different companies. The results suggest that three practices deter IS misuse: user awareness of security policies; security education, training, and awareness (SETA) programs; and computer monitoring. The results also suggest that perceived severity of sanctions is more effective in reducing IS misuse than certainty of sanctions. Further, there is evidence that the impact of sanction perceptions vary based on one's level of morality. Implications for the research and practice of IS security are discussed.

User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach

Analysis of end user security behaviors

This study reports the development of an instrument to assess the motives of marathon runners. The Motivations of Marathoners Scales (MOMS) contains 56 items distributed across nine scales. Content areas covered included health orientation, weight concern, self-esteem, life meaning, psychological coping, affiliation, recognition, competition, and personal goal achievement. Adequate internal consistency (Cronbach's alpha range .80 to .93), retest reliability (intraclass Rs range .71 to .90), and factorial validity of the scales were demonstrated. Assessment of the relationship between individual MOMS scales and other variables of conceptual relevance documents early evidence for the convergent and, discriminant validity of the instrument. Future uses of the MOMS are discussed in light of theoretical, empirical, and practical considerations.

The development of an instrument to measure motivation for marathon running: the Motivations of Marathoners Scales (MOMS)

The purpose of this study was to investigate differences in perceptions of two “severity dichotomies” present in the Equal Employment Opportunity Commission Guidelines on sexual harassment. Alale and female undergraduates (N = 198), from a predominately white midwestern university, were given one of four statements based on these guidelines, varying “form” (physical/verbal) and “consequence” (economic injury/hostile environment) of the behavior. Analysis of variance results showed females rated the incident as more definitely sexual harassment and as affecting perfonnance more than did males. Participants reading “economic injury” statements rated them as having more effect on the victim’s job status than did those reading “hostile environment” statements. A multivariate analysis of variance revealed significant “consequence” and “sex” effects on several factors: A significant three-way interaction showed that males rated statements less negatively than did females, especially when the statement described “physical” behavior with “hostile environment“ consequences. Cluster analysis results are also presented.

Perceptions of sexual harassment as a function of sex of rater and incident form and consequence

The advent of the desktop computer has allowed organizations to help their employees become faster and more productive workers. Some employees, however, use their work computers in unproductive ways as well, such as sending personal email and playing computer games. We call this Personal Use of Work Computers (PUWC). Using a work computer for personal reasons deviates from many organizations' norms. In the current study, we surveyed employees at an educational institution and asked them to report how they use their computers at work. These respondents also answered questions related to their sensation seeking, impulsiveness, conscientiousness, and job satisfaction as well as demographic information. We found that people who use their computers in unproductive ways tend to be men, younger, more impulsive, and less conscientious. We also found that those who use their computers for riskier PUWC behaviors (like viewing sexual content) tended to have sensation seeking personalities.

Personality Correlates of Employees' Personal Use of Work Computers

Information security is a multibillion-dollar problem faced by commercial and government organizations around the world. Through their adverse effects on organizational information systems, malware, hackers, and malicious insiders jeopardize organizations’ capabilities to pursue their missions effectively. Although technology-based solutions help to mitigate some of the many problems of information security, even the best technology cannot work successfully unless the people in organizations do the right thing. In two national survey studies (N=1167 and N=298) we explored some of the motivational antecedents surrounding the practices of information security by end users. Results revealed that organization type, job role, job satisfaction, and organizational commitment each showed relations to some key security behaviors of end users.

/pdf/behavioral-information-security-two-end-user-survey-studies-4og7ldl84v.pdf

Jeffrey A. Jolton

Papers

Analysis of end user security behaviors

The development of an instrument to measure motivation for marathon running: the Motivations of Marathoners Scales (MOMS)

Perceptions of sexual harassment as a function of sex of rater and incident form and consequence

Personality Correlates of Employees' Personal Use of Work Computers

Behavioral Information Security: Two End User Survey Studies of Motivation and Security Practices