The role of deterrability for the effect of multi-level sanctions on information security policy compliance: Results of a multigroup analysis

2020 ◽  
pp. 103318
Author(s):  
Lennart Jaeger ◽  
Andreas Eckhardt ◽  
Julia Kroenung
Keyword(s):  
Information Security ◽  
Security Policy ◽  
Policy Compliance ◽  
Information Security Policy ◽  
Multigroup Analysis ◽  
Multi Level ◽  
Information Security Policy Compliance ◽  
Security Policy Compliance

The role of internal audit and user training in information security policy compliance

2018 ◽  
Vol 33 (4) ◽  
pp. 410-424 ◽  
Author(s):  
Thomas Stafford ◽  
George Deitz ◽  
Yaojie Li
Keyword(s):  
Information Security ◽  
Security Policy ◽  
Internal Audit ◽  
Policy Compliance ◽  
Information Security Policy ◽  
Content Type ◽  
Information Security Policy Compliance ◽  
Security Policy Compliance ◽  
Role Of Information

Purpose The purpose of the study is to investigate the role of information security policy compliance and the role of information systems auditing in identifying non-compliance in the workplace, with specific focus on the role of non-malicious insiders who unknowingly or innocuously thwart corporate information security (IS) directives by engaging in unsafe computing practices. The ameliorative effects of auditor-identified training and motivational programs to emphasize pro-security behaviors are explored. Design/methodology/approach This study applies qualitative case analysis of technology user security perceptions combined with interpretive analysis of depth interviews with auditors to examine and explain the rubrics of non-malicious technology user behaviors in violation of cybersecurity directives, to determine the ways in which auditors can best assist management in overcoming the problems associated with security complacency among users. Findings Enterprise risk management benefits from audits that identify technology users who either feel invulnerable to cyber threats and exploits or feel that workplace exigencies augur for expedient workarounds of formal cybersecurity policies. Research limitations/implications Implications for consideration of CyberComplacency and Cybersecurity Loafing expand the insider threat perspective beyond the traditional malicious insider perspective. Practical implications Implications for consideration of CyberComplacency and Cybersecurity Loafing include broadened perspectives for the consultative role of IS audit in the firm. Social implications CyberComplacency is a practice that has great potential for harm in all walks of life. A better understanding of these potential harms is beneficial. Originality/value This study is the first to characterize CyberComplacency as computer users who feel they operate invulnerable platforms and are subsequently motivated to engage in less cybersecurity diligence than the company would desire. This study is also the first to characterize the notion of Cybersecurity Loafing to describe technically competent workers who take unauthorized but expedient steps around certain security polices in the name of workgroup efficiency.

The Cultural Foundation of Information Security Behavior

2021 ◽  
pp. 522-545
Author(s):  
Canchu Lin ◽  
Anand S. Kunnathur ◽  
Long Li
Keyword(s):  
Organizational Culture ◽  
Information Security ◽  
Security Policy ◽  
Behavior Control ◽  
Policy Compliance ◽  
Information Security Policy ◽  
Information Security Behavior ◽  
Security Behavior ◽  
Information Security Policy Compliance ◽  
Security Policy Compliance

Past behavior research overwhelmingly focused on information security policy compliance and under explored the role of organizational context in shaping information security behaviors. To address this research gap, this study integrated two threads of literature: organizational culture, and information security behavior control, and proposed a framework that integrates mid-range theories used in empirical research, connects them to organizational culture, and predicts its role in information security behavior control. Consistent with the cultural-fit perspective, this framework shows that information security policy compliance fits hierarchical culture and the approach of promoting positive, proactive, and emerging information security behaviors fits participative culture. Contributions and practical implications of this framework, together with future research directions, are discussed.

Sign in / Sign up

Export Citation Format

Share Document