scholarly journals A framework for reporting and dealing with end-user security policy compliance

2019 ◽  
Vol 27 (1) ◽  
pp. 2-25 ◽  
Author(s):  
Mutlaq Jalimid Alotaibi ◽  
Steven Furnell ◽  
Nathan Clarke
Keyword(s):  
Information Security ◽  
Security Policy ◽  
End Users ◽  
Response Strategy ◽  
Security Policies ◽  
Prototype System ◽  
Content Type ◽  
Novel Approach ◽  
Proposed Model ◽  
Security Policy Compliance

Purpose It is widely acknowledged that non-compliance of employees with information security polices is one of the major challenges facing organisations. This paper aims to propose a model that is intended to provide a comprehensive framework for raising the level of compliance amongst end-users, with the aim of monitoring, measuring and responding to users’ behaviour with an information security policy. Design/methodology/approach The proposed model is based on two main concepts: a taxonomy of the response strategy to non-compliant behaviour and a compliance points system. The response taxonomy comprises two categories: awareness raising and enforcement of the security policy. The compliance points system is used to reward compliant behaviour and penalise non-compliant behaviour. Findings A prototype system has been developed to simulate the proposed model and work as a real system that responds to the behaviour of users (reflecting both violations and compliance behaviour). In addition, the model has been evaluated by interviewing experts from academic and industry. They considered the proposed model to offers a novel approach for managing end users’ behaviour with the information security policies. Research limitations/implications Psychological factors were out of the research scope at this stage. The proposed model may have some psychological impacts upon users; therefore, this issue needs to be considered by studying the potential impacts and the best solutions. Originality/value Users being compliant with the information security policies of their organisation is the key to strengthen information security. Therefore, when employees have a good level of compliance with security policies, this positively affects the overall security of an organisation.

Variables influencing information security policy compliance

2014 ◽  
Vol 22 (1) ◽  
pp. 42-75 ◽  
Author(s):  
Teodor Sommestad ◽  
Jonas Hallberg ◽  
Kristoffer Lundholm ◽  
Johan Bengtsson
Keyword(s):  
Systematic Review ◽  
Information Security ◽  
Security Policy ◽  
Empirical Studies ◽  
Security Policies ◽  
Future Research ◽  
Policy Compliance ◽  
Content Type ◽  
Information Security Policy Compliance ◽  
Security Policy Compliance

Purpose – The purpose of this paper is to identify variables that influence compliance with information security policies of organizations and to identify how important these variables are. Design/methodology/approach – A systematic review of empirical studies described in extant literature is performed. This review found 29 studies meeting its inclusion criterion. The investigated variables in these studies and the effect size reported for them were extracted and analysed. Findings – In the 29 studies, more than 60 variables have been studied in relation to security policy compliance and incompliance. Unfortunately, no clear winners can be found among the variables or the theories they are drawn from. Each of the variables only explains a small part of the variation in people's behaviour and when a variable has been investigated in multiple studies the findings often show a considerable variation. Research limitations/implications – It is possible that the disparate findings of the reviewed studies can be explained by the sampling methods used in the studies, the treatment/control of extraneous variables and interplay between variables. These aspects ought to be addressed in future research efforts. Practical implications – For decision makers who seek guidance on how to best achieve compliance with their information security policies should recognize that a large number of variables probably influence employees' compliance. In addition, both their influence strength and interplay are uncertain and largely unknown. Originality/value – This is the first systematic review of research on variables that influence compliance with information security policies of organizations.

scholarly journals It is not my job: exploring the disconnect between corporate security policies and actual security practices in SMEs

2020 ◽  
Vol 28 (3) ◽  
pp. 467-483 ◽  
Author(s):  
Moufida Sadok ◽  
Steven Alter ◽  
Peter Bednar
Keyword(s):  
Information Security ◽  
Security Policy ◽  
Small And Medium Enterprises ◽  
Security Policies ◽  
Sensitive Information ◽  
Work Practices ◽  
Content Type ◽  
Empirical Results ◽  
Corporate Security ◽  
Security Practices

Purpose This paper aims to present empirical results exemplifying challenges related to information security faced by small and medium enterprises (SMEs). It uses guidelines based on work system theory (WST) to frame the results, thereby illustrating why the mere existence of corporate security policies or general security training often is insufficient for establishing and maintaining information security. Design/methodology/approach This research was designed to produce a better appreciation and understanding of potential issues or gaps in security practices in SMEs. The research team interviewed 187 employees of 39 SMEs in the UK. All of those employees had access to sensitive information. Gathering information through interviews (instead of formal security documentation) made it possible to assess security practices from employees’ point of view. Findings Corporate policies that highlight information security are often disconnected from actual work practices and routines and often do not receive high priority in everyday work practices. A vast majority of the interviewed employees are not involved in risk assessment or in the development of security practices. Security practices remain an illusory activity in their real-world contexts. Research limitations/implications This paper focuses only on closed-ended questions related to the following topics: awareness of existing security policy; information security practices and management and information security involvement. Practical implications The empirical findings show that corporate information security policies in SMEs often are insufficient for maintaining security unless those policies are integrated with visible and recognized work practices in work systems that use or produce sensitive information. The interpretation based on WST provides guidelines for enhancing information system security. Originality/value Beyond merely reporting empirical results, this research uses WST to interpret the results in a way that has direct implications for practitioners and for researchers.

Establishing information security policy compliance culture in organizations

2018 ◽  
Vol 26 (4) ◽  
pp. 420-436 ◽  
Author(s):  
Eric Amankwa ◽  
Marianne Loock ◽  
Elmarie Kritzinger
Keyword(s):  
Information Security ◽  
Security Policy ◽  
User Involvement ◽  
Research Model ◽  
End User ◽  
Policy Compliance ◽  
Content Type ◽  
Behavioural Intentions ◽  
End User Involvement ◽  
Security Policy Compliance

Purpose This paper aims to establish that employees’ non-compliance with information security policy (ISP) could be addressed by nurturing ISP compliance culture through the promotion of factors such as supportive organizational culture, end-user involvement and compliance leadership to influence employees’ attitudes and behaviour intentions towards ISP in organizations. This paper also aims to develop a testable research model that might be useful for future researchers in predicting employees’ behavioural intentions. Design/methodology/approach In view of the study’s aim, a research model to show how three key constructs can influence the attitudes and behaviours of employees towards the establishment of security policy compliance culture (ISPCC) was developed and validated in an empirical field survey. Findings The study found that factors such as supportive organizational culture and end-user involvement significantly influenced employees’ attitudes towards compliance with ISP. However, leadership showed the weakest influence on attitudes towards compliance. The overall results showed that employees’ attitudes and behavioural intentions towards ISP compliance together influenced the establishment of ISPCC for ISP compliance in organizations. Practical implications Organizations should influence employees’ attitudes towards compliance with ISP by providing effective ISP leadership, encouraging end-user involvement during the draft and update of ISP and nurturing a culture that is conducive for ISP compliance. Originality/value The study provides some insights on how to effectively address the problem of non-compliance with ISP in organizations through the establishment of ISPCC, which has not been considered in any past research.

scholarly journals The effect of perceived organizational culture on employees’ information security compliance

2021 ◽  
Vol ahead-of-print (ahead-of-print) ◽  
Author(s):  
Martin Karlsson ◽  
Fredrik Karlsson ◽  
Joachim Åström ◽  
Thomas Denk
Keyword(s):  
Organizational Culture ◽  
Information Security ◽  
Security Policy ◽  
Organizational Cultures ◽  
Policy Compliance ◽  
Information Security Policy ◽  
Content Type ◽  
Security Compliance ◽  
Information Security Policy Compliance ◽  
Security Policy Compliance

Purpose This paper aims to investigate the connection between different perceived organizational cultures and information security policy compliance among white-collar workers. Design/methodology/approach The survey using the Organizational Culture Assessment Instrument was sent to white-collar workers in Sweden (n = 674), asking about compliance with information security policies. The survey instrument is an operationalization of the Competing Values Framework that distinguishes between four different types of organizational culture: clan, adhocracy, market and bureaucracy. Findings The results indicate that organizational cultures with an internal focus are positively related to employees’ information security policy compliance. Differences in organizational culture with regards to control and flexibility seem to have less effect. The analysis shows that a bureaucratic form of organizational culture is most fruitful for fostering employees’ information security policy compliance. Research limitations/implications The results suggest that differences in organizational culture are important for employees’ information security policy compliance. This justifies further investigating the mechanisms linking organizational culture to information security compliance. Practical implications Practitioners should be aware that the different organizational cultures do matter for employees’ information security compliance. In businesses and the public sector, the authors see a development toward customer orientation and marketization, i.e. the opposite an internal focus, that may have negative ramifications for the information security of organizations. Originality/value Few information security policy compliance studies exist on the consequences of different organizational/information cultures.

Information security policies and value conflict in multinational companies

2018 ◽  
Vol 26 (2) ◽  
pp. 230-245 ◽  
Author(s):  
Alper Yayla ◽  
Yu Lei
Keyword(s):  
Information Security ◽  
Security Policy ◽  
Cultural Distance ◽  
Multinational Companies ◽  
Security Policies ◽  
Security Risk ◽  
Value Conflict ◽  
Value Conflicts ◽  
Content Type ◽  
Parent Companies

PurposeThe purpose of this paper is to examine challenges multinational companies face during the diffusion of their information security policies. Parent companies use these policies as their discourse for legitimization of their practices in subsidiaries, which leads to value conflicts in subsidiaries. The authors postulate that, when properly crafted, information security policies can also be used to reduce the very conflicts they are creating.Design/methodology/approachThe proposed framework is conceptualized based on the review of literatures on multinational companies, information security policies and value conflict.FindingsThe authors identified three factors that may lead to value conflict in subsidiary companies: cultural distance, institutional distance and stickiness of knowledge. They offer three recommendations based on organizational discourse, ambidexterity and resource allocation to reduce value conflict.Research limitations/implicationsThe authors postulate that information security policies are the sources of value conflict in subsidiary companies. Yet, when crafted properly, these policies can also offer solutions to minimize value conflict.Practical implicationsThe proposed framework can be used to increase policy diffusion success, minimize value conflict and, in turn, decrease information security risk.Originality/valueThe growing literature on information security policy literature is yet to examine the diffusion of policies within multinational companies. The authors argue that information security policies are the source of, and solution to, value conflict in multinational companies.

The role of internal audit and user training in information security policy compliance

2018 ◽  
Vol 33 (4) ◽  
pp. 410-424 ◽  
Author(s):  
Thomas Stafford ◽  
George Deitz ◽  
Yaojie Li
Keyword(s):  
Information Security ◽  
Security Policy ◽  
Internal Audit ◽  
Policy Compliance ◽  
Information Security Policy ◽  
Content Type ◽  
Information Security Policy Compliance ◽  
Security Policy Compliance ◽  
Role Of Information

Purpose The purpose of the study is to investigate the role of information security policy compliance and the role of information systems auditing in identifying non-compliance in the workplace, with specific focus on the role of non-malicious insiders who unknowingly or innocuously thwart corporate information security (IS) directives by engaging in unsafe computing practices. The ameliorative effects of auditor-identified training and motivational programs to emphasize pro-security behaviors are explored. Design/methodology/approach This study applies qualitative case analysis of technology user security perceptions combined with interpretive analysis of depth interviews with auditors to examine and explain the rubrics of non-malicious technology user behaviors in violation of cybersecurity directives, to determine the ways in which auditors can best assist management in overcoming the problems associated with security complacency among users. Findings Enterprise risk management benefits from audits that identify technology users who either feel invulnerable to cyber threats and exploits or feel that workplace exigencies augur for expedient workarounds of formal cybersecurity policies. Research limitations/implications Implications for consideration of CyberComplacency and Cybersecurity Loafing expand the insider threat perspective beyond the traditional malicious insider perspective. Practical implications Implications for consideration of CyberComplacency and Cybersecurity Loafing include broadened perspectives for the consultative role of IS audit in the firm. Social implications CyberComplacency is a practice that has great potential for harm in all walks of life. A better understanding of these potential harms is beneficial. Originality/value This study is the first to characterize CyberComplacency as computer users who feel they operate invulnerable platforms and are subsequently motivated to engage in less cybersecurity diligence than the company would desire. This study is also the first to characterize the notion of Cybersecurity Loafing to describe technically competent workers who take unauthorized but expedient steps around certain security polices in the name of workgroup efficiency.

Work-related groups and information security policy compliance

2018 ◽  
Vol 26 (5) ◽  
pp. 533-550 ◽  
Author(s):  
Teodor Sommestad
Keyword(s):  
Decision Making ◽  
Information Security ◽  
Security Policy ◽  
Content Type ◽  
Security Culture ◽  
Work Related ◽  
Individual Perceptions ◽  
Information Security Policy Compliance ◽  
Security Policy Compliance ◽  
Information Security Culture

PurposeIt is widely acknowledged that norms and culture influence decisions related to information security. The purpose of this paper is to investigate how work-related groups influence information security policy compliance intentions and to what extent this influence is captured by the Theory of Planned Behavior, an established model over individual decision-making.Design/methodology/approachA multilevel model is used to test the influence of work-related groups using a cluster sample of responses from 2,291 employees from 203 worksites, 119 organizations, 6 industries and 38 professions.FindingsThe results suggest that work-related groups influence individuals’ decision-making in the manner in which contemporary theories of information security culture posit. However, the influence is weak to modest and overshadowed by individual perceptions that are straightforward to measure.Research limitations/implicationsThis paper is limited to one national culture and four types of work-related groups. However, the results suggest that the Theory of Planned Behavior captures most of the influence that work-related groups have on decision-making. Future research on security culture and similar phenomena should take this into account.Practical implicationsInformation security perceptions in work-related groups are diverse and information security decisions appear to be based on individual perceptions and priorities rather than groupthink or peer-pressure. Security management interventions may be more effective if they target individuals rather than groups.Originality/valueThis paper tests some of the basic ideas related to information security culture and its influence on individuals’ decision-making.

scholarly journals Measuring information security policy compliance: content validity of questionnaire

2021 ◽  
Vol 22 (1) ◽  
pp. 469
Author(s):  
Angraini Angraini ◽  
Rose Alinda Alias ◽  
Okfalisa Okfalisa
Keyword(s):  
Information Security ◽  
Security Policy ◽  
Security Policies ◽  
Content Ratio ◽  
Content Index ◽  
Item Level ◽  
Validity Tests ◽  
The University ◽  
Information Security Policy Compliance ◽  
Security Policy Compliance

<span>Instruments used to measure compliance with information security policies have been developed by many researchers before, but only a few have conducted validity tests per item, especially for variables selected based on qualitative research. This study aims to validate the questionnaire will be used to measure user compliance with policies of information security. This study began by designing a questionnaire and conducting content validation using content ratio validation (CVR) and content index validation (CVI). As many as eight experts from the university assessed the items given. The results of 72 items submitted a questionnaire, as many as 22 items eliminated, and only 50 items that have CVR and CVI values above 0.75. Also, Kappa statistical calculations show that items have excellent reliability among assessors at the item level. This study revealed that this instrument had obtained an appropriate level of validity to measure compliance with information security policies. </span>

The sufficiency of the theory of planned behavior for explaining information security policy compliance

2015 ◽  
Vol 23 (2) ◽  
pp. 200-217 ◽  
Author(s):  
Teodor Sommestad ◽  
Henrik Karlzén ◽  
Jonas Hallberg
Keyword(s):  
Information Security ◽  
Security Policy ◽  
Protection Motivation Theory ◽  
Motivation Theory ◽  
Anticipated Regret ◽  
Policy Compliance ◽  
Information Security Policy ◽  
Content Type ◽  
Information Security Policy Compliance ◽  
Security Policy Compliance

Purpose – This paper aims to challenge the assumption that the theory of planned behaviour (TPB) includes all constructs that explain information security policy compliance and investigates if anticipated regret or constructs from the protection motivation theory add explanatory power. The TPB is an established theory that has been found to predict compliance with information security policies well. Design/methodology/approach – Responses from 306 respondents at a research organization were collected using a questionnaire-based survey. Extensions in terms of anticipated regret and constructs drawn from the protection motivation theory are tested using hierarchical regression analysis. Findings – Adding anticipated regret and the threat appraisal process results in improvements of the predictions of intentions. The improvements are of sufficient magnitude to warrant adjustments of the model of the TPB when it is used in the area of information security policy compliance. Originality/value – This study is the first test of anticipated regret as a predictor of information security policy compliance and the first to assess its influence in relation to the TPB and the protection motivation theory.

Sign in / Sign up

Export Citation Format

Share Document