Beyond Deterrence: An Expanded View of Employee Computer Abuse

Abstract

Whether motivated by greed, disgruntlement, or other psychological processes, this act has the greatest potential for loss and damage to the employer. We argue the focus must include not only the act and its immediate antecedents of intention (to commit computer abuse) and deterrence (of the crime), but also phenomena which temporally precede these areas. Specifically, we assert the need to consider the thought processes of the potential offender and how these are influenced by the organizational context, prior to deterrence. We believe the interplay between thought processes and this context may significantly impact the efficacy of IS security controls, specifically deterrence safeguards. Through this focus, we extend the Straub and Welke (1998) security action cycle framework and propose three areas worthy of empirical investigation-techniques of neutralization (rationalization), expressive/instrumental criminal motivations, and disgruntlement as a result of perceptions of organizational injustice-and propose questions for future research in these areas.

Influence of Shadow IT on Innovation in Organizations

“…Secondly, our paper provides an empirical justification and solid grounded basis for further theorizing around the phenomenon of Shadow IT. Thirdly, Shadow users can be seen as employees who are usually considered as threats to Information Systems (IS) and as such they are seen as benign non-malicious insiders that violate IS security policies with benevolent intentions [15]. However, our study suggests that if organizations leverage there IS policies by incorporating mechanisms that would enable, encourage and promote Shadow IT and Shadow users to be compliant, benefits for organizational innovation could be manifold.…”

“…By triangulating the findings from these three methods we can see that Shadow IT can be an important source of innovation for firms. While, these Shadow users are considered to be benign non-malicious insiders threatening Information Systems (IS) and violating IS security policies with benevolent intentions [15], they can also be important and new source of innovation. Indeed, so far, organizations were typically mostly relying on their innovation departments or labs to produce innovations.…”

Decision Making and Biases in Cybersecurity Capability Development: Evidence from a Simulation Game Experiment

“…To keep the game simple, it is assumed that all attacks are considered external attacks, in that they originate outside of the victim organization's network, and are not categorized by type, such as a phishing attack or a network-traveling worm. While we acknowledge that the risk of an insider attack is significant in reality [79,80], the simplifications we apply do not impact the relevance of our results, since most successful cyber-attacks result in data loss or operational disruptions regardless of their nature. The only difference between the two graphs in b is the occurrence of cyber-attacks, and in neither simulation is any investment made in cybersecurity capability development, so any difference in profits is directly related to the cyber-attacks shown in (a).…”

Anger or Fear? Effects of Discrete Emotions on Deviant Security Behavior

“…Prior research focuses largely on compliant behaviors versus security policies for employees [3,67,75,76,81]. In essence, those studies attempted to examine factors which can maximize the deterrence effect and reduce employees' noncompliance behaviors.…”

“…For example, intellectual property theft which is caused by current and former employees costs US companies $250 billion per year [65]. The insider threat is regarded as one of the largest threats to organizations [75,81]. To reduce the insider threat, organizations have taken efforts to develop and implement stringent monitoring and control activities, information security policies (ISPs), and sanctions to deter security threat behaviors.…”