Deterrence and prevention-based model to mitigate information security insider threats in organisations

Abstract

Previous studies show that information security breaches and privacy violations are important issues for organisations and people. It is acknowledged that decreasing the risk in this domain requires consideration of the technological aspects of information security alongside human aspects. Employees intentionally or unintentionally account for a significant portion of the threats to information assets in organisations. This research presents a novel conceptual framework to mitigate the risk of insiders using deterrence and prevention approaches.Deterrence factors discourage employees from engaging in information security misbehaviour in organisations, and situational crime prevention factors encourage them to prevent information security misconduct. Our findings show that perceived sanctions certainty and severity significantly influence individuals' attitudes and deter them from information security misconduct. In addition, the output revealed that increasing the effort, risk and reducing the reward (benefits of crime) influence the employees' attitudes towards prevent information security misbehaviour. However, removing excuses and reducing provocations do not significantly influence individuals' attitudes towards prevent information security misconduct. Finally, the output of the data analysis also showed that subjective norms, perceived behavioural control and attitude influence individuals' intentions, and, ultimately, their behaviour towards avoiding information security misbehaviour.

Prevention of crime by criminal law and operational-search means

“…Based on the foregoing, it would be most correct to consider "combating crime" as a term that unites all the activities. Prevention should become relevant when it comes to a potential but not yet conceived crime (prevention) [7][8][9]; about a crime conceived and prepared but not yet committed at the stage of preparation (prevention) [10,11]; about a crime started but still unfinished at the stage of attempt (suppression) [12]. If a crime is over, then it is time to carry out measures to combat (identification, disclosure, investigation, etc.)…”

Information Security Behavior and Information Security Policy Compliance: A Systematic Literature Review for Identifying the Transformation Process from Noncompliance to Compliance

“…In the same way, they have argued that security managers are more interested in actual behaviors than intention. Reference [93] presented a TPB, GDT (i.e., sanction severity, sanction certainty), and SCPT based framework to mitigate insiders' information security misbehavior. This framework was tested upon a total of 444 employees from different organizations.…”

“…The intention is not the only predictor of actual behavior [93] Quantitative study design SEM used for results analysis 444 correct responses considered SCPT and GDT have significant effects on the insider's negative attitude towards misbehavior…”

Security Requirements Engineering Framework with BPMN 2.0.2 Extension Model for Development of Information Systems

“…Adopting an IS does not mean that it can work autonomously until every stake holder of that system is involved and motivated about its importance and criticality [48] and requires a dynamic system to control the threats occurring at run time with a changing system's functional requirements [49]. Studies [7,32,42,44,46,50] have shown that people using the ERP are a major threat to its security, which intentionally or un-intentionally damages the security. These damages can be reduced by explaining the criticality of the security, by educating the populace, by setting accountability, or by deterrence.…”