Examining employee security violations: moral disengagement and its environmental influences

Abstract

Purpose Employee security behaviors are the cornerstone for achieving holistic organizational information security. Recent studies in the information systems (IS) security literature have used neutralization and moral disengagement (MD) perspectives to examine employee rationalizations of noncompliant security behaviors. Extending this prior work, the purpose of this paper is to identify mechanisms of security education, training, and awareness (SETA) programs and deterrence as well as employees’ organizational commitment in influencing MD of security policy violations and develop a theoretical model to test the proposed relationships. Design/methodology/approach The authors validate and test the model using the data collected from six large multinational organizations in Korea using survey-based methodology. The model was empirically analyzed by structural equation modeling. Findings The results suggest that security policy awareness (PA) plays a central role in reducing MD of security policy violations and that the certainty of punishment and immediacy of enforcing penalties are instrumental toward reducing such MD; however, the higher severity of penalties does not have an influence. The findings also suggest that SETA programs are an important mechanism in creating security PA. Originality/value The paper expands the literature in IS security that has examined the role of moral evaluations. Drawing upon MD theory and social cognitive theory, the paper points to the central role of SETA and security PA in reducing MD of security policy violations, and ultimately the likelihood of this behavior. The paper not only contributes to theory but also provides important insights for practice.

Hospital Staff’s Adherence to Information Security Policy: A Quest for the Antecedents of Deterrence Variables

“…36 , 37 In our study, SETA programs refer to hospital staff’s perceived level of proficiency on common knowledge of information security environment, along with required information security skills provided by hospitals. 49 Prior evidence confirms that a SETA program can improve employees’ self-efficacy on security, 50 motivate employees to comply with security policy, 51 and increase employees’ perceptions concerning punishment severity and punishment certainty. 17 Therefore, hospital staff who attend these SETA programs are expected to possess a deeper knowledge about punishments of non-compliance to the ISP in addition to regular security policies and procedures.…”

“…16 In other words, proper compelling policies are required for useful security policy implementations. 49 Organizations should therefore make potential perpetrators aware of those enforcement rules in advance. 61 In this vein, if hospital staff are aware of the probability they will be punished when they are caught violating ISP, they will be more likely than not abide by the stated ISP.…”

Common Misunderstandings of Deterrence Theory in Information Systems Research and Future Research Directions

“…Partially supported in 9 studies:  Computer abuse/crime (Dhillon et al, 2004;Harrington, 1996;Lee et al, 2004;Nicho & Kamoun, 2014;. Fan & Zhang, 2011;Hovav & D'Arcy, 2012) Not supported in 1 study:  Illegal policy violation (Hu, Xu, Dinev, & Ling, 2011) Noncriminal Supported in 18 studies:  Policy violation (Alshare et al, 2018;Barlow et al, 2013;Herath et al, 2018;Johnston et al, 2016;Khan & AlShare, 2019;Workman & Gathegi, 2007).…”

Protecting intellectual property from insider threats

“…The extant literature on ISP compliance has mostly focused on employees’ attitudinal state (value), perceptions of punishment and reward and competency (skills) (Cram et al , 2019). According to Cram et al (2019), the following concepts showed a robust positive influence on employee’s ISP compliance: social values and beliefs (Bulgurcu et al , 2010; Guo et al , 2011; Cheng et al , 2013; D’Arcy and Greene, 2014), individual norms and morality (Myyry et al , 2009; Vance and Siponen, 2012; Ifinedo, 2014; Moody et al , 2018), a proper reward system (Bulgurcu et al , 2010; Chen et al , 2012), sanctions (Bulgurcu et al , 2010; Hu et al , 2012), self-efficacy (Bulgurcu et al , 2010; Burns et al , 2018) and SETA (Bulgurcu et al , 2010; Burns et al , 2018; Han et al , 2017; Herath et al , 2018).…”