Punishment and ethics deterrents: A study of insider security contravention

Abstract

Information security is a growing concern among the general population. For instance, it has been estimated by the U.S. Department of Justice (2004) that one in three people will become victims of identity theft at some point in their lifetime. The bulk of the research into information security has gone into the investigation of technological aspects of security, and there are gaps in the literature relative to contravention of security measures. Drawing from deterrence theory and using the theory of planned behavior as a general framework, this empirical field study investigated the effects of punishment and ethics training on behaviors related to contravention of information security measures among information professionals to fill an important gap in the literature. We found that both punishment and ethics training can be effective in mitigating the threat of software and information security, but that these depend on certain underlying motivational factors of individuals. The results of this study suggest a need to develop and refine the theoretical models, and we offer suggestions for getting at the root of behavioral issues surrounding information security.

A field study of corporate employee monitoring: Attitudes, absenteeism, and the moderating influences of procedural justice perceptions

“…Workman & Gathegi, 2007). However, whether or not people simply comply with policies is incomplete in explaining organizational results.…”

“…Security policies are organizational instruments that establish the rules and punitive sanctions regarding security behaviors. Increasingly, employment is conditioned upon employee agreements that elicit promises to comply with security policies including allowing the organization to collect personal data and monitoring their activities (Straub & Welke, 1998;Workman & Gathegi, 2007).…”

Identifying at-risk employees: A behavioral model for predicting potential insider threats

“…Employee attitudes-especially strong negative affect-are precursors of intentional counterproductive (and even subversive) behaviors ranging from absenteeism to various forms of retaliation (Workman, 2009b;Workman and Gathegi, 2007). Wells (2001) points out that employee dissatisfaction with the work organization is a powerful predictor of workplace fraud.…”

Toward a More Secure HRIS: The Role of HCI and Unconscious Behavior

“…Fundamentally, traditional security research has a "behavioral root" (Workman & Gathegi, 2007) and is a subject of psychological and sociological actions of people. Most prior research in traditional organizational IS security-which is relevant to HRIS -has dealt with the success and failure of security policies by using a deterrence approach (Bulgurcu, Cavusoglu, & Benbasat, 2010;Chen, Ramamurthy, & Wen, 2012;Cheng, Li, Li, Holm, & Zhai, 2013;Herath & Rao, 2009;Straub & Nance, 1990).…”