Understanding Information Security Policy Violation from a Situational Action Perspective

Intentional insider misuse of information systems resources (i.e., IS misuse) represents a significant threat to organizations. For example, industry statistics suggest that between 50%–75% of security incidents originate from within an organization. Because of the large number of misuse incidents, it has become important to understand how to reduce such behavior. General deterrence theory suggests that certain controls can serve as deterrent mechanisms by increasing the perceived threat of punishment for IS misuse. This paper presents an extended deterrence theory model that combines work from criminology, social psychology, and information systems. The model posits that user awareness of security countermeasures directly influences the perceived certainty and severity of organizational sanctions associated with IS misuse, which leads to reduced IS misuse intention. The model is then tested on 269 computer users from eight different companies. The results suggest that three practices deter IS misuse: user awareness of security policies; security education, training, and awareness (SETA) programs; and computer monitoring. The results also suggest that perceived severity of sanctions is more effective in reducing IS misuse than certainty of sanctions. Further, there is evidence that the impact of sanction perceptions vary based on one's level of morality. Implications for the research and practice of IS security are discussed.

Employees’ failure to comply with information systems security policies is a major concern for information technology security managers. In efforts to understand this problem, IS security researchers have traditionally viewed violations of IS security policies through the lens of deterrence theory. In this article, we show that neutralization theory, a theory prominent in Criminology but not yet applied in the context of IS, provides a compelling explanation for IS security policy violations and offers new insight into how employees rationalize this behavior. In doing so, we propose a theoretical model in which the effects of neutralization techniques are tested alongside those of sanctions described by deterrence theory. Our empirical results highlight neutralization as an important factor to take into account with regard to developing and implementing organizational security policies and practices.

Nonmalicious information security policy (ISP) violations can cause organizations significant harm. Here, we aim to extend the understanding of why employees engage in such acts. A large body of ISP violation research is based on the tenet that people violate ISPs to obtain personal benefits, as explained by rational choice and expectancy theories. But this assumption has only been weakly tested, using mostly correlational approaches. Our objective is to improve the causal basis for this argument by using a noninvasive brain stimulation (NIBS) technique, which actually modulates brain activity in regions of the brain that process value/gain assessments. Therefore, it can substantially increase the claim of causality—that expected rewards lead to ISP violations. To do so, we build on expectancy theory and neuroscience knowledge to theorize why reducing the excitability of neurons in the left dorsolateral prefrontal cortex (L DLPFC) can lower the endorsement of ISP violations. We test this idea in four experiments in which we use a NIBS technique called high-definition direct current stimulation (HD-tDCS). Our findings support the assertion that the L DLPFC is likely involved in the expectancy theory of ISP violations, and that endorsing such violations can be experimentally adjusted with NIBS techniques. These findings extend the understanding of cybersecurity behaviors, improve the causal support for the common assumption made by rational choice theory studies that ISP violations are motivated through perceived benefits, point to the need to consider the L DLPFC in research on positively valenced (or attractive) technology-mediated actions, and pave the way for future use of brain stimulation techniques for stronger causality claims in information systems research.

Given the strategic dependence on information and information technology by individuals, workgroups (teams), organizations, industries, nations, and society overall, it is imperative that the integrity of that information is maintained in all three states – during transmission, during storage, and during processing. Information (and information systems) security management is the process of ensuring the confidentiality, integrity, and availability of information whenever and wherever it is transmitted, stored, and processed (sometimes called the “CIA Triad”). While perfect security is desirable, it is unfortunately unattainable. There are numerous active and passive threats to the security of information, as well as responses to these threats that must be adopted by individuals, teams, and organizations. Various technical and behavioral controls are used to counter these threats, but this article will focus on the behavioral controls. Threats characteristics and threat examples are discussed below, as are the responses to such threats. Research findings support the importance of both internal and external threats, with internal threats demonstrating the greatest negative impact in most cases. Factors that contribute to individual compliance with security policies will be discussed, along with some discussion of the intentional violation of security protocols and policies by malicious individuals.

Peers may help others avoid violating organisational information security policies (ISPs). This study explores how peer monitoring reduces employee ISP violation intention. We propose that peer monitoring discourages employees from violating ISP. Moreover, trust plays an important role. Trust not only facilitates peer monitoring, but also moderates the effect of peer monitoring on employee ISP violation intention. In addition, collective responsibility leads to peer monitoring. We test our research model with data from two waves of surveys of 254 employees in the United States conducted two weeks apart. We utilise four scenarios in the second wave of surveys capturing the dependent variable and measure all other constructs in the first wave of surveys. Our results suggest that peer monitoring decreases one’s intention to violate ISPs. Furthermore, both collective responsibility and trust contribute to peer monitoring. Finally, trust amplifies the effect of peer monitoring on employees’ intention to violate ISPs. We discuss the theoretical contributions and practical implications.

This study uses self-report survey data from a sample of college students to provide a partial test of Wikstrӧm’s situational action theory (2010a) by examining the extent, if any, to which the effects of perceptual deterrence on academic dishonesty are moderated by personal morality. The findings show that both personal morality and perceived certainty of formal sanctions are inversely associated with cheating; however, the deterrent effect of high perceived certainty of formal sanctions is not greater among those with weak moral prohibitions against cheating as predicted by Wikstrӧm and observed by Svensson (2015) in an earlier test of Wikstrӧm’s situational action theory.

This paper proposes a model to represent and simulate human activities in farming systems. Our definition of the activity concept (otherwise said ‘action’) stems from the ‘situated action’ theory (Suchman, 1987). Action may be summarized simply as ‘what people are actually doing’. Therefore, we characterize action according to four dimensions: actors (persons or machines engaged in activity), time (start date, end date and duration), space (locations where action occurs) and the interaction with the actor’s environment. To take into account all these dimensions our model is based on: (i) an ‘agent’ approach, (ii) a mathematical formalism to represent action over time (Guerrin, 2009) and (iii) a discrete representation of space inspired from cellular automata. Our aim is to apply this model to representing the human component of agricultural systems, i.e. the farming practices. Space is modelled as a regular grid, each cell being controlled by a specific autonomous abstract ‘agent’, in the sense of multiagent systems (MAS), called ‘cell-agent’. Since activity depends, according to the situated action paradigm, on its context of occurrence and continuously involves interactions with the environment, we focused on the concepts of stigmergy and affordance to carry the information necessary to realize actions and on a reactive agent approach. The radical notion of reactive agent postulates that agents’ actions are reac-tions to stimuli. Various constraints to be dealt with are imposed by our application domain (farming sys-tems), namely temporal constraints the cell-agents must consider for acting. Consequently, our model, alt-hough mainly based on a stimulus-response mechanism, involves also a process, kept as simple as possible, allowing spatially situated agents to select the most appropriate action when several actions are concurrently possible. For this, priority levels coupled with the stigmergy and affordance concepts are used. Cell-agent actions are realized through specific objects called ‘actuators’ representing, unconventionally, the real actors (e.g. a farmer possibly using equipments, animals, etc.). An actuator is a non-autonomous entity that receives from the cell-agent where it is located the command of actions it must execute. A cell-agent can perceive, at any time, what happens in its neighbouring cells and which are the objects these cells host. In case a cell-agent needs a resource not located in a nearby cell, it can possibly get it by propagating its request through its neighbours. Action is represented by a binary function of time (Guerrin, 2009) and implemented by these ‘actuators’, exhibiting dynamic behaviours, although they are actually directed by the cell-agents they rely on. Action starts and ends according to events detected on processes observed by the cell-agents in their local environ-ment, provided they can access the necessary resources, among which actuators endowed with relevant abili-ties. The course of action is subject to a set of conditions that must remain satisfied for the action goes to its end. In the meanwhile, it may be interrupted, resumed or cancelled. The originality of this work lies in that real ‘actors’ (like persons, animals, machines, etc.) are represented as non-autonomous ‘objects’ and not as autonomous ‘agents’, as it is generally the case in other modelling efforts (e.g., Sierhuis et al., 2006). These objects cannot act by themselves. They just follow the instructions given by the cell-agents they rely upon. Our model allows so one to represent the behaviour of real ‘situated’ actors as if it were the environment that dictated them what to do. Doing this way complies with the situated action theory.

We apply key theoretical concepts derived from, and test the predictive efficiency of, situational action theory on sports fans’ decision to engage in cyberbullying perpetration against rivals. To do so, we employ self-report data from a random sample of 508 students from an Iranian university. Ordinary least squares regression is used to analyze these data. In accordance with situational action theory’s propositions, both crime propensity and criminogenic exposure increase fans’ decision to engage in cyberbullying perpetration. Additionally, the interaction of crime propensity and criminogenic exposure increases fans’ engagement in cyberbullying perpetration, while the inclusion of the interaction term increases the model’s predictive power. In contrast to Wikström’s propositions, however, demographic variables (gender, age, education) remain significant even when situational action theory’s constructs are added into the model.

PurposeThis paper aims to establish that employees’ non-compliance with information security policy (ISP) could be addressed by nurturing ISP compliance culture through the promotion of factors such as supportive organizational culture, end-user involvement and compliance leadership to influence employees’ attitudes and behaviour intentions towards ISP in organizations. This paper also aims to develop a testable research model that might be useful for future researchers in predicting employees’ behavioural intentions.Design/methodology/approachIn view of the study’s aim, a research model to show how three key constructs can influence the attitudes and behaviours of employees towards the establishment of security policy compliance culture (ISPCC) was developed and validated in an empirical field survey.FindingsThe study found that factors such as supportive organizational culture and end-user involvement significantly influenced employees’ attitudes towards compliance with ISP. However, leadership showed the weakest influence on attitudes towards compliance. The overall results showed that employees’ attitudes and behavioural intentions towards ISP compliance together influenced the establishment of ISPCC for ISP compliance in organizations.Practical implicationsOrganizations should influence employees’ attitudes towards compliance with ISP by providing effective ISP leadership, encouraging end-user involvement during the draft and update of ISP and nurturing a culture that is conducive for ISP compliance.Originality/valueThe study provides some insights on how to effectively address the problem of non-compliance with ISP in organizations through the establishment of ISPCC, which has not been considered in any past research.

Effects of sanctions, moral beliefs, and neutralization on information security policy violations across cultures

Šiame straipsnyje, pasitelkiant Tarptautinio jaunimo delinkvencinio elgesio, nuostatų ir viktimizacijos tyrimo (The Third International Self-Report Delinquency Study (ISRD-3)1) Lietuvoje duomenis, tiriamos situacinio veiksmo teorijos prielaidos lyties aspektu. Siekiama patikrinti, ar situacinio veiksmo teorijos prielaidos pasitvirtina aiškinant nepilnamečių delinkvencinį elgesį Lietuvoje ir ar šios teorijos prielaidos gali vienodai paaiškinti tiek vaikinų, tiek merginų delinkvencinį elgesį. Gauti tyrimo rezultatai leidžia kalbėti apie tai, kad ne visos situacinio veiksmo teorijos prielaidos buvo patvirtintos, o merginų ir vaikinų delinkvencinį elgesį prognozuoja kiek skirtingi veiksniai.

In our increasingly digitized and interconnected society, people are poorly protected against cyberthreats, with the main reason being user behavior. Human behavior and actions are unpredictable in nature and this make human an important element and enabler of cybersecurity. The objective of the study is promotion of adoption of non-technical countermeasures (such as user awareness) for a comprehensive and holistic way to manage cyber security in organizations in Cameroon. We conducted a subjective study to measure the level of employees’ knowledge and general awareness, risky behavior they engage in, and attitude toward various aspects of cybersecurity and cyberthreats to show the need for user education, training, and awareness. For the study described in this paper, a self-report questionnaire was developed and data were collected from 214 participants. The results of a descriptive statistic percentage indicated that less than 50% of respondents have completed or has regular training program. We find that over 61% of the participants do not have sufficient knowledge of their organization cyber security policies. Among other findings, the over 60% of employees’ mistakes or violations of security policy are not disciplined or penalized is a demonstration of lack of legal status of cyber-attacks. Cyber resilience in any organization is a responsibility shared by both management and employees. Proactive human management element that can actively hunt for malicious activity and indicators of compromise is recommended.

This paper presents an overview of the technologies and the methodologies used in Network Intrusion Detection and Prevention Systems (NIDPS). Intrusion Detection and Prevention System (IDPS) technologies are differentiated by types of events that IDPSs can recognize, by types of devices that IDPSs monitor and by activity. NIDPSs monitor and analyze the streams of network packets in order to detect security incidents. The main methodology used by NIDPSs is protocol analysis. Protocol analysis requires good knowledge of the theory of the main protocols, their definition, how each protocol works.Keywords: Intrusion Detection and Prevention System, Protocol Analysis, Sensor, Signature, State(ProQuest: ... denotes formulae omitted.)1 IntroductionIncreasing size and complexity of the Internet and Intranet networks have led to increasing number of vulnerabilities that could be exploited. Thus, the internal and external attacks on the information systems are increasing at an alarming rate. Also, these are becoming more severe and sophisticated. The attackers find ingenious ways to bypass the security controls and to compromise the security and the well functioning of the information systems. They are motivated by financial, political, and military objectives. In this context, defending wide area networks from malicious traffic, unauthorized access to systems involves many problems.In security information systems Network Intrusion Detection and Prevention Systems (NIDPS) are important tools to detect possible incidents and also, to attempt to stop them in real time. Due to changing attacks, intrusion detection methodologies and technologies continuously evolve, adding new detection capabilities, to avoid detection. They must adapt to new forms of malware, to the public networks, increased traffic.2 Concepts of Intrusion DetectionAn intrusion is a successful action to gain access to an information system, to compromise it or to make it unavailable. This is possible due to the presence of vulnerability in the target system that can be exploited by a motivated intruder.Intrusion Detection and Prevention is the process of monitoring the information systems by sensors or agents and analyzing the collected information to detect and to attempt to stop the attacks in real time, identifying vulnerabilities, the violation of security policies or standard security practices.An Intrusion Detection and Prevention System (IDPS) is a tool that monitors information systems, collects, analyzes information, and initiates responses when an intrusion is detected.Intrusion Detection Systems (IDSs) mainly work as defensive mechanisms. They only alert the system administrators that an incident has occurred. Intrusion Prevention Systems (IPSs) can take some actions to attempt to stop the attack, such as breaking the connection or modifying the firewall rules to deny access to the intruder. The response of the classic IDS can be slow if the system administrator is busy while the response of the IPS is automatic. An architecture that uses together IPS and IDS technologies is the best solution for defense in depth.Conceptually, a generic IDPS consists of modular components. It mainly has the following components: monitoring system, storage, analyzer, and responder.* Monitoring system - monitors and logs the events in a computer system or network;* Storage - stores information, called audit record, about suspicious activities or intrusions; also, the security policies used in analysis are stored;* Analyzer - uses different analysis methodologies to detect the incidents;* Responder - the response mechanism of incidents.The IDPSs could be classified as:* By detection methodology [12], [18]:- misuse-based detection- anomaly-based detection- stateful protocol analysis* By activity [12]:- network-based- wireless-based- network behavior analysis- host-based* By behavior on detection:- passive- active* By collection and analysis frequency:- continuous- periodicThe detection methodologies describe the characteristics of the analyzer. …

Managing Security Clearances within Government Institutions

Securing sensitive and critical information is a significant challenge for many organisations, as leaks can cause financial, reputational, and competitiveness losses. Organisations can implement an Information Security Policy (ISP) that employees must comply with to minimise this risk. However, ensuring compliance with the ISP continues to be a problem. To address this issue, a conceptual model has been proposed that organisations can use to promote ISP compliance behaviour among their employees. The Health Action Process Approach (HAPA) Model is used to derive this model. The model consists of two phases - motivational and volitional which are expected to cover the elements needed to promote behavioural change for ISP compliance. The model's multi-processes approach, covering critical aspects such as risk assessment, self-efficacy, initiation, and maintenance, enables it to serve as a platform for organisations to sustain ISP compliance over the long term. Organisations can conduct employee assessments and provide ISP compliance training and awareness campaigns to implement the model. They can also disseminate cues about information security issues and how the ISP can assist employees in handling them, discourage behaviour that leads to complacency towards ISP compliance, and update the ISP to keep it relevant. The proposed model presents an opportunity for future research to evaluate its applicability in organisational settings.