Variables influencing information security policy compliance

Peers may help others avoid violating organisational information security policies (ISPs). This study explores how peer monitoring reduces employee ISP violation intention. We propose that peer monitoring discourages employees from violating ISP. Moreover, trust plays an important role. Trust not only facilitates peer monitoring, but also moderates the effect of peer monitoring on employee ISP violation intention. In addition, collective responsibility leads to peer monitoring. We test our research model with data from two waves of surveys of 254 employees in the United States conducted two weeks apart. We utilise four scenarios in the second wave of surveys capturing the dependent variable and measure all other constructs in the first wave of surveys. Our results suggest that peer monitoring decreases one’s intention to violate ISPs. Furthermore, both collective responsibility and trust contribute to peer monitoring. Finally, trust amplifies the effect of peer monitoring on employees’ intention to violate ISPs. We discuss the theoretical contributions and practical implications.

PurposeThis paper aims to establish that employees’ non-compliance with information security policy (ISP) could be addressed by nurturing ISP compliance culture through the promotion of factors such as supportive organizational culture, end-user involvement and compliance leadership to influence employees’ attitudes and behaviour intentions towards ISP in organizations. This paper also aims to develop a testable research model that might be useful for future researchers in predicting employees’ behavioural intentions.Design/methodology/approachIn view of the study’s aim, a research model to show how three key constructs can influence the attitudes and behaviours of employees towards the establishment of security policy compliance culture (ISPCC) was developed and validated in an empirical field survey.FindingsThe study found that factors such as supportive organizational culture and end-user involvement significantly influenced employees’ attitudes towards compliance with ISP. However, leadership showed the weakest influence on attitudes towards compliance. The overall results showed that employees’ attitudes and behavioural intentions towards ISP compliance together influenced the establishment of ISPCC for ISP compliance in organizations.Practical implicationsOrganizations should influence employees’ attitudes towards compliance with ISP by providing effective ISP leadership, encouraging end-user involvement during the draft and update of ISP and nurturing a culture that is conducive for ISP compliance.Originality/valueThe study provides some insights on how to effectively address the problem of non-compliance with ISP in organizations through the establishment of ISPCC, which has not been considered in any past research.

Despite increasing investment in information security and its strategic role in today’s business success, effective implementation of information security strategies still remains one of the top challenges facing global organizations. This study investigated Information Security Policy compliance of staff members of a municipality in South Africa. Factors such as information security policy, security policy strategic planning, policy implementation and compliance were considered. A questionnaire was distributed to 80 staff members from different sections in this municipality and a response rate of 100% was achieved. The study findings showed that the majority of employees are largely in support of the municipality’s efforts to develop and implement a security policy framework. They also concur that compliance to security policy safeguards and prevents intrusion information, theft and "denial of service". Among other issues, it is recommended that more training and awareness campaigns should be done to all employees in order to improve security of information in this municipality. The study results can be limited by the small number of the population as indicated that the sample was equal to the population (N=n).

Insiders’ negligence or abuse is regarded as a leading cause of information security breaches in organizations. As most of the extant studies have largely examined insider threats at a high level of abstraction, the role of situational moral reasoning for information security policy (ISP) violations in specific situations has received little attention. To advance this line of research, this paper opens up a potentially fruitful path for IS researchers by applying situational action theory (SAT) to contextually examine why employees violate ISPs in particular situations. We consider the violations of password security policy, internet use policy, and confidential data security policy, and examine specific violation intents ranging from altruistic to malicious. The results support most of the assertions derived from SAT. We found situational moral beliefs to be the predominant driver for ISP violations across three situations in an organizational setting. However, the moderation effect of moral beliefs was only significant in situations involving sharing passwords and selling confidential data. Sanction certainty and sanction severity were also found to have different effects across situations. We conclude by presenting implications for IS security practitioners and suggestions for future research.

A rich stream of research has identified numerous antecedents to employee compliance (and noncompliance) with information security policies. However, the number of competing theoretical perspectives and inconsistencies in the reported findings have hampered efforts to attain a clear understanding of what truly drives this behavior. To address this theoretical stalemate and build toward a consensus on the key antecedents of employees’ security policy compliance in different contexts, we conducted a meta-analysis of the relevant literature. Drawing on 95 empirical papers, we classified 401 independent variables into 17 distinct categories and analyzed each category’s relationship with security policy compliance, including an analysis for possible domain-specific moderators. A meta-analytic relative weight analysis determined the relative importance of each category in predicting security policy compliance, while adding robustness to our findings. At a broad level, our results suggest that much of the security policy compliance literature is plagued by suboptimal theoretical framing. Our findings can facilitate more refined theory-building efforts in this research domain and serve as a guide for practitioners to manage security policy compliance initiatives.

WHAT IS KNOWN ON THE SUBJECT?: Seclusion involves isolating a patient in a room away from other patients in order to contain aggressive behaviour, and it is used in psychiatric hospitals. Research has found that seclusion is often viewed by patients as negative; however, there is limited in-depth understanding of the deeply personal experience. WHAT THIS PAPER ADDS TO EXISTING KNOWLEDGE?: This systematic review found that the published research may have flaws with the quality of analysis, mainly due to limited researcher reflexivity. The review of qualitative research revealed that during seclusion, patients feel vulnerable, neglected and abused, disconnected from the experience and that it is dangerous to their mental health. WHAT ARE THE IMPLICATIONS FOR PRACTICE?: For clinicians facilitating the seclusion process to use their therapeutic skills to provide patients with a sense of being cared for. For clinical supervision to allow space to explore interpersonal dynamics during seclusion in order to enhance therapeutic staff-patient interaction. Abstract Introduction There is limited understanding of patients' seclusion experience. A 2013 systematic review provides some insight; however, more knowledge is required in order to improve patient care. This is a systematic review of qualitative research into the patient experience of seclusion. The qualitative focus enables the phenomena to be the central focus. Question "What are adult psychiatric inpatients' experience of seclusion?" and "What is the quality of the applicable research?" Method Electronic searches for qualitative research published between 2006 and 2017 were undertaken. Data were excluded if it was not explicitly related to seclusion. Research was appraised using three standardized appraisal criterion. Themes were generated through thematic synthesis. Results Eight papers met inclusion criteria; four had been translated into English. Four themes were identified: "feeling vulnerable," "feeling neglected and abused," "disconnecting" and "seclusion is dangerous to mental health." Participants felt vulnerable and without control. They experienced staff and room as neglectful and abusive. Participants mentally disconnected. The experience threatened participants' mental health. Discussion Participants' experience is an amalgamation of interpersonal experience and the environment. Disconnecting may be a coping strategy. Implications for practice The findings have implications for seclusion practice, staff training and clinical supervision. Specific attention needs to be paid to the staff-patient interaction.

Managing Security Clearances within Government Institutions

Crowdsourcing is a well-established concept in several application areas of computer science and information systems. While crowdsourcing is favored in areas such as information sharing, quality management or data acquisition, only little attention has been drawn to crowdsourcing capabilities for information security in the past. Since a few years an increase of crowdsourcing-based research in information security can be identified. To which extend remains unclear since a comprehensive overview of applied crowdsourcing techniques and related challenges is missing. In this paper we try to shed some light on this by conducting a systematic literature review based on the snowballing methodology. It delivered 23 relevant papers which we analyzed with respect to the following perspectives: (a) Bibliographic information, (b) applied research methodology, (c) addressed information security application context, (d) applied crowdsourcing approach, and (e) challenges for crowdsourcingbased research in information security. Finally, based on the described investigations, we give a comprehensive overview, and identify several challenges of crowdsourcing based research in information security.

Information Security Policy (ISP) is an important domain used to preserve the confidentiality, integrity, and availability of sensitive data. However, it is an ambiguous and diverse domain due to the diversity of security policies and the multiplicity nature of organization systems. Numerous specific and generic ISP models have been offered for several purposes. The offered models have numerous redundant procedures, concepts, activities, processes, and tasks that make the ASP domain unorganized, unstructured, and ambiguous among domain experts and users. Thus, the structured and integrated model to simplify sharing, managing, and reusing ISP activities and tasks is still missing. This study applied the design science method to develop a unified model for the ISP domain called the Integrated Information Security Policy Model (IISPM). This aims to identify, recognize, extract, and match different ISP processes, concepts, activities, and tasks from different ISP models in a developed IISPM, thus, allowing domain experts and users to derive/instantiate solution models easily. The developed IISPM consists of six main abstract processes: Information security policy process, information security awareness process, access control process, observing the process, agreement process, and plan process. Each introduced process has specific security practices. The output showed that IISPM assists domain experts and users to create their solution models based on their requirements.

INTRODUCTION Today, in large part, information security is the implementation of controls and best practices suggested by consultants, standard governing bodies (i.e. National Institute of Standards & Technology) (NIST), International Organization for Standardization / International Electrotechnical Commission (ISO/IEC), etc.), the organization's information security department and, sometimes, the organization's employees. While the use of global standards of practice, top management and the information security department within the organization to guide information security planning and implementations may be useful, existing research consistently shows a positive relationship exists between user involvement in planning and the effectiveness of the information systems function within organizations (Gottschalk, 1999; Sambamurthy et al., 1994; Segars & Grover, 1998). A deliverable of the information security planning process is the organization's information security policies and procedures. Standard governing bodies (NIST, ISO/IEC) and researchers (Bidgoli, 2003; Garrison & Posey, 2006) stress the importance of creating information security policies and provide guidance on the different types of information security policies that an organization may need. This research attempts to examine the impact of end-user involvement and formalized information security policies on the effectiveness of the information security function within organizations. Specifically, this study focuses on two antecedent variables, collaborative exchange and formalization, and how it impacts the effective utilization of the information security strategies of deterrence, detection and recovery. Collaborative exchange is an assessment of the extent of collaboration between upper-level management, end users and the information security function. Formalization is an assessment of the extent of established formal information security policies within an organization. The purpose of this research is twofold. First, this research aims to examine the individual effects of formalization and collaborative exchange on the effectiveness of information security detection, deterrence, and recovery activities. Much of the effort expended in the management of information security is in developing and enforcing information security policies. By examining formalization separately, the impact of information security policy development on effective utilization of information security strategies can be assessed. The second aim of this research is to examine the impact of collaborative exchange and formalization in concert on the effectiveness of information security detection, deterrence, and recovery activities. Evaluating complementary effect of collaborative exchange and formalization on effective utilization of information security strategies provides evidence supporting the importance of establishing information security policies with input and effort from all major constituencies within the organization. This study makes several contributions to the literature and practice. First, this research provides insight into how management choices in regards to establishing formal communication channels and developing information security policies may impact the effectiveness of the information security function. Second, the presence of the dependent variable, effectiveness of detection, deterrence and recovery activities, gives academics and practitioners a success measure which can guide more effective decision making in the information security domain. The remainder of this manuscript is organized as follows. The next section discusses the literature supporting the constructs of interest in this study. The following two sections will present the methodological approach taken in this study and the results of data collection. The next section will present the efforts in data analysis. The last section will present a discussion of the important findings and limitations of this research. …

Information security policy (ISP) noncompliance continue to impede information security in organizations. This paper consolidates the strength of previous studies into an effective single solution. The paper, first, synthesizes the existing literature and groups relevant ISP compliance factors into user involvement, personality types, security awareness and training, behavioral factors, and information security culture. Secondly, a generic framework that guides the development of frameworks for ISP compliance in organizations was developed based on the literature review. The generic framework categorized elements required for developing an ISP compliance framework into structure, content and outcome elements. Thirdly, the generic framework was applied to develop a composite ISP compliance framework that proposes the establishment of ISP compliance as a culture in organizations. Finally, the results of the expert review assessment showed that the proposed composite ISP framework was suitable, structurally sound and fit for purpose.

According to a review of the literature, Many employees are unaware of information security policies or choose to disregard them, which can lead to non-compliance. Lack of compliance with the intended policy results from a failure to understand the complicated relationships in the design and implementation of information security rules. This paper assesses the gaps in information security policy compliance. The paper aims to assess the existence of any gaps in the compliance and awareness of employees in the company. In this study, A questionnaire method was utilized to provide an understanding of the compliance within the organization. The questions were carefully selected to cover several factors of the subject areas. The outcome of the questionnaire is important to assess any hypothetical noncompliance among employees, and to specify who is more responsible, the management or the employee. The result finds that many employees are unaware of disregarding information security policies, which can lead to security breaches. The results show that employees are often unaware of information security policies and that they may not understand the importance of compliance. The paper concludes with recommendations for improving employee awareness and compliance with information security policies.

The key threat to information security is constituted by careless employees who do not comply with information security policies. To ensure that employees comply with organizations’ information security procedures, a number of information security policy compliance measures have been proposed in the past. Prior research has criticized these measures as lacking theoretically and empirically grounded principles to ensure that employees comply with information security policies. To fill this gap in research, this paper advances a new model that explains employees’ adherence to information security policies. In this model, we extend the Protection Motivation Theory (PMT) by integrating the General Deterrence Theory (GDT) and the Theory of Reasoned Action (TRA) with PMT. To test this model, we collected data (N = 917) from four different companies. The results show that threat appraisal, self-efficacy and response efficacy have a significant impact on intention to comply with information security policies. Sanctions have a significant impact on actual compliance with information security policies. Intention to comply with information security policies also has a significant impact on actual compliance with information security policies.KeywordsInformation SecuritySecurity PolicyActual ComplianceResponse EfficacyThreat AppraisalThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Diligent compliance with Information security Policies (ISP) can effectively deter threats but can also adversely impact organizational productivity, impeding organizational task completion during extreme events. This paper examines employees’ job performance during extreme events. We use the conservation of resources (COR) theory to examine how psychological resources (individual resilience, job meaningfulness, self-efficacy) and organizational resources (incident command leadership, information availability, and perceived effectiveness of security and privacy controls) influence ISP compliance decisions and job performance during extreme events. The results show that a one-size-fits-all approach to ISP is not ideal during extreme events; ISP can distract employees from critical job tasks. We also observed that under certain conditions, psychological resources, such as individual resilience, are reserved for job performance, while others, such as self-efficacy, are reserved for ISP compliance. A post hoc analysis of data from respondents who experienced strain during a real extreme event while at work was conducted. Our discussion provides recommendations on how security and privacy policies can be designed to reflect disaster conditions by relaxing some policy provisions.

Given the strategic dependence on information and information technology by individuals, workgroups (teams), organizations, industries, nations, and society overall, it is imperative that the integrity of that information is maintained in all three states – during transmission, during storage, and during processing. Information (and information systems) security management is the process of ensuring the confidentiality, integrity, and availability of information whenever and wherever it is transmitted, stored, and processed (sometimes called the “CIA Triad”). While perfect security is desirable, it is unfortunately unattainable. There are numerous active and passive threats to the security of information, as well as responses to these threats that must be adopted by individuals, teams, and organizations. Various technical and behavioral controls are used to counter these threats, but this article will focus on the behavioral controls. Threats characteristics and threat examples are discussed below, as are the responses to such threats. Research findings support the importance of both internal and external threats, with internal threats demonstrating the greatest negative impact in most cases. Factors that contribute to individual compliance with security policies will be discussed, along with some discussion of the intentional violation of security protocols and policies by malicious individuals.