Employees’ failure to comply with IS security procedures is a key concern for organizations today. A number of socio-cognitive theories have been used to explain this. However, prior studies have not ...examined the influence of past and automatic behavior on employee decisions to comply. This is an important omission because past behavior has been assumed to strongly affect decision-making.
To address this gap, we integrated habit (a routinized form of past behavior) with Protection Motivation Theory (PMT), to explain compliance. An empirical test showed that habitual IS security compliance strongly reinforced the cognitive processes theorized by PMT, as well as employee intention for future compliance. We also found that nearly all components of PMT significantly impacted employee intention to comply with IS security policies. Together, these results highlighted the importance of addressing employees’ past and automatic behavior in order to improve compliance.
Fear appeals, which are used widely in information security campaigns, have become common tools in motivating individual compliance with information security policies and procedures. However, ...empirical assessments of the effectiveness of fear appeals have yielded mixed results, leading IS security scholars and practitioners to question the validity of the conventional fear appeal framework and the manner in which fear appeal behavioral modeling theories, such as protection motivation theory (PMT), have been applied to the study of information security phenomena. We contend that the conventional fear appeal rhetorical framework is inadequate when used in the context of information security threat warnings and that its primary behavioral modeling theory, PMT, has been misspecified in the extant information security research. Based on these arguments, we propose an enhanced fear appeal rhetorical framework that leverages sanctioning rhetoric as a secondary vector of threats to the human asset, thereby adding the dimension of personal relevance, which is critically absent from previous fear appeal frameworks and PMT-grounded security studies. Following a hypothetical scenario research approach involving the employees of a Finnish city government, we validate the efficacy of the enhanced fear appeal framework and determine that informal sanction rhetoric effectively enhances conventional fear appeals, thus providing a significant positive influence on compliance intentions.
The purchase of eco-friendly products is encouraged by the governments due to its contributions to the sustainable development of the environment. It is therefore important to examine factors ...influencing the purchase of eco-friendly products. Based on the attitude-behavior-context (ABC) theory, this paper constructs a conceptual model, which explores how a consumer’s perceived effectiveness affects individuals’ purchase of eco-friendly products. In details, this paper attempts to examine the mediating role of consumption attitude of eco-friendly products, as well as the moderating effect of applications of information and communication technologies (ICT) innovation. Moreover, by building a Hidden Markov Model (HMM), this paper further tests the conceptual model. More importantly, based on the HMM, the consumption probabilities of eco-friendly products of different perceived effectiveness under different applications of ICT innovation are computed. Furthermore, based on a dynamic time series, the consumption transition probability of eco-friendly products is further calculated. In addition, this paper explains and calculates the concepts continuity, dependence and inertia in consumption of eco-friendly products. Based on it, the algorithm is used to forecast the consumption behavior of the real environment to verify the reliability of the HMM and the accuracy of probability calculation. This paper contributes the extension of the existing studies and the provision of management implications and guidance for the consumption practice of eco-friendly products.
Beliefs about natural science have been influential in information system (IS; Orlikowski and Baroudi, 1991).1 For example, a belief exists that ‘the methods of natural science constitute the only ...legitimate methods for use in social science’ (Evaristo and Karahanna, 1997: 39). These legitimate methods include the use of ‘quantitative empirical methodologies—field experiment, survey, and laboratory experiments’ (Evaristo and Karahanna, 1997: 39). Understandably, many qualitative IS scholars have reported serious pressure to meet such standards. For example, De Vaujany et al. (2011) asserted that ‘in order to survive, the IS field had to draw on a model of research attributed to the natural sciences’ (p. 405). Similarly, Lyytinen and King (2004) referred to the ‘orthodox’ view in IS, according to which the IS ‘field’s survival depended on . . . drawing on a model of research attributed to the natural sciences’ (p. 222).
It is widely agreed that employee non-adherence to information security policies poses a major problem for organizations. Previous research has pointed to the potential of theories of moral reasoning ...to better understand this problem. However, we find no empirical studies that examine the influence of moral reasoning on compliance with information security policies. We address this research gap by proposing a theoretical model that explains non-compliance in terms of moral reasoning and values. The model integrates two well-known psychological theories: the Theory of Cognitive Moral Development by Kohlberg and the Theory of Motivational Types of Values by Schwartz. Our empirical findings largely support the proposed model and suggest implications for practice and research on how to improve information security policy compliance.
The literature agrees that the major threat to IS security is constituted by careless employees who do not comply with organizations' IS security policies and procedures. To address this concern, ...different approaches for ensuring employees' IS security policy compliance have been proposed. Prior research on IS security compliance has criticized these extant IS security awareness approaches as lacking theoretically and empirically grounded principles to ensure that employees comply with IS security policies. To fill this gap, this study proposes a theoretical model that contains the factors that explain employees' IS security policy compliance. Data (N=245) from a Finnish company provides empirical support for the model. The results suggest that information quality has a significant effect on actual IS security policy compliance. Employees' attitude, normative beliefs and habits have significant effect on intention to comply with IS security policy. Threat appraisal and facilitating conditions have significant impact on attitude towards complying, while coping appraisal does not have a significant effect on employees' attitude towards complying. Sanctions have insignificant effect on intention to comply with IS security policy and awards do not have a significant effect on actual compliance with IS security policy
Scholars have developed several modern information systems security (ISS) methods. Yet the traditional ISS methods - ISS checklists, ISS standards, ISS maturity criteria, risk management (RM) and ...formal methods (FM) - are still among the most used ISS methods. This study makes sense of these traditional ISS methods by comparing their underlying key assumptions. The main finding is that the traditional ISS methods regurgitate several features and assumptions that are required to be dealt with by traditional ISS methods developers and practitioners.
Employees' failure to comply with information systems security policies is a major concern for information technology security managers. In efforts to understand this problem, IS security researchers ...have traditionally viewed violations of IS security policies through the lens of deterrence theory. In this article, we show that neutralization theory, a theory prominent in Criminology but not yet applied in the context of IS, provides a compelling explanation for IS security policy violations and offers new insight into how employees rationalize this behavior. In doing so, we propose a theoretical model in which the effects of neutralization techniques are tested alongside those of sanctions described by deterrence theory. Our empirical results highlight neutralization as an important factor to take into account with regard to developing and implementing organizational security policies and practices.
PDF
