Purpose
This study aims to identify antecedents to noncompliance behavior influenced by decision contexts where investments in time, effort and resources are devoted to a task – referred to as a task ...unlikely to be completed without violating the organization’s information security policy (ISP).
Design/methodology/approach
An empirical test of the suggested relationships in the proposed model was conducted through a field study using the survey method for data collection. Pre-tests, pre-study, main study and a follow-up study compose the frame of our methodology where more than 500 respondents are involved across different organizations.
Findings
The results confirm that the antecedents that explain the escalation of commitment behavior in terms of the effect of lost assets, such as time, effort and other resources, give us a new lens to understand noncompliance behavior; employees seem to escalate their commitments to the completion of their tasks at the expense of becoming noncompliant with ISP.
Research limitations/implications
One of the key areas that requires further attention from this study is to better understand the role of risk perceptions on employee behavior when dealing with value conflicts. Depending on how risk-averse or risk seeking an employee is, the model showed no significant support in either case to influence their noncompliance behavior. The authors therefore argue that employees' noncompliance may be influenced by more powerful beliefs, such as self-justification and sunk costs.
Practical implications
The results show that when employees are caught in tasks undergoing difficulties, they are more likely to increase noncompliance behavior. By understanding better how project obstacles result in such tasks, security managers can define new mechanisms to counter employees’ shift from compliance to noncompliance.
Social implications
Apart from encouraging compliance with enforcement mechanisms (using direct behavioral controls like sanctions or rewards), indirect behavior controls may also encourage compliance. The authors suggest that the ISPs should state that the organization would take positive actions toward task completion and help their employees to resolve their problems quickly.
Originality/value
This study is the first to tackle escalation of commitment theories and use antecedents that explain the effect of lost assets, such as time, effort and other resources can also explain noncompliance with ISP in terms of the value conflicts, where employees would often choose to forego compliance at the expense of finishing their tasks.
Social media tools that connect patients, caregivers, and health providers offer great potential for helping people access health advice, receive and give social support, manage or cope with chronic ...conditions, and make day-to-day health decisions. These systems have seen widespread adoption, but often fail to support the goals as fully as designers and users would like. Through Ackerman's lens of the "sociotechnical gap" and computer supported cooperative work (CSCW) as a science of the artificial, we review contemporary sociotechnical challenges and progress for using social media to support health. These challenges include a tension between privacy and sharing, policy information credibility, accessibility, and tailoring in social spaces. Those studying, building, deploying, and using social media systems to further health goals will benefit from approaching this work by borrowing from Ackerman's framing of CSCW. In particular, this requires acknowledgment that technical systems will not fully meet our social goals, and then adopting design and educational approaches that are appropriate to fill this gap, building less-nuanced systems as partial solutions and tools for advancing our understanding, and by working with the CSCW research community to develop and pursue key lines of inquiry.
Many organizations recognize that their employees, who are often considered the weakest link in information security, can also be great assets in the effort to reduce risk related to information ...security. Since employees who comply with the information security rules and regulations of the organization are the key to strengthening information security, understanding compliance behavior is crucial for organizations that want to leverage their human capital. This research identifies the antecedents of employee compliance with the information security policy (ISP) of an organization. Specifically, we investigate the rationality-based factors that drive an employee to comply with requirements of the ISP with regard to protecting the organization's information and technology resources. Drawing on the theory of planned behavior, we posit that, along with normative belief and self-efficacy, an employee's attitude toward compliance determines intention to comply with the ISP. As a key contribution, we posit that an employee's attitude is influenced by benefit of compliance, cost of compliance, and cost of noncompliance, which are beliefs about the overall assessment of consequences of compliance or noncompliance. We then postulate that these beliefs are shaped by the employee's outcome beliefs concerning the events that follow compliance or noncompliance: benefit of compliance is shaped by intrinsic benefit, safety of resources, and rewards, while cost of compliance is shaped by work impediment; and cost of noncompliance is shaped by intrinsic cost, vulnerability of resources, and sanctions. We also investigate the impact of information security awareness (ISA) on outcome beliefs and an employee's attitude toward compliance with the ISP. Our results show that an employee's intention to comply with the ISP is significantly influenced by attitude, normative beliefs, and self-efficacy to comply. Outcome beliefs significantly affect beliefs about overall assessment of consequences, and they, in turn, significantly affect an employee's attitude. Furthermore, ISA positively affects both attitude and outcome beliefs. As the importance of employees' following their organizations' information security rules and regulations increases, our study sheds light on the role of ISA and compliance-related beliefs in an organization's efforts to encourage compliance.
This paper investigates how managers in the upstream firm (i.e., supplier) adjust their allocations of cost resources in response to managerial expectations of the downstream firms (i.e., customers) ...on the future demand and prospects. We conduct an empirical analysis to examine the impact of the tone of customers’ forward‐looking disclosures (FLDs) contained in the Management Discussion and Analysis section of 10‐K filings on suppliers’ asymmetric cost behaviors, characterizing costs decreasing less for sales fall than increasing for equivalent sales rise (i.e., “cost stickiness”). We show that the degree of suppliers’ asymmetric cost management is positively associated with their customers’ tone of FLDs. Moreover, such an association is stronger when the suppliers produce more unique products for their major customers. Our inferences remain robust after controlling for the strategic disclosure behavior of the customer firms, ruling out an alternative mechanism of suppliers’ own managerial expectations and managerial empire‐building incentives. Lastly, using a decision made by the U.S. Supreme Court in 2005 as a quasi‐natural experiment setting, we show that the effect of customers’ tone of FLDs on suppliers’ cost stickiness becomes stronger when FLDs are more informative. To the best of our knowledge, this paper is the first to introduce cost stickiness in the operations management context to capture management's operational decision intervention regarding resource allocation. We also contribute to information sharing literature by highlighting the importance of channels other than the traditional explicit information sharing channel in obtaining demand‐relevant information in supply chains.
This research investigates the determinants of the performance of small and medium sized manufacturers on business-to-business electronic marketplaces (B2B EMs). Based on the resource-based view, the ...framework proposed suggests that a manufacturing firm's performance on a B2B EM is determined by EM enabling capabilities, namely the online marketing capability, flexible manufacturing capability and content management capability. Further, the framework posits that these EM enabling capabilities are in turn determined by the firm's IT capability. Data from 358 online manufacturers participating in a B2B EM is collected and analyzed. The results confirm our hypotheses that the online marketing capability, flexible manufacturing capability and content management capability fully mediate the impact of the IT capability on the firm's online performance. Furthermore, the online marketing capability is found to be a stronger factor in influencing the manufacturer's online performance than the others.
•Performance of manufacturers operating on B2B electronic marketplaces is studied.•The model explaining the performance includes IT capability and EM enabling capabilities of the manufacturers.•The research model was tested using data from 358 online manufacturers.•IT capability positively affect the performance of manufacturers through the mediation of EM enabling capabilities.
This research investigates whether early mover advantage (EMA) exists among entrepreneurial e-tailers operating on third-party e-commerce platforms. Contrary to traditional wisdom, the current ...research hypothesizes that e-tailers may enjoy early mover advantages because of the consumer demand inertia amplified by the nature of the Internet and the system design characteristics of e-commerce platforms. We also argue that customer relationship management capabilities help enhance early mover advantages in an online setting. We employ panel data on 7309 e-tailers to perform analyses and find empirical evidence that strongly supports the abovementioned hypotheses.
We examine the role of granular privacy controls on dynamic content-sharing activities and disclosure patterns of Facebook users based on the exogenous policy change in December 2009. Using a unique ...panel data set, we first conduct regression discontinuity analyses to verify a discontinuous jump in context generation activities and disclosure patterns around the time of the policy change. We next estimate unobserved effects models to assess the short-run and long-run effects of the change. Results show that Facebook users, on average, increase use of wall posts and decrease use of private messages after the introduction of granular privacy controls. Also, users’ disclosure patterns change to reflect the increased openness in content sharing. These effects are realized immediately and over time. More importantly, we show that user-specific factors play crucial roles in shaping users’ varying reactions to the policy change. While more privacy sensitive users (those who do not reveal their gender and/or those who have exclusive disclosure patterns ex ante) share more content openly and less content secretly than before, less privacy sensitive users (those who reveal their gender and/or those who have inclusive disclosure patterns ex ante) share less content openly and more content secretly after the change. Hence, the policy change effectively diminishes variation among Facebook users in terms of content-generation activities and disclosure patterns. Therefore, characterizing the privacy change as a way to foster openness across all user categories does not reveal the change’s true influence. Although an average Facebook user seems to favor increased openness, the policy change has different impacts on various groups of users based on their sensitivity to privacy, and this impact is not necessarily toward increased openness. To our knowledge, this is the first study that relies on observational data to assess the impact of a major privacy change on dynamic content-sharing activities and the resulting disclosure patterns of Facebook users.
The body of research examining the board's involvement in information technology governance (ITG) is expanding. While there is a growing consensus on the importance of this phenomena, the focal ...concept is still shrouded in confusion. Drawing upon theories on corporate governance, we develop a unifying analytical (Type 1) theory delineating the board's involvement in ITG. The proposed theory can be used by researchers for investigating this phenomenon, and by practitioners for training and policy formulation.
•Organizations invest in three types of information security control resources (ISCR).•Internal security needs assessment (ISNA) affects the level of ISCR in organizations.•Key activities of ISNA are ...security investment rationale and risk analysis.•Institutional pressures affect ISCR directly and indirectly through ISNA.•Coercive and normative pressures are two critical institutional pressures.
To offer theoretical explanations of why differences exist in the level of information security control resources (ISCR) among organizations, we develop a research model by applying insights obtained from resource-based theory of the firm and institutional theory. The results, based on data collected through a survey of 241 organizations, generally support our research model. Institutional pressures and internal security needs assessment (ISNA) significantly explain the variation in organizational investment in ISCR. Specifically, coercive and normative pressures are found to have not only a direct impact but also an indirect impact through ISNA on organizational investment in ISCR.
The increasing use of information technology artifacts in daily life makes security a shared responsibility of both users and companies. In recent years, increasing a user's objective (i.e., actual) ...security knowledge and providing applications with more secure default settings appear among the most ubiquitous tools companies use to broaden their efforts to help users make more secure decisions. Examining both solutions matters because they are widely used, cost effective, and understood by many security practitioners. Additionally, default settings and users’ objective knowledge provide anchors for decision-making. However, human errors and insecure default settings are increasing and raising further questions about the efficacy of such efforts. Using the theory of bounded rationality, we investigated the role of objective, subjective (i.e., self-assessed) security knowledge, and default settings security level on the overall decision security. We found that objective security knowledge can lead to secure decisions when paired with high subjective security knowledge. In the absence of the latter, objective security knowledge is unable to lead to better security decisions. Furthermore, subjective security knowledge reduces the extent to which users fully accept default security settings, thereby mitigating bias toward insecure default settings.
PDF
