I ntentional insider misuse of information systems resources (i.e., IS misuse) represents a significant threat to organizations. For example, industry statistics suggest that between 50%-75% of security incidents originate from within an organization. Because of the large number of misuse incidents, it has become important to understand how to reduce such behavior. General deterrence theory suggests that certain controls can serve as deterrent mechanisms by increasing the perceived threat of punishment for IS misuse. This paper presents an extended deterrence theory model that combines work from criminology, social psychology, and information systems. The model posits that user awareness of security countermeasures directly influences the perceived certainty and severity of organizational sanctions associated with IS misuse, which leads to reduced IS misuse intention. The model is then tested on 269 computer users from eight different companies. The results suggest that three practices deter IS misuse: user awareness of security policies; security education, training, and awareness (SETA) programs; and computer monitoring. The results also suggest that perceived severity of sanctions is more effective in reducing IS misuse than certainty of sanctions. Further, there is evidence that the impact of sanction perceptions vary based on one's level of morality. Implications for the research and practice of IS security are discussed.

we use coping theory to explore an underlying relationship between employee stress caused by burdensome, complex, and ambiguous information security requirements (termed "security-related stress" or SrS) and deliberate information security policy (ISP) violations. results from a survey of 539 employee users suggest that SrS engenders an emotion-focused coping response in the form of moral disengagement from ISP violations, which in turn increases one's susceptibility to this behavior. Our multidimensional view of SrS-comprised of security-related overload, complexity, and uncertainty-offers a new perspective on the workplace environment factors that foster noncompliant user behavior and inspire cognitive rationalizations of such behavior. The study extends technostress research to the information systems security domain and provides a theoretical framework for the influence of SrS on user behavior. For practitioners, the results highlight the incidence of SrS in organizations and suggest potential mechanisms to counter the stressful effects of information security requirements. Downloaded by [Northeastern University]AcADeMics AnD prAcTiTioners AliKe recognize eMployees as a major threat to organizational information security efforts [14,69]. To address this "insider" threat, organizations have devoted significant resources into behavioral security measures, such as policy development and education and training, in addition to continually updating their security technologies [54]. U.S. federal and state governments and certain industries have also introduced regulations and standards that mandate organizations' internal security measures [14]. Despite these initiatives, a class of employee security-related behaviors known as volitional (but not malicious) information security policy (ISP) violations [27, 71] (e.g., password sharing, failing to log off when leaving workstation) continue to plague organizations. At least some explanation for this predicament is that employees face a surfeit of rapidly expanding security requirements (i.e., policies, procedures, and technical controls), which they find to be constraining, inconvenient, and difficult to understand [51,53,69]. Evidence of this comes from a recent survey of over 2,800 employees [16] in which "too busy to think about policies" and "policies are inconvenient to follow" were reported as chief reasons for ISP violations. Some authors have suggested that security requirements can backfire and bring about security-diminishing behavior due to the demands (e.g., time, effort, frustration) they impose on employees [51,60,64]. Although there is preliminary evidence to support this notion [51], the information systems (IS) literature lacks a systematic, theorydriven investigation of the potential adverse effects of organizational information security requirements (hereafter security requirements) on user behavior. A goal of this paper is to address this gap.Against this backdrop, we offer a new avenue for understanding employees' ISP violations-namely, workplace ...

No abstract

No abstract

Paradoxically, virtual teams are ubiquitous and often successful, contrary to most current communication theories'predictions. Media naturalness theory (Kock, 2001), an evolutionary perspective on communication and its principles of media naturalness, innate schema similarity, and learned schema diversity can be used to understand, study, and manage successful virtual teamwork. In particular, potential problems of trust and leadership in virtual teams are shown to be amenable to solutions rooted explicitly in an evolutionary context. From a media naturalness perspective, geographic distance and technological complexity are secondary to processes of adaptation, as humans remain the most complex and flexible part of the communication system. © 2004 Wiley Periodicals, Inc.