An Enhanced Fear Appeal Rhetorical Framework:  Leveraging Threats to the Human Asset Through Sanctioning Rhetoric

Johnston, Allen C.; Warkentin, Merrill; Siponen, Mikko T.

doi:10.25300/misq/2015/39.1.06

Cited by 333 publications

(242 citation statements)

References 89 publications

Supporting

Mentioning

235

Contrasting

Order By: Relevance

“…Indeed, such articles also appear in the best IS journals. Examples in MIS Quarterly include action research papers (Puhakainen & Siponen, 2010;Straub & Welke 1998) and a field experiment (Johnston, Warkentin, & Siponen, 2015). The Journal of the Association for Information Systems (JAIS) has also published ISS research carried out in a company setting (Siponen, Baskerville, & Heikka, 2006).…”

Section: Some Outcomes Of the Current Iss Researchmentioning

confidence: 99%

“…Examples of such applied research include Puhakainen and Siponen (2010), Warkentin and Johnston (2010), and Johnston et al (2015). Siponen and Puhkainen reported multicycle action research interventions that improved employees' e-mail encryption practices at a small company, while Warkentin and Johnston and Johnston et al described online campaigns using fear appeals to scare users into better password security, avoiding insecure use of USBs, and locking their computers.…”

Section: Applied Research Examplesmentioning

confidence: 99%

See 1 more Smart Citation

Intervention Effect Rates as a Path to Research Relevance: Information Systems Security Example

Siponen¹,

Baskerville²

2018

JAIS

Self Cite

View full text Add to dashboard Cite

In the current information systems security (ISS) research, new theory contributions are especially valued. This research typically reflects the following formula: Suggest a new theory (or set of constructs) of ISS and show that it is empirically supported, then suggest another new theory (or set of constructs with some linkages) and show that it is empirically supported, and so on. Despite the merits of this approach, it leaves out many important scientific aspects. For example, after more than 30 years of ISS research, (1) we know little about the conditions and situations to which new theories (or constructs) do not apply; (2) we do not know which new theories are more effective than others in solving an ISS problem; and (3) we have not demonstrated that our best research, or new theoretical contributions, can beat industry best practices or practitioners' intuitive approaches. We suggest that ISS research be examined in terms of long-term research programs comprising four levels: metalevel research, basic research, applied research, and postintervention research. The ultimate success of such programs does not entail new theories, "contextualized theories," or adding IT artifacts to theories; rather, it hinges on the question of which program can demonstrate the best intervention effect rate for a given ISS problem. The lack of demonstrated intervention effectiveness (e.g., by showing treatment effect rates) is one important inhibitor that may prevent ISS research from achieving relevance in practice. Without reporting such evidence, ISS research cannot overpower the folklore, fads, or industry "best practices" that often guide operations. With such treatment effect rates, evidence-based practice may become more justifiable. We believe that our ideas also can be applied to information systems research in general.

show abstract

Section: Some Outcomes Of the Current Iss Researchmentioning

confidence: 99%

Section: Applied Research Examplesmentioning

confidence: 99%

Intervention Effect Rates as a Path to Research Relevance: Information Systems Security Example

Siponen¹,

Baskerville²

2018

JAIS

Self Cite

View full text Add to dashboard Cite

show abstract

“…Human factors play a crucial role in cybersecurity [60], and recent analyses show that employees are often the weakest link in an organization with regard to cybersecurity [61]. As a result, organizations are urged to consider investing in cybersecurity training as a top priority [62], and to encourage protection-motivated behaviors [63,64]. These recommendations mean nothing if organizations fail to understand the impacts of delays and fall into the trap of shorttermism.…”

Section: Complex Systems and Delays In Building Cybersecurity Capabilmentioning

confidence: 99%

Decision Making and Biases in Cybersecurity Capability Development: Evidence from a Simulation Game Experiment

2017

View full text Add to dashboard Cite

Abstract:We developed a simulation game to study how well decision makers understand two fundamental aspects of complexity in cybersecurity: potential delays in building capabilities, and uncertainties in predicting cyber-incidents. Analyzing 1,479 simulation runs, we compared the performances of a group of experienced professionals to an inexperienced control group. Experienced subjects did not understand the mechanisms of delays any better than inexperienced subjects. Both groups also exhibited similar errors when dealing with the uncertainty of cyber-incidents. Our findings highlight the importance of training for decision-makers, and lay the groundwork for future research in uncovering mental biases about the complexities of cybersecurity.

show abstract

“…The key assumption is that behavior is driven by a rational decision process based on costs and benefits of the act to the focal actor. Other studies used protection motivation theory (PMT) and reactance theory (RT) as determinants to users' compliance with organizational information security policies (ISP) (e.g., [12], [18], [19]). PMT departure point assumes individual's desire to protect oneself and the organization, while RT assumes that users are likely to comply with security policies they perceive as justifiable (e.g., [16], [24]).…”

Section: Introductionmentioning

confidence: 99%

How Espoused Culture Influences Misuse Intention: A Micro-Institutional Theory Perspective

Hovav¹

2017

Proceedings of the 50th Hawaii International Conference on System Sciences (2017)

View full text Add to dashboard Cite

show abstract

An Enhanced Fear Appeal Rhetorical Framework: Leveraging Threats to the Human Asset Through Sanctioning Rhetoric

Cited by 333 publications

References 89 publications

Intervention Effect Rates as a Path to Research Relevance: Information Systems Security Example

Intervention Effect Rates as a Path to Research Relevance: Information Systems Security Example

Decision Making and Biases in Cybersecurity Capability Development: Evidence from a Simulation Game Experiment

How Espoused Culture Influences Misuse Intention: A Micro-Institutional Theory Perspective

Contact Info

Product

Resources

About