Impact of perceived technical protection on security behaviors

Abstract

PurposeThe purpose of this paper based on compensation theory, is to incorporate perceived technical security protection into the theory of planned behavior and examined factors affecting end‐user security behaviors, specifically, compliance with security policies.Design/methodology/approachAn online survey is conducted to validate the proposed research model. The survey is sent out to an industrial panel. A total of 176 usable responses are received and used in the data analysis.FindingsThe results show that both perceived behavioral control (PBC) and attitude have significant impact on intention to comply with security policy. Perceived technical protection affects behavioral intentions both indirectly, through PBC, and directly. The negative direct effect (i.e. perceived high technical protection leads to low intention to comply with security policy) suggests possible risk compensation effects in the information security context.Practical implicationsThis result should be of interest to practitioners. In practice (e.g. during security training), the power and capability of technical protection mechanisms should not be exaggerated. Instead, its limitations and drawbacks should be emphasized, so that end‐users will adopt more cautious security practices and adhere to the requirements of the organization's security policies.Originality/valueThis paper embeds risk compensation theory within the security policy compliance context and offers a useful starting point for further empirical examination of this theory in information security context.

Evolvement of Information Security Research on Employees' Behavior: A Systematic Review and Future Direction

“…The top three theories were the DT, theory of reasoned action/planned behavior (TRA), and protection motivation theory (PMT). As shown in Table 3, 12 studies relied on the DT [3, 12, 19, 26-28, 55, 62, 63, 66, 69, 70], whereas the TRA was used in seven studies [5,10,11,22,23,61,67] and PMT in five studies [9,20,21,24,74]. Both the rational choice theory (RCT) and social cognitive theory (SCT) have been adopted in three studies.…”

“…It was not until 2006 when the TRA was introduced in IS research [22], which resulted in its use in six papers [5,10,11,23,61,67]. The first empirical study based on the PMT was published in 2008 [24], and this theory was cited in five papers [9,20,21,24,74].…”

“…Therefore, many organizations make great investment in implementing IS policies to ensure employees to behave in a manner in line with the security demand [7,8]. Consequently, research on employee compliance with IS policies has received a lot of attention from both academia and practitioners [2,9,10]. In such studies, employees' security related behaviors, e.g., compliance with IS policies, have significant ethical implications and are usually influenced by ethics as practiced in working environment [1,11,12].…”

The Role of Social Status and Controllability on Employee Intent to Follow Organizational Information Security Requirements

“…However, employees still routinely fail to comply with those policies, either deliberately or unknowingly [9]. Considering that security researchers and organizational surveys generally consider insiderrelated security threats from well-meaning (nonmalicious) employees as one of the most likely sources of security breaches and which can cause more damage than external attacks [2,[10][11][12], it is important to understand why employees may intend or not intend to comply with the organization's ISP.…”

Assessing the effectiveness of layered security for protecting the aviation system against adaptive adversaries

“…Examples also exist in computer security such asZhang et al (2009) andParsons et al (2010).4 Note that breaking out these effects separately is done for ease of understanding, not to either promote or demote these particular effects of security. Indeed, shaping attacker behavior is one of the key routes through which security measures produce beneficial outcomes.…”