Motivation and opportunity based model to reduce information security insider threats in organisations

Abstract

Rossouw (2018) Motivation and opportunity based model to reduce information security insider threats in organisations. A note on versions:The version presented here may differ from the published version or, version of record, if you wish to cite this item you are advised to consult the publisher's version. Please see the 'permanent WRAP URL' above for details on accessing the published version and note that access may require a subscription.For more information, please contact the WRAP Team at: wrap@warwick.ac.uk Motivation and opportunity based model to reduce information security insider threats in organisationsAbstract Information technology has brought many advantages for organisations, but information security is still a major concern in this domain. Users, whether intentionally or through negligence, are a great potential of risk to information assets. The lack of awareness, ignorance, negligence, resistance, disobedience, apathy and mischievous are root of information security incidents in organisations. As such, insider threats have attracted a number of experts' attention in this domain. Two particularly important considerations when exploring insider threats are motivation and opportunity. The most significant aspect of this research is derived from two fundamental theories -Social Bond Theory (SBT), used to motivate misbehaviour avoidance, and Situational Crime Prevention Theory (SCPT), to reduce the opportunities for misbehaviour. The results of data analysis show that situational prevention factors such as increasing the effort and risk, reducing the rewards and removing excuses can have a significant effect on negative attitudes towards misbehaviour, though reducing provocations does not have any effect on attitudes. Further, social bond factors such as commitment to organisational policies and procedures, involvement in information security activities and personal norms have significant effects on negative attitude towards misbehaviour. However, the attachment does not have any significant effect on employees' attitude in order to avoid misbehaviour. The findings also show that negative attitudes towards misbehaviour influence employees' intention positively, and in turn intention to avoid misbehaviour reduces insider threat behaviour. The outputs of this study shed some light on factors to reduce misbehaviour in the domain of information security for academics and practitioners.

Contemplating social engineering studies and attack scenarios: A review study

“…Theory of planned behavior The theory says that the attitude toward the behavior and subjective norms form an individual's behavioral intentions and actions 3,30,31 Neutralization theory Neutralization theory is a psychological method for people to turn off "inner resistance" when they perform or are about to perform something that they perceive as ethically wrong 3 Learning theory Learning theory explains how information is understood, treated, and retained by participants during the learning process 3 Protection motivation theory The protection motivation theory argues that people guard themselves based on four factors: (a) the perceived severity of an event and the occurrence; (b) vulnerability of the person; (c) the person's ability for the preventive behavior; and (d) believe in his ability to protect 3,30 General deterence theory General Deterrence is a plan designed to deter an opponent from taking actions which are not yet initiated or in another case to prevent people from performing actions that opponent wants them to do 30 Social learning theory Social Learning Theory asserts that people acquire knowledge from one another, via perception, memory, and modeling 30 Social bonding theory Social bond theory is used to explain social issues. Factors of social bonding comprise an attachment to families, devotion to social norms and institutions, engagement in activities, and the faith that these things are essential [30][31][32] General strains theory Innovation happens when community stresses culturally acceptable goals but at the same time provides insufficient opportunity to accomplish these goals with the legal institutionalized means. People finding themselves in financial strain may find a solution of crime in order to achieve goals 30 Organizational injustice If the leaders of the institution are authoritarian, their effort to solve the problems may be ineffective due to many reasons and may increase organizational stress and efficiency of the employees.…”

The influence of organizational injustice in the motivation for the practice of cybercrimes

“…Neste grupo, é possível citar vandalismo virtual, disseminação de vírus ou softwares maliciosos, ataques de negação de serviço, falsificação de endereços na Internet e envio de spam ou mensagens eletrônicas indesejadas (Burden & Palmer, 2003). Os meios utilizados para o crime, os danos provocados, a natureza das ações e suas motivações são fatores adicionais para classificação do crime cibernético (Safa, Maple, Watson & Von Solms, 2018).…”

“…Roratto e Dias (2014) definem vulnerabilidade como uma fraqueza dos sistemas de informação e do ambiente no qual estes estão inseridos, e esta fraqueza pode se tornar um risco de segurança. Neste sentido, a falta de consciência sobre ameaças eminentes denota um comportamento desalinhado com preceitos da segurança cibernética (Safa, Maple, Watson & Von Solms, 2018). A gestão da segurança cibernética, portanto, deve focar neste comportamento, considerando causas e consequências, pois o sucesso ou insucesso da organização depende daquilo que seus membros fazem ou deixam de fazer.…”

“…Os insiders têm vantagens que vão além da capacidade de acesso à infraestrutura de TI. Eles estão cientes sobre as vulnerabilidades e as informações sensíveis: quais são, onde estão, quanto valem, como e quando acessá-las (Safa, Maple, Watson & Von Solms, 2018). Possuem tempo para atingir seus objetivos; e, não raro, conseguem ocultar rastros.…”

“…O insider é alguém que recebeu privilégios que autorizam o acesso e a utilização de sistemas ou instalações na respectiva organização, e que pode ser qualquer pessoa com privilégios e conhecimento sobre os sistemas de informação (Safa, Maple, Watson & Von Solms, 2018). É possível encontrar estudos sobre o comportamento do insider antes e durante a perpetração de um crime cibernético.…”