Organizational Governance, Social Bonds and Information Security Policy Compliance: A Perspective towards Oil and Gas Employees

Abstract

Information security attacks on oil and gas (O&G) organizations have increased since the last decade. From 2015 to 2019, almost 70 percent of O&G organizations faced at least one significant security breach worldwide. Research has shown that 43 percent of security attacks on O&G organizations occur due to the non-compliant behavior of O&G employees towards information security policy. The existing literature provides multiple solutions for technical security controls of O&G organizations. However, there are very few studies available that address behavioral security controls, specifically for O&G organizations of developing countries. The purpose of this study is to provide a comprehensive framework for information security policy compliance (ISPC) for the O&G sector. A mixed-method approach is used to develop the research framework. Semi-structured interviews from O&G specialists refined the developed framework. Based on qualitative study a survey questionnaire was developed. To evaluate the research framework, structural equation modeling was applied to a sample of 254 managers/executives from 150 Malaysian O&G organizations. The obtained test results confirmed the proposed research model, according to which good social bonding among employees plays a critical role in improving ISPC. However, there was less support for the notion that all organizational governance factors significantly improve the social bonding of Malaysian O&G organizations employees. This paper contributes to the current information system (IS) literature by exploring the interrelationships among organizational governance, social bonding, and information security policy compliance (ISPC) in Malaysian O&G organizations.

The Nexus between Proactive Eco-Innovation and Firm Financial Performance: A Circular Economy Perspective

“…Process eco-innovation demonstrated that a cleaner production process can be incorporated into the industrial manufacturing process without negotiating sustainability, societal development, and most importantly the circular economy [39][40][41][42]. Cleaner production is an approach that accumulates various production factors such as shortening the greenhouse emission force, water concentration, waste concentration, energy application, and reprocessing or recycling the materials [38][39][40][41]43].…”

Information Security Behavior and Information Security Policy Compliance: A Systematic Literature Review for Identifying the Transformation Process from Noncompliance to Compliance

“…The study results proved that social factors (i.e., rules-oriented ethical climate and susceptibility) could weaken the effect of the command and control and self-regulatory approaches of ISPC on an individual and organizational level. An empirical study [3] examined organizational governance and social bond factors' effects on ISPC. The study results proved that an organization with good organizational governance could enhance social bonding among employees, improving the ISPC in the organizational context.…”

“…Research shows that about 70% of incidents happened due to human negligence (intentional or unintentional). A study on security professionals' behavior concluded that 43% of data breaches are due to employees' behavior [3,4]. In 2014 IBM cybersecurity intelligence index reported almost 95% of information security incidents to involve employee negligence [5].…”

“…More specifically, researchers try to determine what motivates employees to comply and to violate the ISP. Many researchers, for instance, [3,[15][16][17], focused on behaviors related to compliance with ISP. In contrast, many studies such as [13,[18][19][20] explored violation behaviors.…”

Learning Representations of Network Traffic Using Deep Neural Networks for Network Anomaly Detection: A Perspective towards Oil and Gas IT Infrastructures

“…Furthermore, O&G organizations have geographically disparate sites, which needs secure communication to enable efficiency and effectiveness in decision making and production processes. Although the O&G industry is rapidly moving towards digitization and automation, the management and governance infrastructure of the O&G industry are still prone to many risks, including internal [3,4] , external, physical, reputational, and cybersecurity risks. A small disruption in IT and operation technology (OT) can cause very large financial and reputational losses to O&G organizations [5].…”