Social control through deterrence on the compliance with information security policy

Choi, Myeonggil; Song, Jeongseok

doi:10.1007/s00500-018-3354-z

Cited by 12 publications

(5 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“… Policy compliance (Choi & Song, 2018;Connolly et al, 2017;Kim & Han, 2019;Siponen et al, 2007;Yazdanmehr & Wang, 2016).…”

Section: About the Authorsunclassified

“…The Actor #4 People are selfinterested beings n/a n/a #5 People learn via specific or general deterrence 16 articles (Burns et al, 2017;Choi & Song, 2018;D'Arcy & Devaraj, 2012;D'Arcy & Herath, 2011;Higgins et al, 2005;Merhi & Ahluwalia, 2019;Moody et al, 2018;Park et al, 2019;Skinner & Fream, 1997;Stoycheff et al, 2019;Straub, 1990;Ugrin & Pearson, 2013;Wolfe et al, 2008;Xue et al, 2011).…”

Section: About the Authorsmentioning

confidence: 99%

See 1 more Smart Citation

Common Misunderstandings of Deterrence Theory in Information Systems Research and Future Research Directions

2022

View full text Add to dashboard Cite

In the 1980s, information systems (IS) borrowed deterrence theory (DT) from the field of criminology to explain information security behaviors (or intention). Today, DT is among the most commonly used theories in IS security research. Our review of IS research applying DT highlights that many fundamental assumptions of DT are unrecognized and therefore unexamined. This may have resulted in misunderstandings and conceptual confusions regarding some of the basic concepts of DT. For example, some IS studies confuse general deterrence with specific deterrence or do not recognize the difference between the two. Moreover, these fundamental assumptions, when directly examined, may provide important information about the applicability of DT in certain IS security contexts. This research commentary aims to identify and discuss some of the fundamental assumptions of DT and their implications for IS research. By examining these assumptions, IS researchers can study the previously unexplored aspects of DT in different IS contexts. Further, by recognizing these assumptions, IS scholars can revise them and build new variants of DT to better account for specific characteristics of IS behaviors and contexts.

show abstract

“… Policy compliance (Choi & Song, 2018;Connolly et al, 2017;Kim & Han, 2019;Siponen et al, 2007;Yazdanmehr & Wang, 2016).…”

Section: About the Authorsunclassified

Section: About the Authorsmentioning

confidence: 99%

Common Misunderstandings of Deterrence Theory in Information Systems Research and Future Research Directions

2022

View full text Add to dashboard Cite

show abstract

“…Second, and as presented in Figure 1, the decision to comply with ISP is shaped through the employee's evaluation of the costs and benefits of both compliance and non-compliance. The costs and benefits can be perceived as either personal and ethics-driven [5], [26], social and norm-driven [25], technical and designdriven [29], or related to organizational factors [30]. In addition, the evaluation regards both the significance and the probability of the costs and benefits in each case [9], [31], [32], [33], [34].…”

Section: Isp-compliancementioning

confidence: 99%

“…Normative social influence drives the user towards particular security behaviors by leveraging norm-centric social compliance or ethic-centric self-maintenance mechanisms [41], [42], [43]. Normative social influence is rooted in the user's inherent psychological needs, such as the need for attachment to peers [30] and self-approval [44]. Our review of the literature shows that this social influence can be of two kinds: influence on a user's personally accepted and internalized norms [5] and influence on a user's personally respected but not necessarily internalized norms [25].…”

Section: Normative Social Influencementioning

confidence: 99%

Employees' Compliance with ISP: A Socio-Technical Conceptual Model

Falahati¹,

Lapointe²,

Beaudry³

2022

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Employees' compliance with Information Systems Security Policies (ISP) is critical for protecting organizational data. Both the technical side and the social aspects of IT-use were shown to have significant influence on ISP-compliance. However, they have been mostly studied in isolation, despite the literature's emphasis on the socio-technical nature of security. Also, while the technical side has been extensively explored, there is a scarcity of research on the social mechanisms that underlie ISP-compliance. Here, we aim at bridging the gap between the technical and social sides of compliance. We also build upon Social Impact Theory to provide a more nuanced understanding of the social influence on ISP-compliance. We suggest that transparency of use is associated with the three pivotal elements of social influence, namely, perceived strength, immediacy, and number of influencing sources, which trigger normative and informational forces towards compliance. The influence of organizational ISP-compliance culture is also discussed.

show abstract

“…[45] Sanctions [59], [74], [63], [82] Certainty of Detection [57], [56] Shame [63] Protection Motivation Theory…”

Section: Appendixmentioning

confidence: 99%

Exploring the Influence of Direct and Indirect Factors on Information Security Policy Compliance: A Systematic Literature Review

Alassaf

Alkhalifah²

2021

IEEE Access

View full text Add to dashboard Cite

Information systems security is considered one of the key issues concerning organizations' management. Despite the massive investment that organizations make to safeguard their systems, there are still many internal security breaches. The increase in insider threats to information systems can be related to the employees' compliance toward information security policy. Several review papers were conducted to explore information security policy compliance behavior research. However, the literature lacks insight into the positive and negative (direct or indirect) influence of human and organizational theories and their factors influencing information security policy compliance behavior. Therefore, this paper provides a systematic literature review synthesizing the psychological theories, organizational theories, and other internal and external factors on information security policy compliance researches. The results analysis of 87 studies showed that the general deterrence theory, theory of planned behavior, and protection motivation theory are the most frequently used. The influencing factors of theories are mostly similar in the results. Furthermore, information security education, training and awareness, trust, and leadership, among many other internal and external factors, are highly used. This study is one of the first researches that explores the relationship types among the influencing factors; emphasizing the direct and indirect effect, and information security policy compliance behavior. This paper also identifies some gaps in information security policy compliance behavior research and proposes future works. In addition, it provides a theoretical contribution and practical insight in the context of information security policy compliance.

show abstract

Social control through deterrence on the compliance with information security policy

Cited by 12 publications

References 48 publications

Common Misunderstandings of Deterrence Theory in Information Systems Research and Future Research Directions

Common Misunderstandings of Deterrence Theory in Information Systems Research and Future Research Directions

Employees' Compliance with ISP: A Socio-Technical Conceptual Model

Exploring the Influence of Direct and Indirect Factors on Information Security Policy Compliance: A Systematic Literature Review

Contact Info

Product

Resources

About