ICIS Proceedings Template029e2c6.netsolhost.com/.../2014/IIVC_2014_submission_7.docx · Web viewPrevious literature on behavioral reasoning dealing with information security behavior

An Analysis of the Combined Influences of Neutralization and Planned Behavior

on Desirable Information Security Behavior

Stefan BauerVienna University of Economics and Business

[email protected]

Edward W. N. BernroiderVienna University of Economics and Business

[email protected]

AbstractThe aim of this paper is to develop a better understanding of the importance of neutralization methods in the context of desirable information security behavior of employees. Past behavioral intention theories, such as the theory of planned behavior, have not sufficiently accounted for neutralization by which employees may temporarily neutralize certain values when determining the formation of an intention and consequently behavior. We provide a new integrated view on security behavior by combining the theory of planned behavior and neutralization theory in one study. Based on the analysis of 220 data sets acquired by an online survey, our results support the hypotheses gained from both theories. In particular, neutralization techniques are used by employees to justify undesired security behaviors. In relative terms, neutralization seems to be at least equally important as the predictors of the theory of planned behavior when considering effect sizes. Our main contribution is to provide evidence for the important role of six considered neutralization techniques, which implicates to proactively utilize these in the development of effective information security awareness programs.

Information Institute Conferences, Las Vegas, NV, May 21-23, 2014 1

Bauer; Bernroider

IntroductionThe provision of information security is nowadays a very important topic for most enterprise across all industries. Several reports of industries show that information security incidents are threatening organizations’ business, especially organizations which highly rely on information processing and data assets (Goldstein et al. 2011). Information security practices should ensure availability, confidentiality and integrity of data and data assets of an organization (Hu et al. 2012). Previous research stated that not only technological measures alone can protect organizations information system, but rather employees have to act in a desirable way to ensure the goals of information security (Willison et al. 2013).

Employees' behavior regarding information systems and technology is an important topic for organizations' information security management. Employees act not always desirably regarding information technology or information systems (Warkentin et al. 2009). Several scholars have established classifications of employee security behavior (Guo 2013; Padayachee 2012; Stanton et al. 2005). In our research context, we differentiate between desirable and undesirable employee behavior. Desirable employee behavior is normally made explicit in information security policies of an organization prescribing rules, for example about handling e-mails, passwords or data in a way, which ensures security in an organization.

Desirable employee behavior can be defined as a set of behaviors, where an employee acts compliant with information security policies and work instructions. Furthermore, it is desirable that employees take precautions, actively protect their information systems and technology (Bauer et al. 2013a; Bauer et al. 2013b). Employees’ undesirable behavior regarding information security could have unpredictable consequences, because a violation of the security policy could open a loophole for an internal malicious coworker or external perpetrator (Willison et al. 2013). Further, the aggregation of small violations could have a huge impact on the organizations’ security, especially if the data and their assets are critical resources for the organization.

Employees' violations of the information security policy have different specific reasons. We assume that neutralization techniques such as the denial of responsibilities provide acceptable justifications for employees to act in a deviant way (Lim 2002). Employees may apologize their undesirable behavior through a range of different neutralization techniques (Barlow et al. 2013; Siponen et al. 2010). In general, we can differ between malicious behavior and non-malicious behavior. Malicious employee behavior is defined as security damaging behavior, where the employee’s intention is to harm the organization for his own benefit (Guo 2013). The underlying research focuses on non-malicious behavior. We assume that employees use neutralization techniques to excuse their deviant behavior concerning information security without the actual intention to harm the organization.

The main contribution of the underlying research is to analyze the influence of different neutralization techniques in the context of the theory of planned behavior in one research model. To our knowledge until now, the theory of planned behavior was not analyzed in connection with the neutralization theory in the information systems (IS) context. Based on previous studies we assume that neutralization together with the well-established predictors of the theory of planned behavior, namely subjective norm, attitude and perceived behavioral control, influence the individual's desirable information security behavior or at least the individual's intention to behave accordingly.

2 Editors: Gurpreet Dhillon and Spyridon Samonas

An Analysis of the Combined Influences of Neutralization and Planned Behavior on Desirable Information Security Behavior

The outcome of the study provides important insights for researchers as well as for practitioners. Organizations' chief information security officers need to design and implement information security awareness programs to make the employees aware of potential threats (Bauer et al. 2013b). The findings of our research confirm that common self-centered beliefs from neutralization theory should corroborate the traditional belief-systems in behavioral reasoning analysis. Some neutralization techniques may even be more important than general attitudes towards the security behavior in question and subjective norms.

The remainder of the paper has been divided into the following sections. Next, we introduce the theoretical backgrounds of the theory of planned behavior (TPB) and neutralization theory in the context of this study. This is followed by a presentation of the research model, hypotheses and variables. The next section describes methodological issues of the research. Finally, we discuss the preliminary results of the quantitative study before concluding the paper.

Theoretical Background Previous literature on behavioral reasoning dealing with information security behavior of employees applied several theories ranging from, e.g., deterrence theory (Gibbs 1968), protection motivation theory (Rogers 1975), or theory of reasoned action (Ajzen et al. 1980) to its extension the theory of planned behavior (Ajzen 1991). A number of authors have suggested that future research in behavioral information security research has to identify and combine more innovative concepts to explore information security behavior (Warkentin et al. 2012). For that matter, we chose to explore a range of neutralization techniques in conjunction with the theory of planned behavior (TPB) as potential predictors of employees' security behavior. Neutralization theory is a sociological theory explaining anomalous individual behavior and the link with TPB was perceived as gap in current literature in the field of information security management.

Previous work on the Theory of Planned Behavior and Security Behavior in IS

The theory of planned behavior (Ajzen 1991) is a popular theory from psychology stating that attitude toward behavior, subjective norms, and perceived behavioral control, together predict a person's deliberate behavior intentions and behavior. It was often used to research safety behavior like driving speed, health behavior or condom use. In general, the TPB measures the relation between human thought and human action (Sommestad et al. 2013). Previous research has often used parts of the theory of planned behavior, but as a recent review of the latest academic literature showed, only a limited number of the TPB constructs were analyzed (Sommestad et al. 2013). The authors of this recently published meta-study suggested to more comprehensively test the TPB in information security contexts. Following this suggestion, we incorporated the TPB to analyze the intention for a desirable information security behavior and actual information security behavior. In what follows, we shortly introduce the research constructs of the original TPB (Ajzen 1991) and shortly link into the context of information security.According to the TPB, the attitude of a person toward the behavior in question plays an important role for explaining behavior. Previous research confirmed attitude as a valid predictor of the intention for information security compliance of employees (Bulgurcu et al. 2010). Social norms reflect how other employees care about the behavior in question. The violation of information security work instructions and policies is normally not a criminal activity, but rather a violation of social norms of the organization. Previous research highlights the importance of social norms in information security behavior research and connects social norms with the organization's security culture (Albrechtsen 2007; Cox 2012). In the TPB, social norms are represented by the concept of subjective norm, which


Bauer; Bernroider

describes the level of pressure that a person perceives imposed by significant peers to perform or not to perform a behavior. Finally, perceived behavioral control refers to a person's perception of the ability to perform a given behavior. This factor is held to exert both direct and interactive effects on behavior. These TPB predictors lead to behavioral intentions and consequently deliberate behavior. There is a substantial amount of research that has confirmed the relationship of the intention for information security behavior and actual security behavior (Cox 2012; Sommestad et al. 2013).

Previous work on Neutralization Theory in IS

The principles of neutralization theory (Sykes et al. 1957) have previously been used to explain deviant behavior like drug use, theft, or deviant consumer behavior (Maruna et al. 2004). Neutralization theory is based on the idea that individuals apologize their undesirable behavior by so-called neutralization techniques (Lim 2002). In general, social behavior is internalized and learned in the process of social interaction (Sykes et al. 1957). Scientific information security behavior literature has investigated neutralization theory in connection with deterrence theory (Barlow et al. 2013; Siponen et al. 2010). However, prior research has largely neglected the relative influences of each of three generally accepted TPB predictors in comparison with different neutralization techniques for information security behavior.

Constructs of Neutralization Theory

Neutralization theory describes several neutralization techniques (Sykes et al. 1957), which were later extend by IS related studies (Barlow et al. 2013; Siponen et al. 2010). While one IS study used the three constructs "denial of injury", "metaphor of the ledger" and "defense of necessity" as neutralization constructs (Barlow et al. 2013), another study used six constructs (Siponen et al. 2010). In general, findings confirmed that these neutralization techniques influence security behavior of employees and in particular seem to be more effective than sanctions. One study proposed that focusing communication and training on neutralization techniques is just as effective as focusing on deterrent sanctions (Barlow et al. 2013). A more extensive taxonomy uses six types of neutralization techniques, which we have also considered in our research (Siponen et al. 2010):

Denial of Responsibility: The employee sometimes negate his responsibility for certain actions. Additionally, he considers himself to be powerless regarding the control of these types of incidents (Siponen et al. 2010; Sykes et al. 1957).

Denial of Injury: The employee is totally convinced that his or her non-malicious actions violating the information security do not have a substantial negative impact. In other words, the person tries to excuse behavior by emphasizing the minimal potential damage (Barlow et al. 2013; Siponen et al. 2010; Sykes et al. 1957).

Defense of Necessity: In this strategy, the employee thinks that she has no other acceptable choice to act. In this particular case, the employee sees herself to be forced to break the security rules for example in order to meet important deadlines (Barlow et al. 2013; Siponen et al. 2010).

Condemnation of the Condemners: The employees do not regard the rules as just and fair and consider those who condemn as doing so out of spite. Thus, the lack of recognition can induce the fraudulent behavior (Siponen et al. 2010; Sykes et al. 1957).

Appeal to Higher Loyalties: Sometimes employees excuse their violation of security rules by justifying for the greater good. A common reason is that they consider the rules being too restrictive (Siponen et al. 2010; Sykes et al. 1957).

The Metaphor of the Ledger: Employees tend to rather emphasize other high-quality work and perhaps neglect the gravity of committed mistakes related to information security (Barlow et al. 2013; Siponen et al. 2010; Sykes et al. 1957).



Research Model and OperationalizationResearch Model and Hypotheses

Figure 1 shows the research model, which is based on the theory of planned behavior and neutralization theory. The effects of attitude, subjective norm and perceived behavioral control on the intention for a desirable information security behavior are widely accepted, but the whole model of the TBP needs more validation for the information security context (Sommestad et al. 2013). In principle, however we can assume that attitude, subjective norm and perceived behavioral control will have an influence on intention for a desirable security behavior (H1, H2, H3). Further, we also seek to confirm the direct link between perceived behavioral control and actual security behavior (H4). So far hardly any attention was paid to neutralization in the context of TPB. The effects of neutralization on intention for security violations has been considered (Barlow et al. 2013; Siponen et al. 2010). We approach security behavior differently and concentrate on the anticipated negative effect of neutralization on the intention for a desirable security behavior (H5). Moreover, the underlying study assumes that the intention of a desirable security behavior influences actual security behavior (H6). Consequently, we assume the following:Hypotheses 1 (H1): Attitude has a positive effect on the intention for a desirable information security behavior.Hypotheses 2 (H2): Subjective norm has a positive effect on intention for a desirable information security behavior.Hypotheses 3 (H3): Perceived Behavioral Control has a positive effect on intention for a desirable information security behavior.Hypotheses 4 (H4): Perceived Behavioral Control has a positive effect on actual information security behavior.Hypotheses 5 (H5): Neutralization has a negative effect on intention for a desirable information security behavior.Hypotheses 6 (H6): Intention for a desirable information security behavior has a positive effect on actual information security behavior.

Variable Selection and Measurement

We have summarized how we conceptualized the various variables in Table A2 (Appendix). For each construct, the table offers an overall description and cites supporting literature. Table A1 (Appendix) lists the measurement items of these respective variables. Each of the three exogenous TPB constructs and six exogenous neutralizations were designed as reflective constructs, where the direction of causality runs from the items to the construct. In addition, the two endogenous (dependent) constructs were defined as reflective construct. The higher-order component is overall neutralization, which is too complex to measure as single dimension. We therefore represented neutralization by the six underlying techniques described in the previous section, which we considered together as a reflective-formative hierarchical component model. According to recommendations (Hair et al. 2013), the number of indicators in Table A1 is similar across these lower level components.

Research Methodology Research Approach

The research process is illustrated in Figure 1. Firstly, a comprehensive literature review was conducted (Webster et al. 2002). The research team consulted the academic databases


Bauer; Bernroider

‘Thomson Reuters Web of Knowledge’, ‘Scopus’, ‘Google scholar’, ‘ProQuest ABI/INFORM Global’ through combinations of the keywords "neutralization", "information security" and "security behavior". Based on the findings, we developed the research model and hypotheses. In the next step, we designed and implemented the survey for data collection before analyzing the data.

Figure 1. Main Stages of Research Approach

Data Collection

The data collection method used in this particular study was an online survey, which was conducted in December 2013 and targeted all enrolled students of WU Vienna with work experience. Survey participation was voluntary and no incentives were provided. After sending one invitation email to all registered students, 512 responses were registered within a week after which we closed the survey.Concerning the structure of the online survey, there was a filter after the demographics section, which asked the respondents if they had acquired work experience from a company having an information security policy. 220 respondents approved this question and confirmed that they have at least little knowledge about such a policy. Only these 220 members of the actual working population were included in the data analysis to ensure a degree of external validity of the results

Statistical Methods

We chose partial least squares structural equation modeling (PLS-SEM) approach for the data analysis. The advantage of this approach lies in the fact that with SEM the measurement and the structural model can be analyzed at once (Park et al. 2007; Su et al. 2010). Furthermore, the decision for SEM, based on the underlying approach of PLS, is due to our research aims, which is to explain the variance of the endogenous construct 'intention for desirable information security behavior' (Chin 1998). Furthermore, PLS has fewer stringent requirements regarding distribution properties (Wold 1982). The software package SmartPLS was used to analyze the data (Ringle et al. 2005). Our research model was developed as a reflective measurement model. The bootstrap re-sampling procedure was used to test the significance of all model paths (Gefen et al. 2000).

Data AnalysisSample Descriptives

Table 1 shows the demographic characteristics of our acquired sample. Our respondents all have the general qualification for university entrance, but not completed their degrees. The majority of respondents are between 21 and 30 years old and have between 1 and 10 years



of work experience. On average respondents work 6.3 hours per day with a computer and work in 17 different industries.

Table 1. Demographic Characteristics of Respondents

Demographic Characteristic N Percentage

GenderFemale 101 45.9%

Male 119 54.1%

Age (years)

< 20 32 14.6%

21-25 107 48.6%

26-30 42 36.8%

> 30 39 17.7%

Work experience (years)

< 1 15 6.8%

1-3 104 47.3%

4-10 71 32.3%

11+ 30 13.6%

Measurement Model Validation

We tested the measurement model with the goodness-of-fit criteria in Table 2 following current recommendations (Hair et al. 2013; Hair et al. 2011; Sarstedt et al. 2011). First, we considered internal consistency reliability by assessing Cronbach's α and composite reliability, which considers the different outer loadings of the indicator variables. All respective values are above 0.70, which is considered to be acceptable. In terms of convergent validity, the AVE criteria are also all above the recommended threshold (0.5), which indicates that, on average, the construct explains more than half of the variance of its indicators. For assessing discriminant validity, we controlled the cross loadings of the items (Hair et al. 2011), which were also acceptable.

Table 2. Constructs and Measurement Model Validity


Bauer; Bernroider

Latent Variable

Indicators

Loadings

Cronbach's α

Composite Reliability

AVE

Attitude toward Information Security Behavior

ATT1 0.84

0.92 0.94 0.80ATT2 0.90

ATT3 0.94ATT4 0.90

Subjective norm toward Information Security

SN1 0.720.70 0.83 0.62SN2 0.85

SN3 0.79Perceived Behavioral Control

PBC1 0.880.72 0.88 0.78PBC2 0.89

Intention for desirable security behavior

DSB1 0.790.75 0.85 0.66DSB2 0.82

DSB3 0.83Actual desirable security behavior

ASB1 0.930.86 0.93 0.88ASB2

0.94

Denial of responsibility

DOR1 0.85

0.85 0.91 0.77DOR2 0.90DOR3 0.88

Condemnation of the condemners

CC1 0.860.88 0.93 0.81CC2 0.92

CC3 0.92Appeal to higher loyalties

AHL1 0.960.92 0.96 0.92AHL2 0.96

Denial of injury

DJ1 0.940.87 0.94 0.88

DJ2 0.94

Defense of necessity

DN1 0.920.81 0.91 0.84

DN2 0.91

Metaphor of the ledger

ML1 0.970.93 0.97 0.94

ML2 0.97

Evaluation of the Structural Model

The most commonly used measure to evaluate the structural model is R², which is a measure of the models predictive accuracy and represents the amount of variance in the



endogenous constructs explained by all of the exogenous constructs linked to it. R² of "the intention for a desirable security behavior" is 0.44 and for "actual security behavior" it is 0.30, which are relatively high compared to previous studies of similar constructs (Sommestad et al. 2013) and can be seen described as moderate according to general recommendation in scholarly research (Hair et al. 2013).

Table 3: Verdict on Structural Relationships of the Research Model

HypothesesPath coefficient

T-values f² f² Effect

(H1): Attitude has a positive effect on intention for a desirable information security behavior. 0.27*** 5.71 0.10 Weak

(H2): Subjective norm has a positive effect on intention for a desirable information security behavior.

0.17*** 3.81 0.04 Weak

(H3): Perceived Behavioral Control has a positive effect on intention for a desirable information security behavior.

0.35*** 9.70 0.19 Moderate

(H4): Perceived Behavioral Control has a positive effect on actual information security behavior. 0.14*** 2.67 0.02 Weak

(H5): Neutralization has a negative effect on intention for a desirable information security behavior.

-0.19*** 5.29 0.18 Moderate

(H6): Intention for a desirable information security behavior has a positive effect on actual information security behavior.

0.47*** 11.17 0.23 Moderate

*p<0.10, **p<0.05, ***p<0.01

The purpose of the structural equation model was to test the direct effects of the potential latent predictors identified from the TPB and the Neutralization theory as captured by our 6 research hypotheses. We used the results from bootstrapping with 5000 subsamples as a non-parametric re-sampling procedure to calculate t-statistics (Chin 1998). The path coefficients show weak and moderate relationship of the research constructs. Table 3 illustrates the hypotheses, all path coefficients of the research model, significance levels, and effect sizes. The effect size f2 of a latent factor results from analyzing the decrease in R2 when excluding one independent latent factor (Cohen 1988). It was suggested that f2 values of .02, .15, and .35 mean small, medium, and large effects, respectively. The results indicate that neutralization and perceived behavioral control have the greatest influence on the intention of a desirable information security behavior. As anticipated, the intention for a desirable security behavior predicts actual behavior. The other relationships show weak effects.


Bauer; Bernroider

Figure 2. Research Model and Results

Discussion and Conclusions The main contribution of this paper is to explicate neutralization techniques in conjunction with the theory of planned behavior in the context of desirable employee information security behavior. The findings confirm that individual neutralizations have a negative effect on security behavior and together with the classical indicators of the TPB significantly explain the intention to comply with information security rules, policies and working procedures and in turn actual compliance. Prior research, to our knowledge, has not yet provided the same analysis. The results advance our understanding about the social construction of reality of employees in terms of six defense mechanisms through which employees may rationalize their deviant behavior. We also call for more research on similar offender’s perspectives. Next, we will discuss these findings and implications in relation to the underlying theories (TPB, Neutralization) in more detail.



Our research confirms the classical beliefs-intention-behavior link as suggested by the TPB in the application context of this study. More specifically, attitudes towards desirable security behavior, subjective norms and perceived behavioral control are valid predictors of the individual's intention to act accordingly (H1-3). In addition, the direct link between perceived behavioral control was also validated although only marginally (H4) as well as the obvious strong association between behavioral intention and actual behavior (H6). The latter relationship was already known to hold in general and also in the context of security behavior (Cox 2012; Sommestad et al. 2013).

In terms of Neutralization theory, we can also confirm the general importance of the investigated neutralization techniques, which taken together negatively impact the intention of employees to behave desirably (H5). The effect sizes show that neutralization has a roughly similar effect than the most important predictor of the TPB, which is perceived behavioral control. Theoretically, this finding adds to our understanding of how to predict desirable security behavior in extension to the TPB or deterrence theory (Barlow et al. 2013; Siponen et al. 2010). The internal mechanisms by which employees neutralize their security values should be considered in conjunction with the predictors of the TPB when reflecting upon the desirable security behavior. All six assessed neutralization techniques seem to be important methods by which individuals justify less desired security behaviors. The most important techniques, however, seem to be the defense of necessity and the condemnation of the condemners. For the former, employers defend their undesirable security behavior by their needs to meet their work objectives such as deadlines. In terms of the latter, the employees simply perceive the rules as unfair. We believe that contemporary information security awareness programs should pay more attention to these defense mechanisms (Bauer et al. 2013b).

Finally, we need to acknowledge some limitations of this study. A common problem in empirical quantitative research is external reliability. In this context, the results must be interpreted with caution. Firstly, the sample consists of students with most of the respondents being younger than 30 years. We therefore cannot assume that our results can be unconditionally extended to the context of employees in general. However, we controlled reliability with a number of measures. As a start we contacted the full population to ensure a good representation of all students. We controlled the role of the target person by applying filter questions and semantically linking most questions to the context of work environments. We could not avoid the use of a mono method, which however is common in many studies of similar designs (e.g. Fink et al. 2009).

ConclusionsOur findings provide important insights for scholars and practitioners. Overall, all proposed hypotheses are supported according to our theoretical analysis. It is noteworthy to highlight the relatively stronger effects of perceived behavioral control and neutralization on the intention of desirable information security behavior.

Neutralization theory, which is an essential perspective for explaining employees’ workplace security violations, should be considered in conjunction with the traditional aspects of subjective norm, general attitudes or perceived behavioral control to analyze and influence the intention of employees for desirable security behavior.

Additional research would be required to fully understand the potential influence of neutralization theory on design and content of information security awareness delivery methods and programs. Therefore, we suggest conducting exploratory interviews with employees to explore the cause effect relationships behind their neutralization techniques. Furthermore, innovative information security awareness delivery methods should be designed according to the new insights about the factors influencing desirable information security behavior. These innovative methods should be evaluated in a real world context.


Bauer; Bernroider

ReferencesAjzen, I. 1991. "The theory of planned behavior," Organizational Behavior and Human

Decision Processes (50:2), pp 179–211.Ajzen, I., and Fishbein, M. 1980. Understanding attitudes and predicting social behavior,

(Prentice-Hall: Englewood Cliffs, NJ.Albrechtsen, E. 2007. "A qualitative study of users' view on information security,"

Computers & Security (26:4), pp 276-289.Barlow, J. B., Warkentin, M., Ormond, D., and Dennis, A. R. 2013. "Don't make excuses!

Discouraging neutralization to reduce IT policy violation," Computers & Security:In Press).

Bauer, S., and Bernroider, E. W. N. 2013. "IT Operational Risk Awareness Building in Banking Companies: A Preliminary Research Design Highlighting the Importance of Risk Cultures and Control Systems," International Conference on Information Resource Management, Natal, Brazil, 2013a, pp. 1-4.

Bauer, S., Bernroider, E. W. N., and Chudzikowski, K. 2013. "End User Information Security Awareness Programs for Improving Information Security in Banking Organizations: Preliminary Results from an Exploratory Study," AIS SIGSEC Workshop on Information Security & Privacy (WISP2013), Milano, 2013b.

Boss, S. R., Kirsch, L. J., Angermeier, I., Shingler, R. A., and Boss, R. W. 2009. "If someone is watching, I'll do what I'm asked: mandatoriness, control, and information security," European Journal of Information Systems (18:2), pp 151-164.

Bulgurcu, B., Cavusoglu, H., and Benbasat, I. 2010. "Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness," MIS Quarterly (34:3), pp 523-548.

Chin, W. W. 1998. "The Partial Least Squares Approach to Structural Equation Modeling," in Modern Methods for Business Research, G. A. Marcoulides (ed.), Lawrence Erlbaum Associates: New Jersey, p. 297.

Cohen, J. 1988. Statistical power analysis for the behavioral sciences, (2 ed.) Lawrence, Erlbaum Associates: Hillsdale, New Jersey.

Cox, J. 2012. "Information systems user security: A structured model of the knowing–doing gap," Computers in Human Behavior (28:5), pp 1849-1858.

Fink, L., and Neumann, S. 2009. "Exploring the perceived business value of the flexibility enabled by information technology infrastructure," Information & Management (46:2), pp 90-99.

Gefen, D., Straub, D. W., and Boudreau, M.-C. 2000. "Structural Equation Modeling and Regression: Guidelines for research practice," Communications of the Association for Information Systems (4:7), pp 1-79.

Gibbs, J. P. 1968. "Crime, punishment and deterrence," Southwestern Social Science Quarterly (48:5), pp 515–530.

Goldstein, J., Chernobai, A., and Benaroch, M. 2011. "An Event Study Analysis of the Economic Impact of IT Operational Risk and its Subcategories," Journal of the Association for Information Systems (12:9), pp 606-631.

Guo, K. H. 2013. "Security-related behavior in using information systems in the workplace: A review and synthesis," Computers & Security (32), pp 242-251.

Hair, J. F., Hult, G. T. M., Ringle, C. M., and Sarstedt, M. 2013. A primer on partial least squares structural equation modeling (pls-sem), (Sage: Los Angeles.

Hair, J. F., Sarstedt, M., Ringle, C. M., and Mena, J. A. 2011. "An assessment of the use of partial least squares structural equation modeling in marketing research," Journal of the Academy of Marketing Science (40:3), pp 414-433.



Hu, Q., Dinev, T., Hart, P., and Cooke, D. 2012. "Managing Employee Compliance with Information Security Policies: The Critical Role of Top Management and Organizational Culture," Decision Sciences (43:4), pp 615-659.

Lim, V. K. G. 2002. "The IT way of loafing on the job: cyberloafing, neutralizing and organizational justice," Journal of Organizational Behavior (23:5), pp 675-694.

Maruna, S., and Copes, H. 2004. "What Have We Learned from Five Decades of Neutralization Research?," Crime and Justice (32), pp 221-320.

Padayachee, K. 2012. "Taxonomy of compliant information security behavior," Computers & Security (31:5), pp 673-680.

Park, J.-H., Suh, H.-J., and Yang, H.-D. 2007. "Perceived absorptive capacity of individual users in performance of Enterprise Resource Planning (ERP) usage: The case for Korean firms," Information & Management (44:3), pp 300-312.

Ringle, C., Wende, S., and Will, A. 2005. "SmartPLS 2.0 (beta)," University of Hamburg.Rocha Flores, W., and Antonsen, E. 2013. "The development of an instrument for assessing

information security in organizations: Examining the content validity using quantitative methods," in Proceedings of the International Conference on Information Resource Management 2013 (Conf-IRM 2013), L. Janczewski (ed.): Natal, Brazil, pp. 1-15.

Rogers, R. W. 1975. " A protection motivation theory of fear appeals and attitude change," Journal of Psychology (91:1), pp 93-114.

Sarstedt, M., Ringle, C. M., and Hair, J. F. 2011. "PLS-SEM: Indeed a Silver Bullet," The Journal of Marketing Theory and Practice (19:2), pp 139-152.

Siponen, M., and Vance, A. 2010. "Neutralization: New Insights into the Problem of Employee Information Systems Security Policy Violations," MIS Quarterly (34:3), pp 487-502.

Sommestad, T., and Hallberg, J. 2013. "A review of the theory of planned behaviour in the context of information security policy compliance," International Information Security and Privacy Conference, Springer Verlag Berlin Heidelberg.

Stanton, J. M., Stam, K. R., Mastrangelo, P., and Jolton, J. 2005. "Analysis of end user security behaviors," Computers & Security (24:2), pp 124-133.

Su, Y.-f., and Yang, C. 2010. "Why are enterprise resource planning systems indispensable to supply chain management?," European Journal of Operational Research (203:1), pp 81-94.

Sykes, G. M., and Matza, D. 1957. "Techniques of Neutralization: A Theory of Delinquency," American Sociological Association (22:6), pp 664-670.

Vance, A., Siponen, M., and Pahnila, S. 2012. "Motivating IS security compliance: Insights from Habit and Protection Motivation Theory," Information & Management (49:3-4), pp 190-198.

Warkentin, M., Straub, D., and Malimage, K. 2012. "Featured Talk: Measuring Secure Behavior: A Research Commentary," in Annual Symposium of Information Assurance & Secure Knowledge Management: Albany, NY.

Warkentin, M., and Willison, R. 2009. "Behavioral and policy issues in information systems security: the insider threat," European Journal of Information Systems (18:2), pp 101-105.

Webster, J., and Watson, R. T. 2002. "Analyzing the Past to Prepare for the Future: Writing a Literature Review," MIS Quarterly (26:2), pp xiii-xxiii.

Willison, R., and Warkentin, M. 2013. "Beyond Deterrrence: An Expanded View of Employee Computer Abuse," MIS Quarterly (37:1), pp 1-20.

Wold, H. 1982. "Soft modeling: the basic design and some extensions," in Systems under indirect observations: Causality, structure, prediction. Part 2, K. G. Jöreskog and H. Wold (eds.), North-Holland: Amsterdam, pp. 1-54.


Bauer; Bernroider

AppendixTable A1. Measurement ModelConstruct Adapted

fromAttitude toward Information Security Behavior

ATT1

To me, information security procedures and operating instructions in our daily work are _______. (Scale from unnecessary to necessary)

(Bulgurcu et al. 2010)

ATT2

To me, information security procedures and operating instructions in our daily work are _______. (Scale from unbeneficial to beneficial)

ATT3

To me, information security procedures and operating instructions in our daily work are _______. (Scale from unimportant to important)

ATT4

To me, information security procedures and operating instructions in our daily work are _______. (Scale from useless to useful)

Subjective norm toward Information Security

SN1 In our organization, information security is viewed as a collective responsibility.

(Rocha Flores et al. 2013)SN2 Both my colleagues and I share the same ambitions

and vision of protecting information assets from being compromised in our organization.

SN3 Both my colleagues and I share and agree on the way collective information security goals are being pursued in our organization.

Perceived Behavioral Control toward Information Security

PBC1

I have the necessary skills to fulfill the requirements of the information security procedures and operating instructions.

(Bulgurcu et al. 2010)

PBC2

I have the necessary knowledge to fulfill the requirements of the information security procedures and operating instructions.


DSB1

I plan to keep aware of the latest security threats so I can protect my system.

(Boss et al. 2009)

DSB2

I intend to comply with information security rules, policies and working procedures.

(Vance et al. 2012)

DSB3

I intend to assist others in complying with information security rules, policies and working procedures.

(Vance et al. 2012)

Actual desirable security behavior

ASB1

I take IT-security very seriously. self constructedASB

2I tend to greater care concerning IT-security.

Denial of responsibility

DOR1

It is OK to violate the company information security policy if you aren’t sure what the policy is.

(Siponen et al. 2010)DOR It is OK to violate the company information security



2 policy if you don’t understand it.

DOR3

It is OK to violate the company information security policy if the policy is not advertised.


CC1 It is not as wrong to violate a company information security policy that is not reasonable.

(Siponen et al. 2010)CC2 It is not as wrong to violate a company information

security policy that requires too much time to comply with.

CC3 It is not as wrong to violate a company information security policy that is too restrictive.

Appeal to higher loyalties

AHL1

It is all right to violate a company information security policy if you get your work done.

(Siponen et al. 2010)AHL

2It is all right to violate a company information security policy if you complete the task given by management.

Denial of injury

DJ1 It is OK to violate the company information security policy if no damage is done to the company.

(Siponen et al. 2010)DJ2 It is OK to violate the company information security

policy if no one gets hurt.


DN1 It is all right to violate the company information security policy when you are under a tight deadline.

(Siponen et al. 2010)

DN2 It is all right to violate the company information security policy when you are in a hurry.


ML1 I feel my general adherence to company information security policy compensates for occasionally violating an information security policy.

(Siponen et al. 2010)

ML2 I feel my good job performance compensates for occasionally violating information security policy.


Bauer; Bernroider

Table A2. Theories, Constructs and Measures

ConstructsMeasure

s Codes Descriptions and SourcesBased on the Theory of Planned Behavior (Ajzen 1991)

Attitude toward information security behavior

4-Items ATT1-4 Employee’s attitudes on whether it is good or bad to perform a security compliant behavior. Adapted from (Bulgurcu et al. 2010).

Subjective norm 3-Items SN 1-3 Employee’s perceptions of whether the behavior is accepted and encouraged by people who are important to him or her in the organization, such as colleagues, subordinates, or superiors. Adapted from (Rocha Flores et al. 2013).

Perceived behavioral control

2-Items PBC1-2 Employee’s perceived ease or difficulty of performing a behavior and personal sense of having the skills and control over performing it. Adapted from (Bulgurcu et al. 2010).


3-Items DSB1-3 Employee’s belief that he or she will perform the desirable behavior sometime in the future. Adapted from (Boss et al. 2009; Vance et al. 2012).

Actual desirable security behavior

2-Items ASB1-2 Employee’s belief that he or she will perform the desirable behavior sometime in the future.

Based on the Neutralization Theory (Sykes et al. 1957)Denial of responsibility

3-Items DOR1-3 Employee feels not responsible for his action and he thinks that his behavior is beyond his control (Sykes et al. 1957).


3-Items CC1-3 Employee feels that the rules are unjust or make no sense, hence a violates the information security policy

Appeal to higher loyalties

2-Items AHL1-2 Employees explain their deviant behavior by excusing the violation because they have too less time to carry out the work or that the rules are too restrictive (Sykes et al. 1957).

Denial of injury 2-Items DJ1-2 Employee justifies his action by minimizing the harm it causes.


2-Items DN1-2 Employee thinks that he has no other acceptable choice to act.


2-Items ML1-2 Employee feels that he/she has done enough good deeds to justify doing something against policy.


Documents

ICIS Proceedings Template029e2c6.netsolhost.com/.../2014/IIVC_2014_submission_7.docx · Web viewPrevious literature on behavioral reasoning dealing with information security behavior