Predicting information security policy compliance intentions and behavior for six employee-based risks

IF 0.5 Q4 COMPUTER SCIENCE, SOFTWARE ENGINEERING

International Journal of Information Security and Privacy Pub Date : 2017-10-02 DOI:10.1080/15536548.2017.1418632

T. Ryutov, Nicole D. Sintov, Mengtian Zhao, R. John

引用次数: 5

Abstract

ABSTRACT Employees’ non-compliance with organizational information security policies poses a significant threat to organizations. Enhancing our understanding of compliance behavior is crucial for improving security. Although research has identified numerous psychological factors that affect intentions to comply with security policies, how such intentions map onto actual compliance behavior is not well understood. Building on a well-supported model of security policy compliance intentions, we evaluate compliance with each of six types of information security policies using decision vignettes, and compare parameters across models. The study contributes to information security compliance research by examining each risk separately and exploring heterogeneity across risk types.

查看原文本刊更多论文

预测六种基于员工的风险的信息安全策略遵从意图和行为

员工不遵守组织的信息安全政策对组织构成了重大威胁。增强我们对遵从性行为的理解对于提高安全性至关重要。尽管研究已经确定了许多影响遵从安全策略的意图的心理因素，但是这些意图如何映射到实际的遵从行为还没有得到很好的理解。在一个得到良好支持的安全策略遵从意图模型的基础上，我们使用决策片段评估了六种类型的信息安全策略的遵从性，并比较了模型之间的参数。本研究通过对每一种风险进行单独考察，探索不同风险类型之间的异质性，为信息安全合规研究做出了贡献。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

International Journal of Information Security and Privacy COMPUTER SCIENCE, SOFTWARE ENGINEERING-

CiteScore

2.50

自引率

0.00%

发文量

期刊介绍： As information technology and the Internet become more and more ubiquitous and pervasive in our daily lives, there is an essential need for a more thorough understanding of information security and privacy issues and concerns. The International Journal of Information Security and Privacy (IJISP) creates and fosters a forum where research in the theory and practice of information security and privacy is advanced. IJISP publishes high quality papers dealing with a wide range of issues, ranging from technical, legal, regulatory, organizational, managerial, cultural, ethical and human aspects of information security and privacy, through a balanced mix of theoretical and empirical research articles, case studies, book reviews, tutorials, and editorials. This journal encourages submission of manuscripts that present research frameworks, methods, methodologies, theory development and validation, case studies, simulation results and analysis, technological architectures, infrastructure issues in design, and implementation and maintenance of secure and privacy preserving initiatives.