Does Deterrence Work in Reducing Information Security Policy Abuse by Employees?

Qing Hu,Zhengchuan Xu,Tamara Dinev,Hong Ling

DOI: https://doi.org/10.1145/1953122.1953142

IF: 22.7

2011-01-01

Communications of the ACM

Abstract:Methods for evaluating and effectively managing the security behavior of employees.

What problem does this paper attempt to address?

A Meta-Analysis of Deterrence Theory in Information Security Policy Compliance Research

Simon Trang,Benedikt Brendel

DOI: https://doi.org/10.1007/s10796-019-09956-4

2019-10-25

Information Systems Frontiers

Abstract:Enforcing information security policies is a key concern of information security managers. To deter employees from deviant behavior, organizations often implement sanction mechanisms. However, evidence from research regarding the efficiency of such a deterrence approach has been mixed. Drawing on this inconsistency, this paper examines the applicability of deterrence theory in information security policy compliance research. It is argued that contextual and methodological moderators play a crucial role when conceptualizing deterrence theory in security studies. Applying a meta-analysis, the results suggest that sanctions have an overall effect on deviant behavior. However, the results also indicate that this relationship is dependent on the study's context. Deterrence theory better predicts deviant behavior in malicious contexts, cultures with a high degree of power distance, and cultures with a high uncertainty avoidance. The meta-analysis also reveals no meaningful differences arising from the methodological context in terms of scenario-based and behavior-specific measurement.
Study on e-government information misuse based on General Deterrence Theory

Jing Fan,Pengzhu Zhang

DOI: https://doi.org/10.1109/ICSSSM.2011.5959454

2011-01-01

Abstract:This paper examines four types security countermeasures and their influence on information misuse or abuse behaviors of government internal officials' in the context of e-government information sharing. A research model was developed based on the General Deterrence Theory. Analysis of the data collected in a survey of 21 government agencies in Shanghai with 124 questionnaires who are specialized in the processes of government information sharing, including information collection and storage, information processing, information transfer and information usage. First, the findings indicated that static information security policies only can take effects when the policies are conveyed to employees clearly and the punishment is carried out well. Second, security awareness practice is one of the most important measures for internal officials. Third, when employees realize the organization is monitoring their information system behaviors and know consequence of information misuse or abuse behavior, the countermeasures can play more effects. Fourth, preventative software is still the strongest measure for e-government security.
Study on the Impact of Security Countermeasures on E-Government Information Misuse

Jing Fan,Pengzhu Zhang,Xinjie Zhao

2009-01-01

Abstract:Information security has been a high priority for government agencies nowadays. This study, based on the general deterrence theory, investigates how security countermeasures will result in more effective control of information misuse in government agencies. Data gathered through a survey of 21 government agencies in Shanghai and 124 effective questionnaires were obtained. The results show that security policies and security awareness training will significantly lower information misuse behaviors by increasing the perceived severity of sanctions. Meanwhile,, security monitoring practice will significantly lower information misuse behaviors by increasing the perceived certainty of sanctions. Preventative security software has no effect on perceived certainty and severity of sanction while it will prevent the invading actions directly. Knowledge about these relationships is useful for making key decisions about the security function.
Deterrence and prevention-based model to mitigate information security insider threats in organisations

Nader Sohrabi Safa,Carsten Maple,Steve Furnell,Muhammad Ajmal Azad,Charith Perera,Mohammad Dabbagh,Mehdi Sookhak

DOI: https://doi.org/10.1016/j.future.2019.03.024

IF: 7.307

2019-08-01

Future Generation Computer Systems

Abstract:Previous studies show that information security breaches and privacy violations are important issues for organisations and people. It is acknowledged that decreasing the risk in this domain requires consideration of the technological aspects of information security alongside human aspects. Employees intentionally or unintentionally account for a significant portion of the threats to information assets in organisations. This research presents a novel conceptual framework to mitigate the risk of insiders using deterrence and prevention approaches. Deterrence factors discourage employees from engaging in information security misbehaviour in organisations, and situational crime prevention factors encourage them to prevent information security misconduct. Our findings show that perceived sanctions certainty and severity significantly influence individuals’ attitudes and deter them from information security misconduct. In addition, the output revealed that increasing the effort, risk and reducing the reward (benefits of crime) influence the employees’ attitudes towards prevent information security misbehaviour. However, removing excuses and reducing provocations do not significantly influence individuals’ attitudes towards prevent information security misconduct. Finally, the output of the data analysis also showed that subjective norms, perceived behavioural control and attitude influence individuals’ intentions, and, ultimately, their behaviour towards avoiding information security misbehaviour.
Does One Size Fit All? Examining the Differential Effects of IS Security Countermeasures

John D’Arcy,Anat Hovav

DOI: https://doi.org/10.1007/s10551-008-9909-7

IF: 6.331

2008-08-27

Journal of Business Ethics

Abstract:Research from the fields of criminology and social psychology suggests that the deterrent effect of security countermeasures is not uniform across individuals. In this study, we examine whether certain individual characteristics (i.e., computer self-efficacy) or work arrangement (i.e., virtual status) moderate the influence of␣security policies, security education, training, and awareness (SETA) program, and computer monitoring on information systems misuse. The results suggest that computer savvy individuals are less deterred by SETA programs and computer monitoring, while these countermeasures are also less influential (from a deterrence perspective) on employees that spend more working days outside the office. Implications for both the research and practice of information security are discussed.

business,ethics
A meta-analysis of the deterrence theory in security-compliant and security-risk behaviors

Kuang-Ming Kuo,Paul C Talley,Chi-Hsien Huang

DOI: https://doi.org/10.1016/j.cose.2020.101928

2020-09-01

Abstract:Deterrence theory has been widely adopted in the study of information security management; however, evidence frequently presents sometimes contradictory results. Prior meta-analytic studies have focused primarily on the use of formal deterrence constructs to predict security-compliant behavior, while informal deterrence constructs and security-risk behavior are often neglected as a result. This study aims to meta-analyze the relationships formed between both formal/informal deterrence constructs and security-compliant/risk behaviors in a comprehensive manner beyond what has taken place in prior IS security meta-analysis based on deterrence theory. By searching multiple electronic databases, we have located 40 studies, along with 108 effect sizes, pertinent to our study's purpose. Inverse variance method weighted with sample sizes was used to determine mean effect sizes. The random-effects model was used to report meta-analysis results since Q, I2, and H index showed some degree of heterogeneity existent in the collected data. Publication bias was assessed by means of fail-safe N. All proposed relationships occurring between formal/informal deterrence constructs and security-compliant/-risk behaviors were supported. Formal deterrence constructs exerted weak to moderate effects on security behavior, while informal deterrence constructs exerted moderate to strong effects on security behavior. Further, informal deterrence constructs showed greater mean effect sizes than formal deterrence constructs. Additionally, prediction intervals of deterrence constructs, along with detection certainty, included zero, which indicated that moderators may be present. Based on these findings, the mean effect sizes of deterrence constructs may be more clearly identified when dividing security behavior into both compliant- and risk- behaviors. Further moderators might be employed to improve the inconsistent findings evidenced in deterrence theory.

computer science, information systems
Information Security Policy Noncompliance: an Integrative Social Influence Model.

Kholekile L. Gwebu,Jing Wang,Michael Y. Hu

DOI: https://doi.org/10.1111/isj.12257

2020-01-01

Abstract:Despite the significant advancements made in understanding the factors that drive employees' compliance and noncompliance behaviours with information security policy (ISP), less is known about how different factors interact to impact such behaviours. Having been drawn on the social information processing theory, this research develops an integrative model that investigates how ethical work climate, beliefs, and neutralization interact to jointly explain ISP noncompliance. The model is tested via a survey of a broad cross section of employees. Neutralization, perceived cost of compliance, and perceived cost of noncompliance are found to significantly impact ISP noncompliance. Egoistic, benevolent, and principled climates are found to differentially influence neutralization and individuals' cognitive beliefs about the cost and benefit of ISP compliance versus noncompliance. Neutralization appears to be a more important moderator of the belief‐noncompliance relationship than the principled climate.
Violation with Concerns of Safety: A Study on Non-Compliant Behavior and the Antecedent and Consequent Effects in Power Grid Construction

Fan Zhou,Hongxu Lu,Chunping Jiang

DOI: https://doi.org/10.1016/j.ssci.2023.106353

IF: 6.392

2024-01-01

Safety Science

Abstract:Non-compliant behaviors have been indicated to be leading indicators of accidents in workplaces. Though most studies treat intentional non-compliant behavior or violations as monolithic indicators for adverse safety performance, non-compliant behaviors might take different forms with distinct motives and outcomes. To examine and compare the effects of different forms of non-compliant safety behavior, we proposed a construct of risk-adjusted non-compliant behavior, which refers to employees' deliberate deviation from safety rules while considering safety concerns and adjusting their behavior accordingly, and investigated the differential antecedent effects by contextual factors and consequential effects on safety outcomes. By a sample of 390 workers and their supervisors in a power grid construction firm, the results of our study indicated that safety climate and transformational leadership were positively associated with safety compliance and negatively associated with violation by multi-level analyses. However, active transactional leadership also had a positive association with risk-adjusted non-compliant behavior, and this association was moderated by safety climate such that the relationship was stronger in higher level of safety climate. Furthermore, although risk-adjusted non-compliant behavior did not significantly affect penalties for deviance compared to violation behavior, it increased the workers' risk perception of hazard. The implications of these findings for theory were discussed.
Cognitive Elaboration on Potential Outcomes and Its Effects on Employees' Information Security Policy Compliance Intention-Exploring the Key Antecedents.

Xue Yang,Wei T. Yue,Choon Lin Sia

DOI: https://doi.org/10.1007/978-3-642-29873-8_17

2012-01-01

Abstract:IS security policy is one of the essential tools to ensure the secure use of information systems and technological assets. To enhance the effectiveness of policy implementation, organizations rely on security training, education and awareness (STEA) programs to help employees understand the IS security issues of the organization. However, different levels of STEA informativeness may have conflicting effects on employees' compliance decisions. In addition, the urgency of a task may also lead employees to abandon the compliance decision occasionally. The existing corporate information security policy (ISP) could also serve as a deterrence message that would influence compliance decisions. An experimental survey was conducted to examine this phenomenon and test the related hypotheses. The results of this study can be used to inform and guide researchers and practitioners as to how to better enforce an IS security policy through better implementation of STEA programs and improved design of ISP in different task scenarios.
The Empirical Study of Active Countermeasures Deterrence Impact on Internal E-Government Information Security

FAN Jing,ZHANG Peng-zhu

2012-01-01

Abstract:Information security is one of the critical challenges during e-government development.Aimed at internal information misuse,a deterrence impact model of e-government information active security countermeasures was set up based on Security Action Cycle Theory and General Deterrence Theory.
Taking Promotion and Prevention Mechanisms Matter for Information Systems Security Policy in Chinese SMEs

Hung-Pin Shih,Kee-hung Lai,Xitong Guo,T. C. E. Cheng

DOI: https://doi.org/10.1109/infoman.2016.7477543

2016-01-01

Abstract:Deterrence and rational choice calculus theories can regulate or motivate employees' compliance with information systems security policy (ISSP). However, the two well-developed theories may not fully induce compliance behavior of ISSP given the growing trend of IS security violation in China. Deterrence and rational choice calculus employ an assumption of general awareness of ISSP to address compliance behavior. However, employees may judge their compliance behavior of ISSP in terms of positive and negative emotions but not the trade-off of benefits and costs (risks) only in the compliance. Grounded in regulatory focus theory (RFT), we propose a research model that addresses the motivational mechanisms for employees to comply with ISSP. We adopt a scenario-based questionnaire to survey employees of Chinese SMEs for model testing. The empirical results indicate that promotion-approach is better than promotion-avoidance in motivating compliance intention when employees are aware of the ISSP in their companies. However, promotion-approach and promotion-avoidance are ineffective in inducing compliance intention when employees are unaware of ISSP in Chinese SMEs. Information security awareness is not a necessary condition of the compliance of ISSP. Additionally, prevention-approach is better than prevention-avoidance in motivating compliance intention regardless of whether employees are aware or unaware of ISSP in the workplace. Our empirical results can provide meaningful implications for academics and practitioners.
Leveraging fairness and reactance theories to deter reactive computer abuse following enhanced organisational information security policies: an empirical study of the influence of counterfactual reasoning and organisational trust

Paul Benjamin Lowry,Clay Posey,Rebecca J. Bennett,Tom L. Roberts,Rebecca Becky J. Bennett

DOI: https://doi.org/10.1111/isj.12063

IF: 7.767

2015-02-24

Information Systems Journal

Abstract:Research shows that organisational efforts to protect their information assets from employee security threats do not always reach their full potential and may actually encourage the behaviours they attempt to thwart, such as reactive computer abuse (CA). To better understand this dilemma, we use fairness theory (FT) and reactance theory (RT) to explain why employees may blame organisations for and retaliate against enhanced information security policies (ISPs). We tested our model with 553 working professionals and found support for most of it. Our results show that organisational trust can decrease reactive CA. FT suggests that explanation adequacy (EA) is an important factor that builds trust after an event. Our results also suggest that trust both fully mediates the relationship between EA and CA and partially mediates the relationship between perceived freedom restrictions related to enhanced ISPs and reactive CA. EA also had a strong negative relationship with freedom restrictions. Moreover, organisational security education, training and awareness (SETA) initiatives decreased the perceptions of external control and freedom restrictions and increased EA, and advance notification of changes increased EA. We also included 14 control variables and rival explanations to determine with more confidence what drove reactive CA in our context. Notably, the deterrence theory (DT)‐based constructs of sanction severity, certainty and celerity had no significant influence on reactive CA. We provide support for the importance of respectful communication efforts and SETA programmes, coupled with maximising employee rights and promoting trust and fairness to decrease reactive CA. These efforts can protect organisations from falling victim to their own organisational security efforts.

information science & library science
Hospital Staff’s Adherence to Information Security Policy: A Quest for the Antecedents of Deterrence Variables

Kuang-Ming Kuo,Paul C. Talley,Dyi-Yih Michael Lin

DOI: https://doi.org/10.1177/00469580211029599

2021-01-01

Abstract:Information security has come to the forefront as an organizational priority since information systems are considered as some of the most important assets for achieving competitive advantages. Despite huge capital expenditures devoted to information security, the occurrence of security breaches is still very much on the rise. More studies are thus required to inform organizations with a better insight on how to adequately promote information security. To address this issue, this study investigates important factors influencing hospital staff’s adherence to Information Security Policy (ISP). Deterrence theory is adopted as the theoretical underpinning, in which punishment severity and punishment certainty are recognized as the most significant predictors of ISP adherence. Further, this study attempts to identify the antecedents of punishment severity and punishment certainty by drawing from upper echelon theory and well-acknowledged international standards of IS security practices. A survey approach was used to collect 299 valid responses from a large Taiwanese healthcare system, and hypotheses were tested by applying partial least squares-based structural equation modeling. Our empirical results show that Security Education, Training, and Awareness (SETA) programs, combined with internal auditing effectiveness are significant predictors of punishment severity and punishment certainty, while top management support is not. Further, punishment severity and punishment certainty are significant predictors of hospital staff’s ISP adherence intention. Our study highlights the importance of SETA programs and internal auditing for reinforcing hospital staff’s perceptions on punishment concerning ISP violation, hospitals can thus propose better internal strategies to improve their staff’s ISP compliance intention accordingly.
The Role of Rational Calculus in Controlling Individual Propensity Toward Information Security Policy Non-Compliance Behavior.

Qing Hu,Zhengchuan Xu

DOI: https://doi.org/10.24251/hicss.2018.466

2018-01-01

Abstract:We draw on recent advances in cognitive neural science to articulate an employee security behavioral model. Cognitive neural science studies suggest two neurological processes occurring in human brain when making decisions: the automatic or reflexive process, which is the default mode for decision making, and the controlled or reflective process, which interrupts the automatic process when the brain encounters unexpected events or novel decisions. We map rational choice to the controlled process and self-control to the automatic process and test a decision model using survey data in the context of employee non-compliance behavior to organization information security policies.
An Investigation of Employees' Intention to Comply with Information Security System—A Mixed Approach Based on Regression Analysis and fsQCA

Wenqin Li,Rongmin Liu,Linhui Sun,Zigu Guo,Jie Gao

DOI: https://doi.org/10.3390/ijerph192316038

IF: 4.614

2022-12-01

International Journal of Environmental Research and Public Health

Abstract:Employee security compliance behavior has become an important safeguard to protect the security of corporate information assets. Focusing on human factors, this paper discusses how to regulate and guide employees' compliance with information security systems through effective methods. Based on protection motivation theory (PMT), a model of employees' intention to comply with the information security system was constructed. A questionnaire survey was adopted to obtain 224 valid data points, and SPSS 26.0 was applied to verify the hypotheses underlying the research model. Then, based on the results of a regression analysis, fuzzy set qualitative comparative analysis (fsQCA) was used to explore the conditional configurations that affect employees' intention to comply with the information security system from a holistic perspective. The empirical results demonstrated that perceived severity, perceived vulnerability, response efficacy, and self-efficacy all positively influenced the employees' intention to comply with the information security system; while rewards and response costs had a negative effect. Threat appraisal had a greater effect on employees' intention to comply with the information security system compared to response appraisal. The fsQCA results showed that individual antecedent conditions are not necessary to influence employees' intention to comply with an information security system. Seven pathways exist that influence an employees' intention to comply with an information security system, with reward, self-efficacy, and response cost being the core conditions having the highest probability of occurring in each configuration of pathways, and with perceived severity and self-efficacy appearing in the core conditions of configurations with an original coverage greater than 40%. Theoretically, this study discusses the influence of the elements of PMT on employees' intention to comply with an information security system, reveals the mechanism of influence of the combination of the influencing factors on the outcome variables, and identifies the core factors and auxiliary factors in the condition configurations, providing a new broader perspective for the study of information security compliance behavior and providing some theoretical support for strengthening enterprise security management. Practically, targeted suggestions are proposed based on the research results, to increase the intention of enterprise employees to comply with information security systems, thereby improving the effectiveness of enterprise information security management and the degree of information security in enterprises.

public, environmental & occupational health,environmental sciences
Impact of negative emotions on violations of information security policy and possible mitigations

Jie Zhen,Zongxiao Xie,Kunxiang Dong,Lin Chen

DOI: https://doi.org/10.1080/0144929X.2021.1921029

2021-05-05

Behaviour and Information Technology

Abstract:Security research on the role of employees' negative emotions in their information security policy (ISP) violations is limited. In this study, we examine how employees' negative emotions influence their intention to violate ISP. To understand how to reduce employees' negative emotions, we investigate the effects of perceived organisational support, psychological ownership, and work engagement. We test our hypotheses using survey data of 318 employees from various organisations in China. Results indicate that employees with negative emotions are more likely to violate ISP, while perceived organisational support, psychological ownership, and work engagement can reduce employees' negative emotions. Furthermore, psychological ownership and work engagement partially mediate the relationship between perceived organisational support and negative emotions. The theoretical and practical significance of these results and the direction of future research are discussed.

ergonomics,computer science, cybernetics
From hindrance to challenge

Ying Li,Ting Pan,Nan Zhang,Nan (Andy) Zhang

DOI: https://doi.org/10.1108/jeim-01-2019-0018

2019-09-23

Journal of Enterprise Information Management

Abstract:Purpose This paper is to investigate how employees respond to information security policies (ISPs) when they view the policies as a challenge rather than a hindrance to work. Specifically, the authors examine the roles of challenge security demands (i.e. continuity and mandatory) and psychological resources (i.e. personal and job resources) in influencing employees’ ISP non-compliance. Design/methodology/approach Applying a hypothetical scenario-based survey method, the authors tested our proposed model in six typical ISPs violation scenarios. In sum, 347 responses were collected from a global company. The data were analyzed using partial least square-based structural equation model. Findings Findings indicated that continuity and mandatory demands increased employees’ level of perseverance of effort, which, in turn, decreased their ISPs non-compliance intention. In addition, job resources, such as the trust enhancement gained from co-workers and the opportunities for professional development, enhanced the perseverance of effort. Practical implications The findings offer implications to practice by suggesting that organizations should design training programs to persuade employees to understand the ISPs in a positive way. Meanwhile, organizations should encourage employees to invest more personal resources by creating a trusting atmosphere and providing them opportunities to learn security knowledge and skills. Originality/value This study is among the few to empirically explore how employees respond and behave when they view the security policies as challenge stressors. The paper also provides a novel understanding of how psychological resources contribute to buffering ISP non-compliance.

information science & library science,management
It ain't my business: a coping perspective on employee effortful security behavior.

Zhengchuan Xu,Ken H. Guo

DOI: https://doi.org/10.1108/JEIM-10-2018-0229

2019-01-01

Journal of Enterprise Information Management

Abstract:Purpose Human factor is often cited as one of the biggest challenges for organizational information security management. The purpose of this paper is to investigate how and why employees fail to carry out required security tasks. Design/methodology/approach On the basis of coping theory, this paper develops a theoretical model to examine employee effortful security behavior (ESB). The model is tested with the data collected through a survey of computer users. Findings The results suggest that employee procrastination of security tasks and psychological detachment from security issues are two antecedents of ESB. Psychological detachment and procrastination are in turn influenced by perceived externalities of security risk and triage of business tasks over security issues by employees. Originality/value This paper contributes to the information systems security literature by providing a nuanced understanding of the antecedents and process of how employees cope with security task demands. It also offers some insights for practitioners in terms of the importance of designing and implementing security measures that are viewed as relevant to employees.
Research on Privacy-by-Design Behavioural Decision-Making of Information Engineers Considering Perceived Work Risk

Fei Bu,Nengmin Wang,Qi Jiang,Xiang Tian

DOI: https://doi.org/10.3390/systems12070250

2024-01-01

Systems

Abstract:Privacy by design (PbD) has attracted considerable attention from researchers and information security experts due to its enormous potential for protecting private information and improving the privacy and security quality of information technology products. The adoption of PbD among information engineers is currently limited owing to its innovativeness and the distinctive traits of the information technology industry. Utilising the Technology Acceptance Model as a framework, this study innovatively explores the pivotal factors and mechanisms that influence information engineers’ decision-making in the adoption of PbD from the viewpoint of the perceived work risk. In this empirical research, professional information engineers were invited to complete a questionnaire survey. After analysing the data using partial least squares structural equation modelling, the results reveal that information engineers’ perceived work risk in PbD (PWRP) negatively affects their perceptions of the usefulness and ease of use of PbD. This negative perception subsequently reduces their intention to implement PbD (INTP) and adversely impacts their attitudes towards implementing PbD (ATTP). Furthermore, the study findings reveal that a positive ATTP among engineers boosts their INTP and positively influences their behaviours regarding information security. This study provides an in-depth examination of these findings and lays a solid theoretical groundwork for the further promotion and implementation of PbD in information technology enterprises. Moreover, the findings offer invaluable support for management decisions in both information technology companies and information security regulatory authorities, significantly contributing to the expansion and deepening of research in the field of PbD.
Effects of Security Knowledge, Self-Control, and Countermeasures on Cybersecurity Behaviors

Princely Ifinedo

DOI: https://doi.org/10.1080/08874417.2022.2065553

2022-04-20

Journal of Computer Information Systems

Abstract:Organizations whose employees participate in risky cybersecurity behaviors (RCySecB) could suffer disastrous consequences either directly or indirectly from actions linked to such behaviors. This study used conceptualizations facilitated by Attribution Theory to examine the effects of dispositional factors (self-control and knowledge of IS security threats/risks and their potential consequences) and situational factors (security, education, training, and awareness (SETA) programs and computer monitoring) in reducing employee participation in RCySecB. Data was collected from a survey of working professionals in India, and relevant hypotheses were formulated. The PLS technique was used for data analysis. This study investigated the direct effects of the factors on the dependent construct and analyzed the interacting effects of the constructs as well. The results indicate that all factors reduce employee participation in RCySecB. However, the joint effects of the situational factor elements and the dispositional factor of personal knowledge security threats/risks and their potential consequences were insignificant in the model.

computer science, information systems

Does Deterrence Work in Reducing Information Security Policy Abuse by Employees?

A Meta-Analysis of Deterrence Theory in Information Security Policy Compliance Research

Study on e-government information misuse based on General Deterrence Theory

Study on the Impact of Security Countermeasures on E-Government Information Misuse

Deterrence and prevention-based model to mitigate information security insider threats in organisations

Does One Size Fit All? Examining the Differential Effects of IS Security Countermeasures

A meta-analysis of the deterrence theory in security-compliant and security-risk behaviors

Information Security Policy Noncompliance: an Integrative Social Influence Model.

Violation with Concerns of Safety: A Study on Non-Compliant Behavior and the Antecedent and Consequent Effects in Power Grid Construction

Cognitive Elaboration on Potential Outcomes and Its Effects on Employees' Information Security Policy Compliance Intention-Exploring the Key Antecedents.

The Empirical Study of Active Countermeasures Deterrence Impact on Internal E-Government Information Security

Taking Promotion and Prevention Mechanisms Matter for Information Systems Security Policy in Chinese SMEs

Leveraging fairness and reactance theories to deter reactive computer abuse following enhanced organisational information security policies: an empirical study of the influence of counterfactual reasoning and organisational trust

Hospital Staff’s Adherence to Information Security Policy: A Quest for the Antecedents of Deterrence Variables

The Role of Rational Calculus in Controlling Individual Propensity Toward Information Security Policy Non-Compliance Behavior.

An Investigation of Employees' Intention to Comply with Information Security System—A Mixed Approach Based on Regression Analysis and fsQCA

Impact of negative emotions on violations of information security policy and possible mitigations

From hindrance to challenge

It ain't my business: a coping perspective on employee effortful security behavior.

Research on Privacy-by-Design Behavioural Decision-Making of Information Engineers Considering Perceived Work Risk

Effects of Security Knowledge, Self-Control, and Countermeasures on Cybersecurity Behaviors