The Empirical Study of Active Countermeasures Deterrence Impact on Internal E-Government Information Security

FAN Jing,ZHANG Peng-zhu

2012-01-01

Abstract:Information security is one of the critical challenges during e-government development.Aimed at internal information misuse,a deterrence impact model of e-government information active security countermeasures was set up based on Security Action Cycle Theory and General Deterrence Theory.

What problem does this paper attempt to address?

Study on e-government information misuse based on General Deterrence Theory

Jing Fan,Pengzhu Zhang

DOI: https://doi.org/10.1109/ICSSSM.2011.5959454

2011-01-01

Abstract:This paper examines four types security countermeasures and their influence on information misuse or abuse behaviors of government internal officials' in the context of e-government information sharing. A research model was developed based on the General Deterrence Theory. Analysis of the data collected in a survey of 21 government agencies in Shanghai with 124 questionnaires who are specialized in the processes of government information sharing, including information collection and storage, information processing, information transfer and information usage. First, the findings indicated that static information security policies only can take effects when the policies are conveyed to employees clearly and the punishment is carried out well. Second, security awareness practice is one of the most important measures for internal officials. Third, when employees realize the organization is monitoring their information system behaviors and know consequence of information misuse or abuse behavior, the countermeasures can play more effects. Fourth, preventative software is still the strongest measure for e-government security.
Study on the Impact of Security Countermeasures on E-Government Information Misuse

Jing Fan,Pengzhu Zhang,Xinjie Zhao

2009-01-01

Abstract:Information security has been a high priority for government agencies nowadays. This study, based on the general deterrence theory, investigates how security countermeasures will result in more effective control of information misuse in government agencies. Data gathered through a survey of 21 government agencies in Shanghai and 124 effective questionnaires were obtained. The results show that security policies and security awareness training will significantly lower information misuse behaviors by increasing the perceived severity of sanctions. Meanwhile,, security monitoring practice will significantly lower information misuse behaviors by increasing the perceived certainty of sanctions. Preventative security software has no effect on perceived certainty and severity of sanction while it will prevent the invading actions directly. Knowledge about these relationships is useful for making key decisions about the security function.
Information Security Game Analysis with Penalty Parameter

Wei Sun,Xiangwei Kong,Dequan He,Xingang You

DOI: https://doi.org/10.1109/ISECS.2008.149

2008-01-01

Abstract:This paper analyzes information security in the E-commerce based on game theory, and this game analysis method is applied to information security for the first time. We set up the information security game model of the defender and the attacker, make the equilibrium analysis of this game model, and get the ideal strategy combination. Then we introduce the penalty parameter of the defender and the penalty parameter of the attacker to solve the problem that the restriction condition is not satisfied. The introduction of the penalty parameter of the defender promotes the defender to invest in information security, and the introduction of the penalty parameter of the attacker promotes the attacker to take no attack strategy. This paper provides good reference for information security in the E-commerce.
Threat and Its Countermeasures of TEMPEST ATTACK on Computer Information Security

刘杰,刘济林

DOI: https://doi.org/10.3321/j.issn:1008-9497.2004.05.013

2004-01-01

Abstract:TEMPEST ATTACK threat on the computer information security is analyzed. The fundamental electromagnetic radiation models are set up. The information leakage problems are discussed in detail. The information eavesdropping caused by TEMPEST ATTACK from computer display units, peripherals host computer, and computer virus are investigated. Finally, some countermeasures are introduced against the TEMPEST ATTACK.
Information Security Policy Noncompliance: an Integrative Social Influence Model.

Kholekile L. Gwebu,Jing Wang,Michael Y. Hu

DOI: https://doi.org/10.1111/isj.12257

2020-01-01

Abstract:Despite the significant advancements made in understanding the factors that drive employees' compliance and noncompliance behaviours with information security policy (ISP), less is known about how different factors interact to impact such behaviours. Having been drawn on the social information processing theory, this research develops an integrative model that investigates how ethical work climate, beliefs, and neutralization interact to jointly explain ISP noncompliance. The model is tested via a survey of a broad cross section of employees. Neutralization, perceived cost of compliance, and perceived cost of noncompliance are found to significantly impact ISP noncompliance. Egoistic, benevolent, and principled climates are found to differentially influence neutralization and individuals' cognitive beliefs about the cost and benefit of ISP compliance versus noncompliance. Neutralization appears to be a more important moderator of the belief‐noncompliance relationship than the principled climate.
Does Deterrence Work in Reducing Information Security Policy Abuse by Employees?

Qing Hu,Zhengchuan Xu,Tamara Dinev,Hong Ling

DOI: https://doi.org/10.1145/1953122.1953142

IF: 22.7

2011-01-01

Communications of the ACM

Abstract:Methods for evaluating and effectively managing the security behavior of employees.
Study on the Effectiveness of the Government Portal Website Performance from the User's View

LIU Yuan,WEI Fang-fang,DENG Hong-jun

DOI: https://doi.org/10.3969/j.issn.1004-6062.2009.04.024

2009-01-01

Abstract:Government portal is an important platform for communication between citizens and government,which makes it to be a core role in the e-government.How to improve the public service and citizen's trust to the government by constructing and reforming the government portals is now a problem concerned by both the government and researchers.This paper constructed a research model based on the review of the theory of information system efficiency,TAM and task technology fit.Then we focused on Zhejiang province government portal,explored the factors those would affect the utility of the government portal from the perspective of the users.According to the conclusions,we give out some countermeasures and suggestions to the related government departments.
Research on Risk Evaluation Model of E-government Information Security Based Onmenace Analysis

CHEN Tao,FENG Ping,ZHU Duogang

DOI: https://doi.org/10.3969/j.issn.1002-1965.2011.08.020

IF: 3.1759

2011-01-01

Journal of Intelligence

Abstract:Information security evaluation is the key of information security management.This article presents an E-government information security risk evaluation model based on Markov and menaces analysis The probability and consequence of the risks are measured using menaces index through Markov and menaces analysis.Then,the importance of risk factors can be determined according to menaces index,which could be applied as the foundation of E-government information security risk management and control strategies.
A Meta-Analysis of Deterrence Theory in Information Security Policy Compliance Research

Simon Trang,Benedikt Brendel

DOI: https://doi.org/10.1007/s10796-019-09956-4

2019-10-25

Information Systems Frontiers

Abstract:Enforcing information security policies is a key concern of information security managers. To deter employees from deviant behavior, organizations often implement sanction mechanisms. However, evidence from research regarding the efficiency of such a deterrence approach has been mixed. Drawing on this inconsistency, this paper examines the applicability of deterrence theory in information security policy compliance research. It is argued that contextual and methodological moderators play a crucial role when conceptualizing deterrence theory in security studies. Applying a meta-analysis, the results suggest that sanctions have an overall effect on deviant behavior. However, the results also indicate that this relationship is dependent on the study's context. Deterrence theory better predicts deviant behavior in malicious contexts, cultures with a high degree of power distance, and cultures with a high uncertainty avoidance. The meta-analysis also reveals no meaningful differences arising from the methodological context in terms of scenario-based and behavior-specific measurement.
A meta-analysis of the deterrence theory in security-compliant and security-risk behaviors

Kuang-Ming Kuo,Paul C Talley,Chi-Hsien Huang

DOI: https://doi.org/10.1016/j.cose.2020.101928

2020-09-01

Abstract:Deterrence theory has been widely adopted in the study of information security management; however, evidence frequently presents sometimes contradictory results. Prior meta-analytic studies have focused primarily on the use of formal deterrence constructs to predict security-compliant behavior, while informal deterrence constructs and security-risk behavior are often neglected as a result. This study aims to meta-analyze the relationships formed between both formal/informal deterrence constructs and security-compliant/risk behaviors in a comprehensive manner beyond what has taken place in prior IS security meta-analysis based on deterrence theory. By searching multiple electronic databases, we have located 40 studies, along with 108 effect sizes, pertinent to our study's purpose. Inverse variance method weighted with sample sizes was used to determine mean effect sizes. The random-effects model was used to report meta-analysis results since Q, I2, and H index showed some degree of heterogeneity existent in the collected data. Publication bias was assessed by means of fail-safe N. All proposed relationships occurring between formal/informal deterrence constructs and security-compliant/-risk behaviors were supported. Formal deterrence constructs exerted weak to moderate effects on security behavior, while informal deterrence constructs exerted moderate to strong effects on security behavior. Further, informal deterrence constructs showed greater mean effect sizes than formal deterrence constructs. Additionally, prediction intervals of deterrence constructs, along with detection certainty, included zero, which indicated that moderators may be present. Based on these findings, the mean effect sizes of deterrence constructs may be more clearly identified when dividing security behavior into both compliant- and risk- behaviors. Further moderators might be employed to improve the inconsistent findings evidenced in deterrence theory.

computer science, information systems
Research on Successful Factors Model of Information Sharing Across Government Agencies under E-government

FAN Jing,ZHANG Peng-zhu

DOI: https://doi.org/10.3969/j.issn.1007-7634.2007.07.027

2007-01-01

Abstract:The key of E-government development is how to integrate,apply and manage government information resource and solve isolated information systems.Therefore,it is an important mission to strengthen information sharing across government agencies at present.Based on literature and field study,seven factors are induced including legal and policy,program championship agencies,trust across agencies,manager support,technology support,operation cost and process traceability.A successful factors model is set up and validated through empirical study.Meanwhile,it is also studied the difference information sharing conditions with different government hierarchies.
Does One Size Fit All? Examining the Differential Effects of IS Security Countermeasures

John D’Arcy,Anat Hovav

DOI: https://doi.org/10.1007/s10551-008-9909-7

IF: 6.331

2008-08-27

Journal of Business Ethics

Abstract:Research from the fields of criminology and social psychology suggests that the deterrent effect of security countermeasures is not uniform across individuals. In this study, we examine whether certain individual characteristics (i.e., computer self-efficacy) or work arrangement (i.e., virtual status) moderate the influence of␣security policies, security education, training, and awareness (SETA) program, and computer monitoring on information systems misuse. The results suggest that computer savvy individuals are less deterred by SETA programs and computer monitoring, while these countermeasures are also less influential (from a deterrence perspective) on employees that spend more working days outside the office. Implications for both the research and practice of information security are discussed.

business,ethics
Impact Antecedents of E-Government Content Service Capability: an Exploratory Empirical Study

Guangwei Hu,Wenwen Pan,Jie Wang,Jin Shi

DOI: https://doi.org/10.1109/bcgin.2011.55

2011-01-01

Abstract:With the development of e-government (e-gov), it is continuously discussed on how to enhance the effectiveness and efficiency of e-gov service (EGS) at a suitable cost. The purpose of this article is to develop the theoretical links from the capability management views and empirically examine the associations between capability antecedents and e-government content service capability (CSC). Then empirical investigations on the proposed models and related hypotheses were carried out using CFA based on observed data. Furthermore, structural equation model (SEM) was adopted to explore the impact paths. The paths analysis results might have some practical values to management and improvement of EGS capability.
Internet Aggression in Online Communities: a Contemporary Deterrence Perspective

Bo Xu,Zhengchuan Xu,Dahui Li

DOI: https://doi.org/10.1111/isj.12077

IF: 7.767

2015-01-01

Information Systems Journal

Abstract:Internet users' activities are critical to the development and success of Web 2.0 systems, such as online communities. Within the community's participation, knowledge sharing, and communications, users may conduct aggressive behaviors that would have a negative impact on that online community. This study investigates factors that affect Chinese users' aggression intention in online communities. Research findings show that online aggression can be inhibited by internal deterrents of face saving and moral beliefs, which may be enhanced through implementation of consequences from an effective community policy and peer pressure among community members. Differences in the effects of the deterrence measures exist between younger and older users. This paper contributes theoretically and empirically to Web 2.0 research and has practical implications for virtual community management.
Deterrence and prevention-based model to mitigate information security insider threats in organisations

Nader Sohrabi Safa,Carsten Maple,Steve Furnell,Muhammad Ajmal Azad,Charith Perera,Mohammad Dabbagh,Mehdi Sookhak

DOI: https://doi.org/10.1016/j.future.2019.03.024

IF: 7.307

2019-08-01

Future Generation Computer Systems

Abstract:Previous studies show that information security breaches and privacy violations are important issues for organisations and people. It is acknowledged that decreasing the risk in this domain requires consideration of the technological aspects of information security alongside human aspects. Employees intentionally or unintentionally account for a significant portion of the threats to information assets in organisations. This research presents a novel conceptual framework to mitigate the risk of insiders using deterrence and prevention approaches. Deterrence factors discourage employees from engaging in information security misbehaviour in organisations, and situational crime prevention factors encourage them to prevent information security misconduct. Our findings show that perceived sanctions certainty and severity significantly influence individuals’ attitudes and deter them from information security misconduct. In addition, the output revealed that increasing the effort, risk and reducing the reward (benefits of crime) influence the employees’ attitudes towards prevent information security misbehaviour. However, removing excuses and reducing provocations do not significantly influence individuals’ attitudes towards prevent information security misconduct. Finally, the output of the data analysis also showed that subjective norms, perceived behavioural control and attitude influence individuals’ intentions, and, ultimately, their behaviour towards avoiding information security misbehaviour.
Tension between the safe flow of government data across organizational boundaries and fragmentations in secure collaboration: the Chinese e-government

Zijun Mao,Yuqi Zhu

DOI: https://doi.org/10.1108/ajim-10-2022-0461

IF: 1.935

2023-04-12

Aslib Journal of Information Management

Abstract:PurposeThe study focuses on influential factors of collaboration on government data security by the Chinese government.Design/methodology/approachThe article explores the case of e-government in the Chinese centralized unitary state system context, using a structured–pragmatic–situational (SPS) approach and the boundary theory as an analytical lens.FindingsThe findings indicate that e-government operates in highly interconnected environments where the safe flow of government data requires collaborative and cross-boundary strategies. Any organization is a potential “weakest link”. In addition, collaboration is fragmented by ambiguous accountability and organizational inertia across government departments, resources differences and limited visibility and measurability of security efforts across government levels and conflicts and uncertainties in principal–agent relationships. The solutions for those obstacles are also discussed from the multi-function, multi-level and multi-actor dimensions, respectively. A multi-dimensional overarching security model for the flow of government data is proposed.Originality/valueThe study advances the technology-oriented micro-analysis of previous studies on government data security to cross-organizational revealing at the macrolevel by connecting streams of research in information systems and public administration. These findings will contribute to making the safe flow of government data more resilient in the transformation of e-government.

Computer Science,Political Science
Threats and countermeasures for information system security: A cross-industry study

Quey-Jen Yeh,Arthur Jung-Ting Chang

DOI: https://doi.org/10.1016/j.im.2007.05.003

2007-07-01

Abstract:IS security threats have increased significantly in recent years. We identified the gaps between manager perceptions of IS security threats and the security countermeasures adopted by firms by collecting empirical data from 109 Taiwanese enterprises. Industry type and organizational use of IT were seen as the two factors that affected the motivation of firms to adopt security countermeasures, but their implementation did not necessarily affect the threat perceptions of the managers. Analyses of responses suggested that the scope of the countermeasures adopted were not commensurate with the severity of the perceived threats. Among the threats, networks were rated as contributing the most severe threat and yet had the lowest level of protection, this was followed by threats due to personnel and administrative issues. We therefore addressed threat mitigation strategies, specifically in terms of the differences between industries.

information science & library science,management,computer science, information systems
Leveraging fairness and reactance theories to deter reactive computer abuse following enhanced organisational information security policies: an empirical study of the influence of counterfactual reasoning and organisational trust

Paul Benjamin Lowry,Clay Posey,Rebecca J. Bennett,Tom L. Roberts,Rebecca Becky J. Bennett

DOI: https://doi.org/10.1111/isj.12063

IF: 7.767

2015-02-24

Information Systems Journal

Abstract:Research shows that organisational efforts to protect their information assets from employee security threats do not always reach their full potential and may actually encourage the behaviours they attempt to thwart, such as reactive computer abuse (CA). To better understand this dilemma, we use fairness theory (FT) and reactance theory (RT) to explain why employees may blame organisations for and retaliate against enhanced information security policies (ISPs). We tested our model with 553 working professionals and found support for most of it. Our results show that organisational trust can decrease reactive CA. FT suggests that explanation adequacy (EA) is an important factor that builds trust after an event. Our results also suggest that trust both fully mediates the relationship between EA and CA and partially mediates the relationship between perceived freedom restrictions related to enhanced ISPs and reactive CA. EA also had a strong negative relationship with freedom restrictions. Moreover, organisational security education, training and awareness (SETA) initiatives decreased the perceptions of external control and freedom restrictions and increased EA, and advance notification of changes increased EA. We also included 14 control variables and rival explanations to determine with more confidence what drove reactive CA in our context. Notably, the deterrence theory (DT)‐based constructs of sanction severity, certainty and celerity had no significant influence on reactive CA. We provide support for the importance of respectful communication efforts and SETA programmes, coupled with maximising employee rights and promoting trust and fairness to decrease reactive CA. These efforts can protect organisations from falling victim to their own organisational security efforts.

information science & library science
E-Government Information Security Risk Assessment Research

Lei Ping,Lei Zhanbo

2010-01-01

Abstract:In this study, based on the study of information security risk assessment, make a deep research of the E-government information security risk assessment by comparing the analysis of the relevant standards, make a improvements of the assessment model elements of the E-government information security risk, then through the form of expert advice to complete the content validity of the indicators of the detection, the lower indicators validity of the structure were removed. As the E-government information security risks are difficult to quantify the characteristics, the study integrated the AHP model and the Fuzzy model to build the Fuzzy-AHP model to assess the level of E-government information security risks, And by building a new method, we realized the E-government information security risk assessment.
Cognitive Elaboration on Potential Outcomes and Its Effects on Employees' Information Security Policy Compliance Intention-Exploring the Key Antecedents.

Xue Yang,Wei T. Yue,Choon Lin Sia

DOI: https://doi.org/10.1007/978-3-642-29873-8_17

2012-01-01

Abstract:IS security policy is one of the essential tools to ensure the secure use of information systems and technological assets. To enhance the effectiveness of policy implementation, organizations rely on security training, education and awareness (STEA) programs to help employees understand the IS security issues of the organization. However, different levels of STEA informativeness may have conflicting effects on employees' compliance decisions. In addition, the urgency of a task may also lead employees to abandon the compliance decision occasionally. The existing corporate information security policy (ISP) could also serve as a deterrence message that would influence compliance decisions. An experimental survey was conducted to examine this phenomenon and test the related hypotheses. The results of this study can be used to inform and guide researchers and practitioners as to how to better enforce an IS security policy through better implementation of STEA programs and improved design of ISP in different task scenarios.

The Empirical Study of Active Countermeasures Deterrence Impact on Internal E-Government Information Security

Study on e-government information misuse based on General Deterrence Theory

Study on the Impact of Security Countermeasures on E-Government Information Misuse

Information Security Game Analysis with Penalty Parameter

Threat and Its Countermeasures of TEMPEST ATTACK on Computer Information Security

Information Security Policy Noncompliance: an Integrative Social Influence Model.

Does Deterrence Work in Reducing Information Security Policy Abuse by Employees?

Study on the Effectiveness of the Government Portal Website Performance from the User's View

Research on Risk Evaluation Model of E-government Information Security Based Onmenace Analysis

A Meta-Analysis of Deterrence Theory in Information Security Policy Compliance Research

A meta-analysis of the deterrence theory in security-compliant and security-risk behaviors

Research on Successful Factors Model of Information Sharing Across Government Agencies under E-government

Does One Size Fit All? Examining the Differential Effects of IS Security Countermeasures

Impact Antecedents of E-Government Content Service Capability: an Exploratory Empirical Study

Internet Aggression in Online Communities: a Contemporary Deterrence Perspective

Deterrence and prevention-based model to mitigate information security insider threats in organisations

Tension between the safe flow of government data across organizational boundaries and fragmentations in secure collaboration: the Chinese e-government

Threats and countermeasures for information system security: A cross-industry study

Leveraging fairness and reactance theories to deter reactive computer abuse following enhanced organisational information security policies: an empirical study of the influence of counterfactual reasoning and organisational trust

E-Government Information Security Risk Assessment Research

Cognitive Elaboration on Potential Outcomes and Its Effects on Employees' Information Security Policy Compliance Intention-Exploring the Key Antecedents.