Abstract:Despite widespread agreement among practitioners and academicians that organizational insiders are a significant threat to organizational information systems security, insider computer abuse (ICA)—unauthorized and deliberate misuse of organizational information resources by organizational insiders—remains a serious issue. Recent studies have shown that most employees are willing to share confidential or regulated information under certain circumstances and nearly a third to half of major security breaches are tied to insiders. These trends indicate that organizational security efforts, which generally focus on deterrence and sanctions, have yet to effectively address ICA. Therefore, leading security researchers and practitioners have called for a more nuanced understanding of insiders in respect to deterrence efforts. We answer these calls by proposing a middle-range theory of ICA that focuses on understanding the inherent tensions between insider motivations and organizational controls. Our careful review distinguishes two categories of personal motives for ICA: (1) instrumental (i.e., financial benefits) (2) and expressive (i.e., psychological contract violations) motives. Our novel theory of ICA also includes the influence of two classes of controls for ICA: (1) intrinsic (i.e., self-control) and (2) extrinsic (i.e., organizational deterrence) controls. We developed and empirically examined a research model based on our middle-range theory that explains a substantial portion of the variance in ICA (R2 = 0.462). Specifically, our results indicate that both instrumental and expressive motives were positively related to ICA. Moreover, intrinsic self-control exerted significant direct and moderating influences in our research model, whereas extrinsic organizational deterrence failed to exhibit a direct effect on ICA and significantly moderated instrumental motives’ relationship with ICA only. Not only do our results show that self-control exerted a stronger effect on the model than deterrence did (f2self-control = 0.195; f2org.det. = 0.048) but they also help us identify the limits of deterrence in ICA research.

Organizational information security as a complex adaptive system: insights from three agent-based models

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

Cyber Defense as a Complex Adaptive System: A model-based approach to strategic policy design

The effects of knowledge mechanisms on employees' information security threat construal

Building Security Awareness of Interdependent Services, Business Processes, and Systems in Cyberspace

A situation awareness model for information security risk management

Basics of Adaptive Information Security Systems

A comprehensive model of information security factors for decision-makers

Ontology Based Modeling for Information Security Management

Using Agent-Based Models for Analyzing Threats to Financial Stability

Information Security Strategy in Organisations: Review, Discussion and Future Research Directions

Development of an Information Security Management Model for Enterprise Automated Systems

A Collaborative Framework for Information Security Management System Using Intelligent Multi-Agent

Organizational information security policies: a review and research framework

Adversarial Organization Modeling for Network Attack/Defense

A Generalized Information Security Model SOCMD for CMD Systems

An integrated system theory of information security management

Insider Threat Modeling: An Adversarial Risk Analysis Approach

Deterrence and prevention-based model to mitigate information security insider threats in organisations

The Strategy Detection on Information Security in Corporate Organizations on Crucial Asset

Going Beyond Deterrence: A Middle-Range Theory of Motives and Controls for Insider Computer Abuse