Abstract:Despite widespread agreement among practitioners and academicians that organizational insiders are a significant threat to organizational information systems security, insider computer abuse (ICA)—unauthorized and deliberate misuse of organizational information resources by organizational insiders—remains a serious issue. Recent studies have shown that most employees are willing to share confidential or regulated information under certain circumstances and nearly a third to half of major security breaches are tied to insiders. These trends indicate that organizational security efforts, which generally focus on deterrence and sanctions, have yet to effectively address ICA. Therefore, leading security researchers and practitioners have called for a more nuanced understanding of insiders in respect to deterrence efforts. We answer these calls by proposing a middle-range theory of ICA that focuses on understanding the inherent tensions between insider motivations and organizational controls. Our careful review distinguishes two categories of personal motives for ICA: (1) instrumental (i.e., financial benefits) (2) and expressive (i.e., psychological contract violations) motives. Our novel theory of ICA also includes the influence of two classes of controls for ICA: (1) intrinsic (i.e., self-control) and (2) extrinsic (i.e., organizational deterrence) controls. We developed and empirically examined a research model based on our middle-range theory that explains a substantial portion of the variance in ICA (R2 = 0.462). Specifically, our results indicate that both instrumental and expressive motives were positively related to ICA. Moreover, intrinsic self-control exerted significant direct and moderating influences in our research model, whereas extrinsic organizational deterrence failed to exhibit a direct effect on ICA and significantly moderated instrumental motives’ relationship with ICA only. Not only do our results show that self-control exerted a stronger effect on the model than deterrence did (f2self-control = 0.195; f2org.det. = 0.048) but they also help us identify the limits of deterrence in ICA research.

Leveraging fairness and reactance theories to deter reactive computer abuse following enhanced organisational information security policies: an empirical study of the influence of counterfactual reasoning and organisational trust

Information Security Policy Noncompliance: an Integrative Social Influence Model.

Effects of Security Knowledge, Self-Control, and Countermeasures on Cybersecurity Behaviors

Going Beyond Deterrence: A Middle-Range Theory of Motives and Controls for Insider Computer Abuse

From hindrance to challenge

The effects of knowledge mechanisms on employees' information security threat construal

Assessing the Moderating Effect of Security Technologies on Employees Compliance with Cybersecurity Control Procedures

Cyberloafing in the Workplace: Mitigation Tactics and Their Impact on Individuals’ Behavior

Cognitive‐affective drivers of employees' daily compliance with information security policies: A multilevel, longitudinal study

A Meta-Analysis of Deterrence Theory in Information Security Policy Compliance Research

Cognitive Elaboration on Potential Outcomes and Its Effects on Employees' Information Security Policy Compliance Intention-Exploring the Key Antecedents.

Can I Help Prevent Data Breaches in the Workplace? from Routine Activities to Extra-Role Security Behaviors

Deterrence and prevention-based model to mitigate information security insider threats in organisations

The impact of an employee's psychological contract breach on compliance with information security policies: intrinsic and extrinsic motivation

Information security policies compliance in a global setting: An employee's perspective

Does One Size Fit All? Examining the Differential Effects of IS Security Countermeasures

Believe It or Not: Employees Intend to Comply With Information Security Policy Because of the Desire for Trade-Offs

Employees' Intention to Comply with Information Security Policies: The Impacts of Loafing and Commitment

A meta-analysis of the deterrence theory in security-compliant and security-risk behaviors

Trust, and high control: an exploratory study of Counterproductive Work Behaviour in a high security organization

Examining the effects of cognitive load on information systems security policy compliance