Understanding Nonmalicious Security Violations in the Workplace: A Composite Behavior Model

• 成果类型: Article
• 署名作者: Guo, Ken H.; Yuan, Yufei; Archer, Norman P.; Connelly, Catherine E.
• 署名单位: Western New England University; McMaster University
• 刊物名称: JOURNAL OF MANAGEMENT INFORMATION SYSTEMS
• ISSN/ISSBN: 0742-1222
• DOI: 10.2753/MIS0742-1222280208
• 发表日期: 2011
• 页码: 203-236
• 关键词: information-technology acceptance; policy compliance; computer abuse; systems; IDENTITY; ORGANIZATIONS; CONSTRUCTION; deterrence; management; pressures

摘要

End users are said to be the weakest link in information systems (IS) security management in the workplace. They often knowingly engage in certain insecure uses of IS and violate security policies without malicious intentions. Few studies, however, have examined end user motivation to engage in such behavior. To fill this research gap, in the present study we propose and test empirically a nonmalicious security violation (NMSV) model with data from a survey of end users at work. The results suggest that utilitarian outcomes (relative advantage for job performance, perceived security risk), normative outcomes (workgroup norms), and self-identity outcomes (perceived identity match) are key determinants of end user intentions to engage in NMSVs. In contrast, the influences of attitudes toward security policy and perceived sanctions are not significant. This study makes several significant contributions to research on security-related behavior by (1) highlighting the importance of job performance goals and security risk perceptions on shaping user attitudes, (2) demonstrating the effect of workgroup norms on both user attitudes and behavioral intentions, (3) introducing and testing the effect of perceived identity match on user attitudes and behavioral intentions, and (4) identifying nonlinear relationships between constructs. This study also informs security management practices on the importance of linking security and business objectives, obtaining user buy-in of security measures, and cultivating a culture of secure behavior at local workgroup levels in organizations.