Results

Found 36 articles

Clear filters

An Adversarial Dance: Toward an Understanding of Insiders’ Responses to Organizational Information Security Measures
PDF
2023 | Journal of the Association for Information Systems | Citations: 0
Authors: Balozian, Puzant; Burns, A.; Leidner, Dorothy

Abstract: Despite the increased focus on organizational security policies and programs, s ... Expand

Abstract: Despite the increased focus on organizational security policies and programs, some employees continue to engage in maladaptive responses to security measures (i.e., behaviors other than those recommended, intended, or prescribed). To help shed light on insiders' adaptive and maladaptive responses to IS security measures, we conducted a case study of an organization at the forefront of security policy initiatives. Drawing on the beliefs-actions-outcomes (BAO) model to analyze our case data, we uncover a potentially nonvirtuous cycle consisting of security-related beliefs, actions, and outcomes, which we refer to as an "adversarial dance." Explaining our results, we describe a novel belief framework that identifies four security belief profiles and uncovers an underexplored outcome of IS security: insiders' lived security experiences. We find that individuals' unfavorable lived security experiences produce counterproductive security-related beliefs that, in turn, lead to maladaptive behaviors. Maladaptive behaviors create new potential for security risk, leading to increased organizational security measures to counter them. Thus, the adversarial dance continues, as the new security measures have the potential to reinforce counterproductive security-related beliefs about the importance and risk of IS security and lead to new maladaptive behaviors. To help situate our findings within the current security literature, we integrate the results with prior research based on extant theories. While this paper is not the first to suggest that security measures can elicit maladaptive behaviors, the emergent belief framework and expanded BAO model of IS security constitute an important contribution to the behavioral IS security literature.Puzant Balozian is an assistant professor of computer information systems at James Madison University. His research focus is primarily on the impacts of organizational factors on individual user behaviors in the context of information security and privacy and addressing security policy compliance and violation. Collapse

Semantic filters: neutralization theory

Topics: IT security IT security defense productivity IT security threat anonymity

Methods: case study qualitative interview personal interview theory development survey

Theories: information systems theory neutralization theory behavioral theory
“This Is the Future of Advertising!” Or Is It? New Insights into the Justifiability of Deceptive Crowdwork in Cyberspace
PDF
2022 | HICSS | Citations: 0
Authors: Kauppila, Santtu; Soliman, Wael

Abstract: Unlike classical forms of deception where the deceiver deceives their victims di ... Expand

Abstract: Unlike classical forms of deception where the deceiver deceives their victims directly, the crowdsourcing of cyber deception provides a powerful and cost-effective mechanism for deceivers to create and spread falsehood from the shadows. But for a mass deception campaign to be effective, the crowdworkers must rationalize (and willingly accept) their role in the deceptive act. What, then, could justify participation in a mass-deception campaign? To answer this question, we adopt the qualitative vignette approach and utilize neutralization theory as our guiding lens. Our results point to several neutralization techniques that crowdworkers could invoke to convincingly rationalize involvement in a cyber deception campaign. Importantly, the findings shed new light on a growing pessimism about work ethics in cyberspace which may lead some ordinary people into joining deception campaigns, believing it to be the future of advertising. We discuss the theoretical and practical implications of these novel insights. Collapse

Semantic filters: neutralization theory

Topics: social media crowdsourcing social norm advertising management

Methods: qualitative interview personal interview

Theories: neutralization theory
How Do Individuals Justify and Rationalize their Criminal Behaviors in Online Romance Fraud?
PDF
2022 | Information Systems Frontiers | Citations: 0
Authors: Offei, Martin; Andoh-Baidoo, Francis Kofi; Ayaburi, Emmanuel W.; Asamoah, David

Abstract: Online romance fraud (ORF) is a growing concern with such serious negative conse ... Expand

Abstract: Online romance fraud (ORF) is a growing concern with such serious negative consequences as financial loss or suicide to the victim. Majority of empirical studies on online romance fraud using attachment, deception, protection motivation and relation theories focus on the victim. While neutralization offers insights into how individuals justify their deviant behaviors, the results have not been consistent in different contexts. In the ORF context, offenders may not only rely on justifying techniques but also rationalize their actions by denying risk both to the victim and the offender. Thus, drawing from the neutralization and denial of risk theories, we develop a research model to explain how online romance offenders justify and rationalize their intended criminal activities. To confirm our theoretical model, we collected 320 responses from individuals at Internet Cafés alleged to be online romance fraud hotspots. Our results highlight the boundary conditions of neutralization techniques in the context of online romance fraud. The study shows that denial of risk, a rationalization mechanism, moderates the relationship between denial of victim, a justification technique, and intention to commit romance fraud. This insight advances the frontiers of neutralization theory. We offer both theoretical and managerial implications of the findings. Collapse

Semantic filters: neutralization theory

Topics: criminality internet technology online dating internet fraud information security policy violation

Methods: psychometrics structural equation modeling theory development data transformation SEM tool

Theories: neutralization theory
New Insights into the Justifiability of Organizational Information Security Policy Noncompliance: A Case Study
PDF
2022 | HICSS | Citations: 0
Authors: Soliman, Wael; Mohammadnazar, Hojat

Abstract: Information security policies as apparatus for communicating security principles ... Expand

Abstract: Information security policies as apparatus for communicating security principles with employees are the cornerstone of organizational information security. Resultantly, extant literature has looked at different theories to better understand the noncompliance problem. Neutralization theory is emerging as one of the most popular approaches, not only as an explanation but also as a solution. In this in-depth qualitative study, we ask the question ‘how do employees justify violating the ISP’? Our findings reveal nine rationalizing techniques, three of which have not been recognized in previous research. We label them ‘I follow my own rules’, ‘matter of mere legality’ and ‘defense of uniqueness’. But more importantly, our in-depth insights point to the danger of taking these rationalizations out of context, since without context, it becomes impossible to judge whether the behavior or the rule, needs correcting, reflecting a dilemma recognized in the original writing of neutralization theory, which has since been forgotten. Collapse

Semantic filters: neutralization theory

Topics: data security information system use anonymity IT security threat communication service infrastructure

Methods: qualitative interview cross sectional research longitudinal research

Theories: neutralization theory
Organizational Cybersecurity: Advanced Cyber Defense, Cyber Analytics, and Security Minitrack Overview

2022 | HICSS | Citations: 0
Authors: Steiner, Stuart; Plachkinova, Miloslava; Shepherd, Morgan; de Leon, Daniel Conte

Abstract: Cybersecurity touches all aspects of organizational management, with organizatio ... Expand

Abstract: Cybersecurity touches all aspects of organizational management, with organizational systems, networks and critical infrastructures increasingly targeted by determined malicious actors with advanced skills and resources. Such attacks have the potential for major disruption of our society including damage to assets, people, and the environment. Organizations, of all sizes and at all levels, are faced with the challenge of continuously, effectively, and efficiently protecting their systems while enabling and ensuring their mission. Organizational cybersecurity aims to advance knowledge on the theory and practice of cybersecurity management. Collapse

Semantic filters: neutralization theory

Topics: IT security innovation management IT security threat digital innovation intrinsic motivation

Methods: qualitative interview design artifact personal interview

Theories: neutralization theory
Combatting the Neutralization of Security Policy Violations: Insights from the Healthcare Sector

2021 | European Conference On Information Systems | Citations: 0
Authors: Frank, Muriel

Abstract: Employees who do not adhere to security policies and regulations are a major co ... Expand

Abstract: Employees who do not adhere to security policies and regulations are a major concern for today's organizationsespecially in the healthcare sector. Prior research revealed that individuals often use neutralization techniques to justify their non-compliant security behaviors. It therefore seems requisite to investigate how to overcome such rationalizations and how to strengthen an individual's intent to follow security rules. Building on both neutralization theory and relational coordination theory, we propose a theoretical model linking the quality of relational ties to coping responses and information security policy violations. With the help of 199 young healthcare professionals, we provide evidence that factors like sharing the same goal and mutual respect can significantly reduce the usage of neutralization techniques. Our results add to the growing body of behavioral information security research and offer new insights on the impact of relationships in the workplace. Collapse

Semantic filters: neutralization theory

Topics: information security policy violation data security IT security threat security policy organizational context

Methods: survey factor analysis data transformation structural equation modeling chi squared test

Theories: coordination theory neutralization theory
High-Risk Deviant Decisions: Does Neutralization Still Play a Role?
PDF
2021 | Journal of the Association for Information Systems | Citations: 0
Authors: Trinkle, Bradley; Warkentin, Merrill; Malimage, Kalana; Raddatz, Nirmalee

Abstract: Extant research has shown that neutralization processes can enable potential IS ... Expand

Abstract: Extant research has shown that neutralization processes can enable potential IS security policy violators to justify their behavior and overcome the deterrence effect of sanctions in order to engage in unethical behaviors. However, such sanctions are typically moderate and not career ending. We test the boundary conditions of this theory by evaluating whether neutralization plays a role in overcoming the impact of extreme levels of deterrence. We extend the Siponen and Vance (2010) framework within a professional context that assigns extreme sanctions to violators. Using the scenario-based factorial survey method common in IS security research, we collected data from future auditors who understand these extreme sanctions. We test the reasons that auditors may use to form intentions to falsify information concerning an information security issue with a company's accounting information system, thereby jeopardizing data integrity and security by modifying working papers to hide irregularities and, by doing so, violating their professional standards, which could result in career-ending sanctions. We empirically validated and tested the theoretical model. Our results show that sanctions play an important role in reducing employees' intentions to violate policy but that, even under extreme boundary conditions, employees might seek to rationalize their unethical behavior by denying responsibility for their actions through, for example, arguing that their supervisors pressured them into performing the violations. We also establish that messages heightening the awareness and perceptions of the certainty and severity of organizational punishment are likely to attenuate such deviant behaviors. We discuss the implications of these findings and suggest future avenues for research. Collapse

Semantic filters: neutralization theory

Topics: behavioral intention accounting IT career IT security threat accounting information system

Methods: survey hierarchical linear modeling statistical hypothesis test experiment experimental design

Theories: deterrence theory neutralization theory behavioral theory general deterrence theory protection motivation theory
Information security policy noncompliance: An integrative social influence model
PDF
2020 | Information Systems Journal | Citations: 12
Authors: Gwebu, Kholekile L.; Wang, Jing; Hu, Michael Y.

Abstract: Despite the significant advancements made in understanding the factors that driv ... Expand

Abstract: Despite the significant advancements made in understanding the factors that drive employees' compliance and noncompliance behaviours with information security policy (ISP), less is known about how different factors interact to impact such behaviours. Having been drawn on the social information processing theory, this research develops an integrative model that investigates how ethical work climate, beliefs, and neutralization interact to jointly explain ISP noncompliance. The model is tested via a survey of a broad cross section of employees. Neutralization, perceived cost of compliance, and perceived cost of noncompliance are found to significantly impact ISP noncompliance. Egoistic, benevolent, and principled climates are found to differentially influence neutralization and individuals' cognitive beliefs about the cost and benefit of ISP compliance versus noncompliance. Neutralization appears to be a more important moderator of the belief-noncompliance relationship than the principled climate. Collapse

Semantic filters: neutralization theory

Topics: data security financial performance anonymity internet technology electronic mail

Methods: survey partial least squares path modeling theory development cross sectional research post-hoc analysis

Theories: social information processing theory neutralization theory theory of reasoned action
Taking it out on IT: A Mechanistic Model of Abusive Supervision and Computer Abuse

2020 | HICSS | Citations: 1
Authors: Nehme, Alaa; George, Joey F

Abstract: One salient issue in organizational information security is computer abuse. Draw ... Expand

Abstract: One salient issue in organizational information security is computer abuse. Drawing on the management literature, we identify abusive supervision as a potential factor that affects the latter. As such, this paper proposes a model that formulates why subordinates commit computer abuse in response to abusive supervision. The model focuses on the mechanism of displacing aggression in retaliating against the organization. Drawing upon neutralization and deterrence theories and grounded in appraisal theory, the model offers several propositions. Most notably, the model identifies an interplay among the relevant appraisals, the emotion of anger, neutralization, deterrence and computer abuse. The model also incorporates two conditional moderators, including supervisor’s organization embodiment and controllability. The specific propositions and implications are discussed. Collapse

Semantic filters: neutralization theory

Topics: IT security threat data security

Methods: theory development

Theories: appraisal theory neutralization theory deterrence theory general deterrence theory
Editorial: A Brief Retrospective (2013-2019)
PDF
2020 | Journal of the Association for Information Systems | Citations: 0
Authors: Sarker, Suprateek; Palvia, Prashant; Oguz, Abdullah; Wu, Caven; Xiao, Xiao

Abstract: ... Expand

Abstract: Collapse

Semantic filters: neutralization theory

Topics: privacy information system use systems design health information system electronic commerce

Methods: literature sample theory development grounded theory design theory structured literature research

Theories: privacy calculus theory technology acceptance model actor network theory general systems theory theory of affordance

Page 1 of 4 Next

AIS11

Journals

Conferences

Semantic Filter

Found 36 articles

An Adversarial Dance: Toward an Understanding of Insiders’ Responses to Organizational Information Security Measures

“This Is the Future of Advertising!” Or Is It? New Insights into the Justifiability of Deceptive Crowdwork in Cyberspace

How Do Individuals Justify and Rationalize their Criminal Behaviors in Online Romance Fraud?

New Insights into the Justifiability of Organizational Information Security Policy Noncompliance: A Case Study

Organizational Cybersecurity: Advanced Cyber Defense, Cyber Analytics, and Security Minitrack Overview

Combatting the Neutralization of Security Policy Violations: Insights from the Healthcare Sector

High-Risk Deviant Decisions: Does Neutralization Still Play a Role?

Information security policy noncompliance: An integrative social influence model

Taking it out on IT: A Mechanistic Model of Abusive Supervision and Computer Abuse

Editorial: A Brief Retrospective (2013-2019)