NDLI: Technical opinionAre employees putting your company at risk by not following information security policies?

Please wait, while we are loading the content...

Technical opinionAre employees putting your company at risk by not following information security policies?

Content Provider	ACM Digital Library
Author	Mahmood, M. Adam Pahnila, Seppo Siponen, Mikko
Abstract	Introduction Careless employees, who do not follow information security policies, constitute a serious threat to their organization. We conducted a field survey in order to understand which factors help towards employees' compliance with these security policies. Our research shows that the visibility of the desired practices and normative expectations of peers will provide a solid foundation towards employees complying with these policies. Our research also shows that if employees realize how vulnerable their organization is to security threats and the severity of these threats, they are likely to have a strong intention to comply with information security policies. Finally, employees' self-efficacy and response efficacy motivate them to comply with these policies. This article provides an information security strategic plan that puts together various best practices we found in our survey and that shows how these practices can be used to alleviate employees' non-compliance with organizational security policies. Information security breaches can cause serious damage to organizations. Such breaches can harm irreparably by shutting down computers forcing businesses to loose potential revenues or by leaking corporate confidential information and customer data possibly making corporations vulnerable to legal and regulatory problems and bad $publicity.^{4,5}$ Most organizations encounter more than one information security breaches in a given $year.^{2}$ Prior information security research studies suggest that 91% of organizations' own employees frequently fail to adhere to information security $policies^{2}$ paving the way for such breaches. To tackle this situation, a number of suggestions have been made in the literature to help ensure employees' compliance with security policies. Commentators have, however, pointed out a serious of weaknesses in the existing approaches. They suggest that these approaches lack empirical evidence on their effectiveness in practice. Because practitioners need empirically validated information, it is extremely important that we study employees' non-compliance with information security policies using field research. In order to understand why employees are careless about following security policies and which factors are important toward employees' compliance with these policies, we conducted a field survey of information security professionals from five Finnish companies operating in different lines of business. The survey instrument was developed based on a theoretical model developed from behavioral theories including the Theory of Reasoned $Action^{1}$ and the Protection Motivation $Theory.^{3}$ Since employees' compliance with information security policies is ultimately a psychological phenomenon; we find these theories useful in understanding how organizations can help their employees comply with these security policies. We show how these theories can be useful in offering a new and practical insight into what motivates employees to comply with these policies. Some 3130 employees from four Finnish corporations were asked to fill out a Web-based information security instrument. Of these, 919 filled out the questionnaire resulting in a 29.4% response rate. The demographic data, among the respondents, show that the number of male (56.1%) and female (43.1%) are fairly evenly distributed. In order to test our model, we analyzed the field survey responses using factor analysis and multiple regression analysis. All constructs were found to have an acceptable level of reliability and validity confirming soundness of the measuring instrument.
Starting Page	145
Ending Page	147
Page Count	3
File Format	PDF
ISSN	00010782 15577317
DOI	10.1145/1610252.1610289
Journal	Communications of the ACM (CACM)
Volume Number	52
Issue Number	12
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2005-08-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Content Type	Text
Resource Type	Article
Subject	Computer Science Computer Science

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Does deterrence work in reducing information security policy abuse by employees?

Give your Company

Security: technical, social, and legal challenges

Enforceable security policies

Enforceable Security Policies Revisited

Information security and risk management

Not Your Father's PBX?

Information security: threat from employees

Measuring Risk: Computer Security Metrics, Automation, and Learning

Technical opinionAre employees putting your company at risk by not following information security policies?

Similar Documents

Does deterrence work in reducing information security policy abuse by employees?

Give your Company

Security: technical, social, and legal challenges

Enforceable security policies

Enforceable Security Policies Revisited

Information security and risk management

Not Your Father's PBX?

Information security: threat from employees

Measuring Risk: Computer Security Metrics, Automation, and Learning

Technical opinionAre employees putting your company at risk by not following information security policies?