Exploring Personal and Environmental Factors that Can Reduce Nonmalicious Information Security Violations

ABSTRACT

Employee engagement in nonmalicious information security violations (NISVs) is a threat to organizations. The Social Cognitive Theory was used to investigate the effects of personal and environmental factors on the intention to engage in NISVs. Data of 204 working professionals in Germany were used for analysis. Key results showed that personal goal setting, employee organizational commitment, and vicarious learning reduced employees’ intentions to engage in NISVs. Implications of the findings for research and practice were discussed.

KEYWORDS:

• Nonmalicious information security violations
• insider threat
• behavioral information systems security
• employees
• survey
• social cognitive theory

Acknowledgments

The constructive comments provided by two anonymous reviewers of an earlier draft of the manuscript is appreciated. Funding for this research was provided by the Social Sciences and Humanities Research Council of Canada (#2015-423).

Disclosure statement

No potential conflict of interest was reported by the author(s).

Notes

1. A disgruntled employee who damages or sabotages organizational IS is considered a malicious insider threat. An employee who intentionally breaks organizational IS usage policies, but without an intent to harm the organization, is a nonmalicious insider threat. An employee who accidentally enters the wrong data in an online database or clicks on a link in a phishing e-mail is an accidental insider threat. A credential thief tries to get information by claiming to be someone else.

Additional information

Funding

This work was supported by the Social Sciences and Humanities Research Council of Canada (#2015-423).

Notes on contributors

Princely Ifinedo

Princely Ifinedo is a Professor in the Goodman School of Business at Brock University, Canada. He holds a Ph.D. in Information Systems (IS) from University of Jyväskylä, Finland, and an MBA from the Royal Holloway, University of London, UK. His research includes IS security management, E-business, IS adoptions, and IS issues in developing economies. He has presented papers at various international IS conferences, contributed chapters to several books, encyclopedia, and published in reputable journals such as I & M, ISM, IJIM, EIS, CHB, JGIM, JGTIM, ITD, JCIS, JSS, and DATABASE, among others. He is affiliated with AIS and ASAC.