A meta-analysis of the deterrence theory in security-compliant and security-risk behaviors. Issue 96 (September 2020)

• Record Type: Journal Article
• Authors: Kuo, Kuang-Ming; Talley, Paul C; Huang, Chi-Hsien
• Is Part Of: Computers & security. Issue 96(2020)
• Publication Date: 2020-09
• Subjects: Contextual and methodological moderators -- Deterrence theory -- Random-effects model -- Security-compliant behavior -- Security-risk behavior; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2020.101928
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Deterrence theory has been widely adopted in the study of information security management; however, evidence frequently presents sometimes contradictory results. Prior meta-analytic studies have focused primarily on the use of formal deterrence constructs to predict security-compliant behavior, while informal deterrence constructs and security-risk behavior are often neglected as a result. This study aims to meta-analyze the relationships formed between both formal/informal deterrence constructs and security-compliant/risk behaviors in a comprehensive manner beyond what has taken place in prior IS security meta-analysis based on deterrence theory. By searching multiple electronic databases, we have located 40 studies, along with 108 effect sizes, pertinent to our study's purpose. Inverse variance method weighted with sample sizes was used to determine mean effect sizes. The random-effects model was used to report meta-analysis results since Q, I 2, and H index showed some degree of heterogeneity existent in the collected data. Publication bias was assessed by means of fail-safe N . All proposed relationships occurring between formal/informal deterrence constructs and security-compliant/-risk behaviors were supported. Formal deterrence constructs exerted weak to moderate effects on security behavior, while informal deterrence constructs exerted moderate to strong effects on security behavior. Further, informal deterrence constructs showed greater mean effect sizes than formal deterrence constructs. Additionally, prediction intervals of deterrence constructs, along with detection certainty, included zero, which indicated that moderators may be present. Based on these findings, the mean effect sizes of deterrence constructs may be more clearly identified when dividing security behavior into both compliant- and risk- behaviors. Further moderators might be employed to improve the inconsistent findings evidenced in deterrence theory.