Violators versus non-violators of information security measures in organizations—A study of distinguishing factors. Issue 1 (2nd January 2019)

• Record Type: Journal Article
• Authors: Khan, Habib Ullah; AlShare, Khalid A.
• Is Part Of: Journal of organizational computing and electronic commerce. Volume 29:Issue 1(2019)
• Page Start: 4
• Page End: 23
• Publication Date: 2019-01-02
• Subjects: Information security (IS) -- violators -- non-violators -- information security policy (ISP) -- organizational IT capability; Management -- Data processing -- Periodicals; Electronic commerce -- Periodicals; Electronic data interchange -- Periodicals; Business enterprises -- Computer networks -- Periodicals; 658.0505
• DOI: 10.1080/10919392.2019.1552743
• Languages: English
• ISSNs: 1091-9392

Abstract

ABSTRACT: The present study analyzes the elements that differentiate violators from non-violators of information security measures. Various elements are derived from established theories and models such as general deterrence theory, theory of planned behavior, theory of reasoned action, protection motivation theory, and social cognitive theory. To examine these factors, the data are gathered through an online study conducted in a Midwestern University, USA. The data are collected using questionnaires, and after scrutiny, 195 questionnaires are selected for final analysis. This data are analyzed using second-level statistical techniques, such as chi-square analysis and ANOVA. Results reveal that violators and non-violators of information security measures differ significantly with respect to many factors. These factors include perceived privacy, subjective norms, perceived information security policy (ISP) scope, perceived severity of penalty, perceived celerity of penalty, management support, organizational security culture, and perceived organizational IT capability. The non-significant factors are trust and work load. Implications for practitioners and researchers are provided.