• The Journal of the Korea institute of electronic communication sciences
• /
• v.19 no.3
• /
• pp.609-618
• /
• 2024

The escalating demand for organized information resource management within organizations necessitates increased investment in information security (IS), as a single error can lead to information exposure incidents, underscoring the importance of IS compliance by insiders. The research aims to elevate IS compliance within the organization by examining the influence of the shared goal of information security policy (ISP), perceived ISP value and individual's fits on an insider's intention to comply with the ISP. Antecedent research in organizational behavior and IS led to a proposed hypothesis, tested using 366 obtained samples. The ISP shared goal's positive influence on ISP compliance intentions was evident from the test results, primarily through the perceived ISP value. Furthermore, the person-organization and demand-ability fit moderated the antecedent factors associated with ISP compliance intentions. Our findings suggest the methods for sustaining organizational IS levels by examining the requisite conditions from the viewpoints of the organizational environment, ISP values, and fits.

• Journal of Digital Convergence
• /
• v.10 no.5
• /
• pp.37-51
• /
• 2012

The purpose of this study is to approach information security from a more comprehensive perspective. Particularly, information countermeasures includes a technological tool for end users, thereby increasing the end users' technological stresses. Based on the technostress framework, we investigate a effect of security awareness training on technostress, and also examine a effect of technostress on the persistent security compliance. Results showed that security awareness training influenced on techno-overload and techno-uncertainty. We also found that techno-overload and techno-uncertainty have a significant effect on the persistent security compliance. Conclusion and implications are discussed.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.355-370
• /
• 2022

This research investigates the impacts of information security (IS) culture and management leadership styles on employee's security behaviors (IS policies compliance, IS participation) in financial institutions. This study use the survey data collected from 236 employees of financial institutions. This research shows that IS culture has a positive effect on both behavioral intentions to comply with IS policies and the intentions to actively participate in information security activities. Transactional leadership has a positive impact on the IS policies compliance intentions and to participate in information security activities. In contrast, transformational leadership has a positive impact on the intentions to participate in information security activities, but not on the IS policies compliance intentions.

• Journal of Digital Convergence
• /
• v.10 no.10
• /
• pp.31-46
• /
• 2012

Drawing upon Griffin and Neal's safety climate and performance model, this study developed an information security climate model. Research model is composed of three research variables that include information security climate, information security compliance attitude, and opportunistic security behavior. Results of the study strongly support the fundamental proposition that the organizational security climate has significant positive influence on the individual's opportunistic security behavior. However, the study also reveals that the organizational climate may not directly associate with the reduction of opportunistic security behavior. Rather the organizational security climate nurtures the favorable attitude of the employee towards the compliance of information security, which in turn discourages opportunistic security behavior.

• Information Systems Review
• /
• v.12 no.1
• /
• pp.23-42
• /
• 2010

Although organizations are given various benefits with information technologies, they sometimes have suffered fatal damages due to information security incidents now such as computer virus, hacking, counterfeiting, plagiarizing, etc. The fundamentalcauses of information security incidents are closely related to individuals who do not comply with information security policy or rules. The spontaneous self-control of individuals and monitoring for individuals could be the most essential solution for the ongoing observance of information security policy. Thus, the purpose of this study is to analyze effects of punishment and ethics training on compliance of information security policy of individuals in organizations, to determine individual divide among security propensity depending on organization types, and to find the more fundamental solution which leads change of organizational members’ behaviors and self-control. Regardless of the type of organizations, the results of the study suggest that there exist positive effects of punishment and ethics training in all types of organization on compliance of information security rules or regulations. A member of unitary form organization has higher cognition of punishment than a member's cognition of the multi-divisional form organization, while relatively lower awareness of ethics training. Also, a member of public organization has higher awareness of ethics training than a member’s awareness of private organization, while lower cognition of punishment. Finally, the result shows that punishment and ethics training may be major factors which affect information security. It also suggests that organizational security managers have to understand and consider organization member’s propensity relying on organization form and organization characteristics for establishment and enforcement of information security policy.

• Journal of Digital Convergence
• /
• v.18 no.11
• /
• pp.169-176
• /
• 2020

With widespread use of information technologies the importance of information security has been heightened. Security policies which deal with fundamental direction of information security are critical elements of information security management. Numerous studies have been conducted on users' intention to comply security policies. They were based on various theoretical foundations and the theory of planned behavior(TPB) was the most frequently used. This research employed one of the quantitatively synthesizing meta-analytic techniques called Two-Stage Structural Equation Modeling to investigate factors influencing information security policy compliance behavior based on TPB. Analysis results indicated that all three factors of TPB were significantly influencing the behavioral intention. Moreover, the overall fit indices of structural model exhibited satisfactory level.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.16 no.6
• /
• pp.1101-1112
• /
• 2021

Organizations continue to increase investment in information security(IS) policies and technologies to prevent external intrusion and internal exposure to information assets. However, as the organization's regulations and behavioral requirements for strict IS policy increase, employees may induce negative behaviors through IS-related stress. The purpose of this study is to suggest the effects of challenge and hindrance stressors on IS compliance intentions and to confirm how authentic leadership moderates the positive and negative effects of stressors. We reflected employees of the organization who are applying IS policy to their work as a study target and applied a survey to obtain a sample for research hypothesis verification. As a result of analysis through structural equation modeling, challenge and hindrance stressors affected IS compliance intentions, and authentic leadership moderated the effects of stressors on compliance intention. Our research helps to establish insiders support strategies to achieve internal IS goals, because the results suggested stressor conditions and leaders' behavioral directions that influence employees IS compliance behavior.

• Informatization Policy
• /
• v.25 no.1
• /
• pp.99-114
• /
• 2018

In the past, organizations tended to focus on physical and technical aspects of managing corporate's information security (IS), rather than the aspect of human resources related to IS. Recently, increasing security incidents caused by organization members raise the issue of how to improve employees' compliance with security policies. This study conducted a field experiment to examine the effect of security awareness training and technical security services on employee's security behaviors. In Study 1, the number of spam opening cases were measured right after the IS training and re-measured three months later. In Study 2, a spam warning message was provided and then the number of employees' spam opening cases were counted to find out the effect of security services. It was found that both the IS training and the technical IS service were effective; they significantly decreased spam opening rates. However, the training effect did not last longer than three months. These findings suggest that organizations need to consider providing regular training programs and supplementary technical services to improve employees' compliance with security policies.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.18 no.6
• /
• pp.1177-1188
• /
• 2023

Socially, organizations are required to maintain strict management of their information resources and invest in the adoption of information security (IS) technologies and policies. However, the ongoing threat of information exposure by employees persists within the organization. This study aims to identify the role stress that employees may experience due to strict IS policies and propose methods for reducing its negative impact. Specifically, our study suggests a mechanism for mitigating role stress by incorporating factors related to IS policy goal setting and work regulatory focus. We conducted a survey among workers in the financial industry, where IS policies are rigorously enforced, and tested our research hypotheses using a sample of 309 participants. The results indicate that increasing the difficulty and specificity of IS policy goals reduces role stress (conflict and ambiguity) and positively influences employees' intention to comply with IS policies. Furthermore, individual work promotion focus moderated the relationship between role stress and IS compliance intention. These findings have important implications for organizations seeking to strengthen their IS compliance among employees and inform the development of effective IS strategies.

• Convergence Security Journal
• /
• v.22 no.1
• /
• pp.113-120
• /
• 2022

Despite the limitations of existing security policies due to technological development, companies are unable to actively respond to changes by maintaining a closed security policy. This study classified information security policy into three types: regulatory type policy, advisory type policy, and informative type policy. For each classified policy type, the effect on the information security policy compliance behavior of organizational members was investigated by applying the extended theory of planned behavior, and the moderating effect of information security stress was investigated. SmartPLS 2.0 and SPSS 21.0, which are structural equation modeling techniques, were used to analyze the relationship affecting each factor. As a result of the study, regulatory type, advisory type, and informative type security policies affected organizational members' information security policy compliance behavior, and security stress had an effect on information security compliance attitudes and subjective norms on information security, which are prerequisites for planned behavior theory. gave. This study suggests that various types of corporate information security policies can be applied and that security stress can affect information security behaviors of members.