• The Journal of the Korea institute of electronic communication sciences
• /
• v.17 no.2
• /
• pp.375-386
• /
• 2022

As information asset protection is recognized as an important management factor for organizations, organizations are increasing their investments in information security(IS) policies and technologies. However, strict application of IS may cause non-compliance behavior through IS stress on employees of the organization. Accordingly, this study suggests a mechanism by which employee stress affects IS compliance intentions through self-determination, and a method to reinforce IS compliance intentions through person-organization fit. We conducted an online survey of employees working at companies that adopted IS policies and tested hypotheses using 475 samples. First, as a result of analyzing the main effects of applying the structural equation model, role stress affected IS compliance intention through self-determination. Second, as a result of analyzing the moderating effect of applying Process 3.1, personal organization fit strengthened the relationship between self-determination and IS compliance intention. The research suggests a direction for achieving internal IS goals by confirming the influence of IS stress and behavioral causes of employees.

• Convergence Security Journal
• /
• v.18 no.1
• /
• pp.69-84
• /
• 2018

This study examines antecedents of the intention of compliance with information security policies based on Ajzen's Theory of Planned Behavior. The study conducted the following: Verification of casual relations between role of management and protection motivation and the antecedents of planned behavior as parameters to determine the effect on the intention of compliance with information security policy, and comparative analysis between the research model and a competition model. The result of the study disclosed that, in the research model, attitude and subjective norm took an intermediary role on management beliefs, response efficacy, response cost, self-efficacy, and compliance intention, and perceived behavior control on management beliefs, self-efficacy and compliance intention.

• Journal of Digital Convergence
• /
• v.19 no.2
• /
• pp.105-115
• /
• 2021

The purpose of this study is to present the effect of differences in individual coping and organizational homogeneity culture on information security compliance from an exploratory perspective. The study divided groups into individual coping (task-oriented, emotion-oriented) and organizational homogeneity culture (homogeneity, heterogeneity), confirms the difference in information security for each group through cross-design and presents a multiple mediation model between information security factors. As a result of the study, in the coping dimension, the average of the security compliance factors was higher in the emotion-oriented than the task-oriented, and in the homogeneity culture dimension, the average of the security compliance factors was higher in the homogeneity than the heterogeneity. Additionally, social influence and involvement had a multiple mediation effect on the relationship between information security awareness and compliance intention. The implications of this study were to confirm the difference in the effect of individual decision-making styles on security compliance according to the organizational culture differences. The results suggest the necessity of applying a customized information security compliance model for each organization and individual characteristics.

• Journal of Navigation and Port Research
• /
• v.40 no.4
• /
• pp.213-222
• /
• 2016

Recently, as cases of organizations' information disclosure occur continuously, it is urgent to manage security of information and establish measures to enhance security of information by an organization itself. Especially, members of an organization should be prepared with measures for information security, and an organization should do its efforts to raise its members' awareness toward information security. I set a research model to verify what effects an organization's fulfillment of regulations to secure information brings to performance of information security and selected members from maritime and port organizations and financial and insurance institutes as sample. Results of the analysis to identify factors affecting information security performance among members of maritime and port organizations are as follows. Firstly, I found that the factors affecting information security awareness are information security attitude and information security standards. Secondly, the factor giving influence on information security policy of an organization was found to be information security standards. In contrast, information security punishments and information security training were verified not to give influence on compliance of information security policy. Thirdly, information security awareness was identified to give significant influence on compliance of information security policy, information security competence and information security behavior. Fourthly, compliance of information security policy was verified to be those factors that give influence on information security competence and information security behavior. Lastly, information security competence and information security behavior were found to be such factors that give influence on information security performance.

• Journal of Korea Society of Industrial Information Systems
• /
• v.26 no.3
• /
• pp.23-39
• /
• 2021

Investment of organization in information security is increasing, but information security threats within the organization are not decreasing. The purpose of this study is to suggest a direction to increase the information security compliance intention of employees. In detail, the study presents the positive effects of security motivation and organization trust on the information security compliance intention, and presents the moderating effect of work promotion focus. Research model and hypothesis verification are confirmed through structural equation modeling and the study conducted a questionnaire technique to the employees of the organization applying the information security policy for quantitative verification. As a result, information security punishment and value congruence had a positive affect on the compliance intention by mediating organization trust. In addition, work promotion focus had a moderating effect on the positive relationship between the precedent factors on the compliance intention. The research has academic and practical implications from the viewpoint of presenting the factors of the organization's efforts to improve the level of information security compliance by insiders.

• Convergence Security Journal
• /
• v.16 no.7
• /
• pp.51-59
• /
• 2016

An internal and external threat against an information system has increased, and to reduce it, organization has spent a great deal of money and manpower. However, in spite of such investment, security threat and trouble have happened continuously. Organization has conducted information security activity through various policies. The study classified such activities into prevention-oriented activity and control-oriented activity, and researched how information security activity of organization affects members of an organization and obeys information security policy by using health belief model. As a result of the study, prevention-oriented activity has a meaningful impact on seriousness, and this seriousness affects compliance intention for information security. Control-oriented activity has a meaningful impact on benefits, and the benefits have an effect on compliance intention. When an organization conducts prior activities such as education, PR, and monitoring, this organization should emphasize negative results that can happened because of deviation. In addition, in case of exposure and punishment through post activities such as inspection and punishment, if the organization emphasizes the positive effects of exposure and punishment rather than emphasis of negative parts, information security activity will be more effective.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.5
• /
• pp.1243-1250
• /
• 2016

The purpose of this study is to investigate how abusive supervision influences on security policy compliance in their work place and find moderation effects of organizational justice. The results is that abusive supervision decreases employees' affective commitment or social bond to their organizations. And it negatively affect employees' behavioral intent to comply with security policies. Organizational justice acts to attenuate the negative relationship between the stress from abusive supervision and willingness to comply with the security policy. Especially, distributive justice has a significant effect on decreasing the negative relationship.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.04a
• /
• pp.332-335
• /
• 2017

정보기술의 발달은 조직의 업무환경에 긍정적인 영향을 주는 동시에 다양한 정보보호 위협에 따른 사고 발생 등 부정적인 영향을 미친다. 조직에서는 보안사고 예방을 위하여 다양한 노력들을 경주하고 있지만 기술적 보안 솔루션에 의존하는 경향이 있으며, 그럼에도 불구하고 보안 사고를 완벽히 예방하는 것은 불가능하다. 최근 기존의 정보보호 접근방법의 한계를 극복하기 위한 새로운 접근방법인 인간 중심 보안(People Centric Security)에 대한 관심이 증가하고 있으며, 임직원의 자발적인 정보보호 정책준수에 대한 연구의 필요성이 제기되고 있다. 본 연구는 향후 인간 관점의 정보보호 연구의 발전을 위해 기존의 수행된 연구들을 분석하여 통합된 관점에서 연구방향을 제시하는 연구동향 분석 연구로서, 해외 4개의 저널에서 수집한 134개의 논문을 대상으로 연구 추세, 연구 주제, 연구 방법론 등을 분석하였다. 본 연구의 결과는 국내의 인간 관점에서의 정보보호 관련 연구 활성화에 기여할 수 있을 것이라 판단되며, 조직에서 임직원의 정책준수에 영향을 주는 요인들을 참고하여 정보보호 정책 수립 시 활용할 수 있을 것이다.

• Journal of Digital Convergence
• /
• v.11 no.10
• /
• pp.153-168
• /
• 2013

Information security has been a major concern in organizations. The longstanding question of how to improve employees security behaviors and reduce human errors remains unanswered and requires further exploration in the information security domain. To do this, we propose a risk compensation theory-based model and examine the model. Research results shows that the relationships between information security countermeasures and information security compliance intention of employees are moderated by system vulnerability. However, the finding is contrary to the previously held risk compensation assumption and deserve further study. In addition, system quality does not play a moderator role in the relationship. Conclusions and implications are discussed.

• The Journal of Society for e-Business Studies
• /
• v.16 no.4
• /
• pp.33-51
• /
• 2011

This research derived the influencing factors for employees' compliance with the information security policy in organizations on the basis of Neutralization Theory, Theory of Planned Behavior and Protection Motivation Theory. To empirically analyze the research model and the hypotheses, data were collected by conducting web survey, 194 of 207 questionnaires were available. The test of causal model was conducted by PLS. Reliability, validity and model fit were found to be statistically significant. the results of hypotheses tests showed that seven ones of eight hypotheses could be accepted. The theoretical implications of this study are as follows : 1) this study is expected to play a role of baseline for future research about employee compliance with the information security policy, 2) this study attempted interdisciplinary approach through combining psychology and information system security research, and 3) it suggested concrete operational definitions of influencing factors for information security policy compliance through comprehensive theoretical review. Also, this study has some practical implications. First, it can provide the guideline to support the successful execution of the strategic establishment for implement of information system security policies in organizations. Second, it is proved that the need for conducting education and training program suppressing employees. neutralization psychology to violate information security policy should be emphasized in the organizations.