• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.3
• /
• pp.575-590
• /
• 2022

Recently, organizations are increasing their investment to protect information resources from information security(IS) threats through the adoption of IS policies and technologies. However, IS incidents occur in a variety of ways, such as intrusions from outside the organization and exposure to the inside. Our study presented the negative effects of IS role stress on organizational insiders and suggested factors from the organizational and individual perspectives for mitigating IS role stress. We conducted a survey on employees of companies that introduced and applied IS policies to their work and tested the hypothesis using 329 samples. As a result, IS organization justice reduced IS role stress and strengthened IS positive psychological capital, thereby affecting the IS compliance intention of employees. Also, IS positive psychological capital moderated the relationship between IS stress and IS compliance intention. This study contributes to the achievement of internal IS goals by suggesting the conditions that affect the IS compliance behavior of employees in terms of the organizational environment and individual characteristics

• Journal of Digital Convergence
• /
• v.12 no.2
• /
• pp.27-37
• /
• 2014

While organizations are making a considerable effort to leverage formal and informal control mechanisms (e.g., policies, procedures, organizational culture) to improve security, their impact and effectiveness is under scrutiny as employees seldom comply with information security procedures. The best way to ensure the viability of a security policy is to make sure users understand it and accept necessary precautions. From an organization's perspective, a lack of security knowledge and awareness on the part of employees is a major problem. However, previous studies suggest that effect of security awareness education is inconsistent. Thus, this study is to find the answer why security awareness education is not effective. Conclusions and implications are discussed.

• Journal of the Korea Convergence Society
• /
• v.12 no.1
• /
• pp.211-218
• /
• 2021

This study is composed of a convergence research design plan as the necessity of information security field dealing with human factors are raised. The purpose of this study is to analyze the effectiveness of the aspect of information security on the cognitive process related to security policy. The research method consisted of the cross-design of the availability dimension and the culture dimension, and the information security process was measured with information security awareness, response efficacy, compliance behavioral intention, and information security behavior. As a result of the study, the dimension of availability had a significant effect on response efficacy, and it was found that the influence of the case-based condition was greater than that of the statistics-based condition. The cultural dimension had a significant effect on information security awareness, response efficacy, compliance behavioral intention, and information security behavior, and the influence of the homogeneity condition was found to be greater than that of the diversity condition. The proposed research model was verified as a multiple mediation model reconstructed with measurement variables. In addition, the discussion describes the necessity of an information security strategy in consideration of individual factors and organizational characteristics.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.6
• /
• pp.1225-1241
• /
• 2014

Recently, Financial companies implement DLP(Data Leaks Prevention) security products and enforce internal controls to prevent customer information leaks. Accidental data leaks in financial business increase more and more because internal controls are insufficient. Security officials and IT operation staffs struggle to plan countermeasures to respond to all kinds of accidental data leaks. It is difficult to prevent data leaks and to control information flow in business without research applications that handle business and privacy information. Therefore this paper describes business and privacy information flow on applications and how to plan and deploy security container based OS-level and Hypervisor virtualization technology to enforce internal controls for applications. After building security container, it was verified to implement internal controls and to prevent customer information leaks. With security policies additional security functions was implemented in security container and With recycling security container costs and time of response to security vulnerabilities was reduced.

• Journal of Convergence for Information Technology
• /
• v.10 no.9
• /
• pp.123-135
• /
• 2020

Recently organizations are implementing strict security policies and technologies to minimize security incidents. However, strict information security can cause work stress of employees and can make it difficult to achieve security goals. The purpose of this study is to present the preconditions for mitigating the negative impact of security-related work stress. We conducted a questionnaire survey of employees working in the financial industry and secured a total of 266 samples. The test of the research hypothesis was carried out by structural equation modeling. As a result, work stress had a negative effect on compliance intention, and value congruence reduced work stress. Also, security feedback had a moderating effect on the relationship between research factors. The results have theoretical and practical implications for mitigating work stress of employees.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.16 no.6
• /
• pp.243-253
• /
• 2016

Company strengthen various information security policy and activity in order to protect important information assets that the company has been dealing with and prevents information security accidents such as personal information spill. However, some study said these policy and activity increase employee's information security stress and still information security accidents by employees have happened so far. Therefore, this study will review preceding theories and studies used in many various fields including Information Security areas needed to explain human's behavioral intention and determinants and summarize characteristic factors that have influence on control of human's behavioral intention in the results of the above theories and studies. Secondly, this study will implement exploratory analysis on characteristic factors perceived by employees that has been stemmed from various company's information security policy and activity in order to increase employee/'s information security compliance intention under the its surrounding security circumstance. Thirdly, this study will fulfil multiple-regression analysis in order to identify cause-effect relationship between employee's perceived information security stress and employee's perceived characteristic factor. Finally, this study will explain casual relationship with same analysis methods between information security stress and information security compliance intention based on results of the survey conducted on the financial firm's employees with same analysis methods.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.18 no.1
• /
• pp.165-175
• /
• 2023

As the reduction of information exposure threats by organization insiders contributes to achieving information security(IS) goals, organizations are establishing strict IS policies applicable to insiders and increasing investment in IS systems. However, since IS incidents cause damage to an organization even by malicious information exposure by one person, psychological support for strengthening IS compliance behavior by insiders. This study aims to confirm how the uncertain organizational environment related to IS affects individual IS-related behavior. We surveyed insiders of organizations operating IS policies and tested the hypothesis using 440 samples. As a result, IS technology and communication uncertainty reduced IS voice behavior through IS prospective anxiety, and individuals' susceptibility to information influence moderated the relationship between IS technology, communication, and prospective anxiety and IS voice behavior. Our results suggest the necessity and direction of supplementing the uncertain IS environment in practice.

• Convergence Security Journal
• /
• v.19 no.2
• /
• pp.47-58
• /
• 2019

This study applied the Theory of Reasoned Action by Fishbein & Ajzen(1975) as the grounded theory and adopt sanctions of the General Deterrent Theory and protection motivation of the Protection Motivation Theory as the antecedents to discuss the theoretical factors and the cases of application in the field of information security. Then, it adopted subjective norm, a variable of the Theory of Reasoned Action, as a parameter to analyze the causality of sanctions, perceived vulnerability, response cost, and self-efficacy with the intention to follow the information security policies. As a result, all of the antecedents except for sanctions had causality with the intention and subjective norm proved its mediating effect as a parameter between the antecedents and the intention.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.04a
• /
• pp.893-896
• /
• 2011

기업들은 새롭게 변화하는 법률 및 표준이 포함하고 있는 정보보호 요구사항들을 만족하기 위해 매번 상당한 시간과 비용을 투자하고 있다. 또한, 기업이 자체적으로 개발한 내부 컴플라이언스 정책 및 체계를 활용하고 있어 다양한 법, 표준의 변화가 있을 때 기업 내의 서로 다른 조직들과 협업하여 이를 준수하기란 어려운 상황이다. 이와 같이 관련 법, 표준의 내용들이 변경되는 한, 이에 대한 컴플라이언스를 위해 반복적으로 시간과 자원이 투입되기 때문에 막대한 비용이 소요될 수 밖에 없다. 따라서 본 논문에서는 금융기관들의 컴플라이언스 체계를 개선하며 이를 효율적으로 관리할 수 있는 금융 IT보안 컴플라이언스 프레임워크를 제안한다.

• Journal of Digital Convergence
• /
• v.18 no.12
• /
• pp.217-229
• /
• 2020

Globally, information protection of organization has become an essential management factor, and organizations continue to invest high-level resources for information security. Security threats from insiders are not decreasing. The purpose of this study is to present the antecedence factors to mitigate the role conflict that is the cause of the security avoid behavior. For the study, a survey was conducted for employees of organizations with information security policies, and structural equation modeling was conducted using a total of 383 samples for hypothesis verification. As a result of the analysis, role conflict increased avoid behavior, and goal difficulty, goal specificity, justice, and trust mitigated role conflict. In particular, justice influenced the reduction of role conflict and avoid behavior through trust. The implications were to present the causes and mitigation factors for avoid behavior of employee, and it is judged that it will help the organization to establish a security strategy.