Quality and Fairness of an Information Security Policy as Antecedents of Employees Security Engagement in the Workplace: An Empirical Investigation

Transcription

1 Quality and Fairness of an Information Security Policy as Antecedents of Employees Security Engagement in the Workplace: An Empirical Investigation Burcu Bulgurcu The University of British Columbia Hasan Cavusoglu The University of British Columbia Izak Benbasat The University of British Columbia Abstract This paper investigates the impact of the characteristics of information security policy (ISP) on an employee s security compliance in the workplace. Two factors were proposed as the antecedents of employees security compliance: ISP Fairness and ISP Quality. ISP Quality is comprised of three quality dimensions--clarity, Completeness, and Consistency. It is shown that ISP fairness has a strong positive effect on an employee s ISP Compliance. In addition, it is found that ISP quality does not only have a strong positive influence on an employee s ISP compliance but also have a strong influence on an employee s perceived ISP fairness. This study contributes to the literature by highlighting the importance of ISP characteristics; namely, ISP quality and ISP fairness as an organizational resource to enhance an organization s information security. 1. Introduction Organizations today agree that one of their top managerial priorities has became enhancing the safety of their information and technology resources [18, 20]. Since technology-based solutions were shown to help improve information security [20] organizations usually start with the technology to address information security challenges [13]. Despite the fact that organizations make increasingly more investments in technology-based solutions, empirical and anecdotal evidence indicate that the numbers of information security-related incidents are still increasing. The growing evidence implies that organizations may not achieve thorough enhancement of information security if they do not invest in individual and organizational resources along with technology-based solutions [8]. Many organizations recognize that their employees, who are often considered as the weakest link in information security, can be a great resource as well to fight against information security-related risks. Organizations create Information Security Policy (ISP) documents to provide guidelines to employees as to what they should do in order to ensure information security while they interact with information systems to perform their job responsibilities [26]. While such guidelines are quite useful to depict an employee s role in information security, it is fundamental that the employee accomplishes his roles by complying with information security related rules and regulations of his organization. Therefore, understanding the compliance behavior of an employee is crucial for organizations to effectively leverage their human capital and hence, to strengthen their information security. In this paper, we specifically focus on the characteristics of an ISP and investigate their impact on an employee s compliance with the security related rules and regulations, which are specified in the ISP. In accordance with this research focus, we address two main questions in this paper: 1. Do the characteristics of an Information Security Policy (ISP) help enhance an employee s compliance with the requirements of the ISP? In particular, how do perceived ISP fairness and ISP quality influence an employee s compliance with the ISP requirements? 2. What are the quality dimensions of an ISP document that in turn help enhance an employee s ISP compliance? 2. Research model and hypotheses 2.1. ISP compliance The dependent variable of this study is an employee s compliance with the information security policy. We have proposed two constructs to measure ISP compliance Intention to Comply and Current Compliance. Intention to Comply is defined as an indication of an employee's readiness to comply with /10 $ IEEE 1

2 the requirements of the ISP, and is considered to be the immediate antecedent of the actual behavior [2]. As an alternative to ISP compliance intention, we suggested employees actual ISP compliance, which is defined as an employee s perceptions on her current compliance with the requirements of the ISP of her organization ISP Fairness We define ISP fairness as an employee s belief in the justice of the organization s rules and regulations regarding security, which are prescribed in the ISP. Various studies conducted on justice in the field of organizational science supports the view that if an organization fails to provide fair processes, treatment, information, or outcomes, deviant behavior often increases [3, 5]. Any kinds of disincentives were also proved to be ineffective unless the measures are perceived to be legitimate or justified by employees [3]. Besides the widely accepted role of organizational injustice on deviant behavior, the group engagement model [25] also argues that procedural justice is central to shaping social identities within a group, which in turn positively influence attitudes, values, and cooperative behavior. In accordance with the group engagement model, we argue that the extent to which an employee believes in the fairness of her organization s security related rules and regulations prescribed in the ISP would positively influence her security compliance. Hence, Hypothesis 1: An employee s perceived ISP Fairness positively affects her security compliance ISP Quality The concept of quality has been investigated in various literatures and defined in various ways. Quality, depending on the context, means conformance to requirements [12], conformance to specifications [16], value [1], meeting customer expectations [17], and loss avoidance [24]. In this study, drawing on Crosby s definition suggesting that quality is conformance to the necessary requirements, we conceptualize the quality of ISP as the requirements or expectations of employees from the ISP document. Various studies emphasize the relativity of the quality concept among different subjects [12]. In light of this, we characterized ISP quality as the employee s perceptions of ISP quality. Irrespective of how quality is defined, quality is often conceptualized as a multidimensional concept [19]. Consistent with the multidimensionality notion of quality in the literature, we propose three quality dimensions for ISP Quality: Clarity, Adaptability, and Consistency. Clarity is defined as the policy s quality of being clear and easy to understand. Clarity of the policy may be reached by making it clearer or easier to understand by providing more details with simpler and more understandable explanations. Completeness is the policy s quality of being comprehensive and including all the necessary security rules and regulations in the documentation. Consistency is the policy s quality of cohering or being coherent in all parts across all security requirements. The policy should have a common goal and each part of the policy should connect and designed to perform for the sake of this common goal. We conceptualize that ISP quality influences an employee s compliance with it. The extent to which one trusts in the quality of a service or product influences her persuasion in adopting the service or valuing the product [28, 11]. Rogers (2003) suggests persuasion as a direct antecedent of making decisions [22]. Applying to the ISP compliance setting, perceived quality of ISP leads to the decision to comply with the requirements of the ISP. Consistent with the literature showing the link between quality and behavioral intention [11], we propose that, Hypothesis 2: An employee s perceived ISP Quality positively affects her security compliance. Furthermore, we argue that an employee s perceived ISP Quality will influence her perceptions about the fairness of the ISP. The relationship between fairness and quality has been explored in a variety of literatures, such as management, social justice, sociology, and psychology [27, 6]. It has been argued that one factor affects the other, depending on the context. Consistent with the literature, we propose that only after trusting in the quality of the requirements of the ISP, an employee can believe in the fairness of these requirements. One should first know that the requirements dictated by the ISP are carefully designed and developed and combined in a high quality document. Accordingly, we believe that an employee s perceived fairness can be enhanced by ensuring the quality of the ISP. Hence, Hypothesis 3: An employee s perceived ISP Quality positively affects her ISP Fairness. Clarity Completeness Consistency ISP Fairness H3 + ISP Quality H1 + Compliance H2 + Figure 1: Theoretical research model 2

3 3. Method 3.1. Measurement items The process of item development began with an investigation of previous theoretical and empirical literature. When we found existing measures which successfully capture our conceptualization, those measures were adopted. Otherwise, new measures were developed by closely following our definitions of constructs in this study. Appendix A presents the measurements items of all constructs with their anchors. Except for intention to comply, all constructs were measured reflectively with multiple items on seven-point Likert scales. The initial survey instrument was refined based on card sorting exercises and exploratory data analysis of two smallscale pre-tests. Information about the measurement items of each construct are given below: Compliance: We tested our research model with three different compliance constructs which include different measurement items. We first conceptualized compliance as an employee s intention to comply with the requirements of the ISP and measured it reflectively and formatively. The reflective measures of intention to comply were adopted from Bulgurcu et al. (2009) [7], which were based on the theory of planned behavior [2]. We also developed sixteen formative measures by investigating the major common requirements of an ISP. Lastly, we have conceptualized compliance as an employee s current compliance with the security requirements and by eliciting employee s perception about her current compliance. Our main idea for having different conceptualizations and different measurement items for compliance was to understand weather the model was sensitive to different measures of compliance so that we enhance the reliability of our results. ISP Quality: We have proposed ISP Quality as a second order construct, which is formatively created by the reflective measures of Clarity, Completeness, and Consistency. ISP Fairness, Clarity, Completeness, and Consistency: The reflective measurement items of these constructs were developed by closely following our definitions of constructs in this study in the context of employee s information security compliance Data collection We conducted an online survey to collect data and test our research model. A professional market research company located in the United States provided a nationwide sample of their panel members. We asked the research company to contact participants who are employed by a diverse set of organizations. Of all panel members, a total of 928 individuals opted to go on and participate to the survey by agreeing consent agreement. Those panel members then were first asked questions regarding demographics. Next, they were asked exclusion questions so that the data will not include those who work in organizations without an explicitly written ISP and who are unaware of the requirements of the ISP. Those who met the exclusion criteria were not able to proceed with the survey. Thus, 258 of the participants were screened out from the survey at that point. Of all the remaining 670 responses, 175 were eliminated due to incompleteness, and 31 were eliminated due to data runs. Hence, sample of 464 usable questionnaires were included in the analysis, giving an effective response rate of 42%. In the final sample of 464, 52% of the respondents were female, and 36% were in the age range. The average length of computer usage was 17.6 years, and the average usage of the Internet was 12.2 years. Twenty-eight percent of the respondents reported working for information-intensive companies. In terms of the responsibilities of the respondents, as well as the annual sales revenue and size of the companies they were working for, the sample was quite evenly distributed. 4. Data analyses and results The measurement and the structural models were tested using structural equation modeling. The component based partial least squares (PLS) approach were used to evaluate the psychometric properties of measurement scales and to test research hypotheses proposed in this study. The PLS, as a component based approach, is preferred over the covariance based approach because it is considered to be more appropriate when formative indicators as well as reflective indicators are used to measure latent constructs within a research model [9]. For this study, the measurement model was tested using both the reflective and the formative measurement items of the dependent variable to compare the possible differences in results. Moreover, because the PLS focuses on prediction of data and is better suited for exploratory models and theory development, it is considered to be more adequate for this study. The Smart-PLS software package (version 2.0.M3) was used for the estimations. 3

4 4.1. Validity and reliability of measurements The measurement and the structural models were tested using structural equation modeling. The component based partial least squares (PLS) approach were used to evaluate the validation of measurement scales and to test research hypotheses proposed in this study. The PLS, as a component based approach, is preferred over the covariance based approach because it is considered to be more appropriate for exploratory models [9] and formative items. The Smart-PLS software package (version 2.0.M3) was used for the estimations. The measurement quality of reflective constructs was assessed by examining the convergent validity, individual item reliability, composite reliability, and discriminant validity of the measurement model [4]. Since the measures of all constructs had adequate reliability and validity assessments, all the measurement items of these constructs were kept for testing the structural model. Subsequently, we estimated the structural model and tested the research hypothesis. The Average Variance Extracted (AVE) values for all reflective constructs were greater than the minimum recommended value of 0.50 (Convergent Validity). The square root of AVE for each construct in the model, as reported in the diagonal of the correlation of constructs matrix is larger than the corresponding off-diagonal correlations of the construct to their latent variables (Discriminant Validity). The composite reliability values for all the constructs in the research model are greater than 0.75 and Cronbach s alpha values are greater than 0.92, demonstrating that all constructs have adequate reliability assessment scores (Internal Consistency and Scale Reliability) [14]. All the measurement items loadings on respective constructs were above recommended minimum value of 0.707, indicating that at least 50 percent of the variance was shared with the construct (Convergent Validity) [9]. All the measurement item loadings on the intended constructs were above 0.78, and at least 0.1 less on its loadings on other constructs (Discriminant Validity) [14]. Please see Table 2 and 3 in Appendix A Structural model testing The measurement of the structural model was estimated by using PLS approach to structural equation modeling. Bootstrapping resampling method was used for the estimation of the structural model. The results of the model estimation including standardized path coefficients, significance of the paths based on one-tailed t-test and the amount of variances explained (R 2 ) are presented in Figure 2. Based on the significant path coefficients (Figure 2), all hypotheses were supported at minimum of p< ISP Fairness and ISP Quality were shown to positively affect an employee s compliance, predicting approximately 25% of the variance. All the proposed dimensions of ISP Quality were found to be also highly effective in explaining ISP Quality construct, suggesting that each sub-constructs significantly contributed to the underlying overall factor. In addition, ISP Quality was shown to significantly affect ISP Fairness, explaining 49% of the variance. As stated before, both reflective and formative measurement items were developed for compliance construct, and the model was tested with different types of measurement items. The results presented in Figure 2 were obtained by using the reflective measurement items of compliance. Because using formative measurement items of the construct (or using current compliance) did not result in any significant difference in the measurement model, we only presented the model with reflective items. Clarity.43* ISP F. (.49) Completeness.29*.70* Consistency.40* ISP Q. (.98).22*.27* 4.3. Discussions and implications C. (.25) Figure 2: Results of structural model testing *p<.001 Our study highlights the importance of the characteristics of an organization s ISP documentation in an employee s compliance with the security rules and regulations. Our results suggest that an employee s perceived ISP quality and ISP fairness have a significantly positive impact on her security compliance. Furthermore, we have suggested three quality dimensions for ISP quality and showed that an employee s perceived ISP Quality is comprised of these three dimensions, which in turn helps develop her perceived ISP Fairness. Hence, our study sheds light on the role of an employee s perceived ISP characteristics on her security compliance in the workplace. As organizations strive to get their employees to follow their information security rules and regulations, we believe that this study is important in emphasizing the development of high quality ISP document. As an important practical 4

5 implication of our results, organizations should develop high quality security policy document since it will directly and indirectly improve information security compliance. When they are doing so, they should pay specific attention to clarify, consistency and completeness of the ISP document. Further, our results imply that organizations should try to establish understanding among employees that the ISP that they have to comply is fair. While this can be achieved in various way, our research indicates that the high quality ISP help employees develop the ISP fairness. 5. Conclusion and future research Future research should identify the dimensions of ISP fairness as we found that ISP fairness plays a crucial role in employee s compliance behavior. Furthermore, we believe that the identification of the factors leading employees perceived ISP fairness and quality would be an important contribution to our knowledge in employee s security compliance since there is a gap in the literature in this direction. Such research would be important to practitioners since they can use those factors to formulate their ISP documents. Another fruitful future research direction is to investigate whether the employee s active participation in the development of the document, such as having the possibility to suggest new requirements to the ISP or evaluate and alter the existing rules and requirements of the ISP, can play a role in shaping her perceived ISP fairness and quality. The selection of participants may be one of the possible limitations of this study. In the beginning of the survey questionnaire respondents were asked whether their organization had provided an established ISP and whether they were aware of the requirements of the ISP. The participants who were not aware of the ISP of their organizations were excluded from participation in the survey. The selection of information security aware participants could have created a favorability bias in the responses. However, the investigation of this study would be impracticable with participants who were completely unaware of the requirements of the ISP. 10. References [1] L. Abbott, Quality and competition, Columbia University Press: NY, [2] I. Ajzen, The theory of planned behavior, Organizational Behavior and Human Decision Processes, 50, 1991, pp [3] K. Aquino, T.M. Tripp, and R.L. Bies, Getting even or moving on: Power, procedural justice, and types of offense as predictors of revenge, forgiveness, reconciliation, and avoidance in organizations, Journal of Applied Psychology, 91, 2006, pp [4] Barclay, D., Higgins, C., and Thompson, R. The Partial Least Squares (PLS) Approach to Causal Modeling: Personal Computer Adoption and Use as an Illustration, Technology Studies, 2:2, 1995, pp [5] R.J. Bies, The predicament of injustice: The management of moral outrage, Research in Organizational Behavior, 9, 1987, pp [6] S.L. Blair, Work roles, domestic roles, and marital quality: perceptions of fairness among dual earner couples, Social justice research, 11:3, 1998, pp [7] B. Bulgurcu, H. Cavusoglu, and I. Benbasat, Information Security Policy Compliance: An Empirical Study of Compliance-related Beliefs and Information Security Awareness, 2009, UBC Working Paper. [8] H. Cavusoglu, H. Cavusoglu, J. Son, and I. Benbasat, Information Security Control Resources in Organizations: A Multidimensional View and Their Key Drivers, 2009, UBC Working Paper. [9] W. W. Chin, Issues and Opinion on Structural Equation Modeling, MIS Quarterly, 22:1, 1998, pp.vii-xvi. [10] J. J. Cronin, and S. A. Taylor, Measuring service quality: A reexamination and extension, Journal of Marketing, 56:3, 1992, pp [11] J.J. Cronin, M. K. Brady, and T.M. Hult, Assessing the effects of quality, value, and customer satisfaction on consumer behavioral intentions in service environments Journal of Retailing, 76:2, 2000, pp [12] P. B. Crosby, Quality is free: The art of making quality certain, McGraw-Hill Companies, NY, [13] Deloitte, Global security survey, Deloitte Touche Tohmatsu, [14] D. Gefen, D. W. Straub, and M. C. Boudreau, Structural Equation Modeling and Regression: Guidelines For Research Practice, Communications of The AIS, 4, 2000, pp [15] D. Gefen, and D. Straub, A Practical Guide to Factorial Validity Using PLS-Graph: Tutorial and Annotated Example, Communications of the Association for Information Systems, 16, 2005, pp

6 [16] H. L. Gilmore, Product conformance cost, Quality progress, 7:5, 1974, pp [17] C. Gronroos, Strategic Management and marketing in the service sector, Marketing Science Institute, Cambridge: MA, [18] D.F. Lohmeyer, J. McCrory, J., and S. Pogreb, S. Managing Information Security, The McKinsey Quarterly, SE: Risk and Resilience, 2, 2002, pp [19] R. J. Maxwell, Dimensions of quality revisited: fro though to action, Q. S. Healthcare, 1992, pp [20] S. Ransbotham, and S. Mitra, Choice and Chance: A Conceptual Model of Paths to Information Security Compromise, Information Systems Research, June 20, 2008 ( [21] C. M. Ringle, S. Wende, and A. Will, SmartPLS. (2.0 (beta)). Hamburg, Germany, ( [22] E. M. Rogers, Diffusion of innovations. 5th ed. New York: Free Press, [23] D. W. Straub, Effective IS Security: An Empirical Study, Information Systems Research, 1, 1990, pp [24] G. Taguchi, Introduction to Quality Engineering; Asian Productivity Organization: Tokyo, [25] T.R. Tyler, and S.L. Blader, The Group Engagement Model: Procedural Justice, Social Identity, and Cooperative Behavior, Personality and Social Psychology Review, 7, 4, 2000, pp [26] M. E. Whitman, A. M. Townsend, and R. J. Aalberts, Information systems security and the need for policy, in Information Security Management - Global Challenges in the Next Millennium, G. Dhillon, London: Idea Group, 2001, pp [27] M.K. Wynia, D. Cummins, D. Fleming, Improving fairness in coverage decisions: performance expectations for quality improvement, American Medical Association, [28] V. A. Zeithaml, Consumer perceptions of price, quality and value: A means-ends model and synthesis of evidence, Journal of Marketing, 52, pp Appendix A Table 1: Measurement items and scales Cons. Measurement Items I intend to comply with the requirements of the ISP in regards to protection of the of my organization. C-F1 computing resources C-F2 software resources C-F3 data and information resources C-F4 Internet resources C-F5 network resources C-F6 electronic communications C-F7 private, strategic and sensitive information C-F8 trade secrets I intend to comply with the requirements of the ISP by to protect the resources of my organization: C-F9 appropriately selecting and updating passwords C-F10 using and updating anti-virus software C-F11 adhering to the rules of remote access to internal networks C-F12 alerting security personnel when I find out potential security threats C-F13 getting rid of viruses or spyware or getting help from others if necessary C-F14 learning the skills and methods to protecting my information system C-F15 updating security patches to software resources C-F16 paying attention to the physical security of resources C-R1 I intend to comply with the requirements of the ISP of my organization in the future. I intend to protect information and technology resources C-R2 according to the requirements of the ISP of my organization in the future. I intend to carry out my responsibilities prescribed in the C-R3 ISP of my organization when I use information and technology in the future. C-C1 I am currently complying with the requirements of the ISP of my organization. I believe the requirements of the ISP that I am required to comply with are. ISPF1 unfair... fair ISPF 2 unreasonable... reasonable ISPF 3 unjust... just ISPF 4 inequitable... equitable Clar1 complex... clear Clar2 difficult to understand... easy to understand Clar3 complicated... simple Clar4 convoluted... straightforward Comp1 partial... thorough Comp2 deficient... comprehensive Comp3 incomplete... complete Cons1 inconsistent... consistent Cons2 contradictory... coherent Cons3 discordant... harmonious Constructs: C-F: Compliance - Formative; Scale: a C-R: Compliance - Reflective; Scale: a 6

7 C-C: Current Compliance; Scale: b ISPF: ISP Fairness; Scale: c Clar: Clarity; Scale: c Comp: Completeness; Scale: c Cons: Consistency; Scale: c Scales: a) 1. Strongly Disagree 7. Strongly Agree; b) 1. Definetely False 7. Definetely True; c) 1. Extremely, 2. Quite, 3. Slightly, 4. Neither, 5. Slightly, 6. Quite, 7. Extremely Table 2: Means, standard deviations, and item loadings Constructs Items Mean STD Loading C - F C-F C-F C-F C-F C-F C-F C-F C-F C-F C-F C-F C-F C-F C-F C-F C-F C - R C-R C-R C-R C - C C-C ISP F. ISPF ISPF ISPF ISPF Clar. Clar Clar Clar Clar Comp. Comp Comp Comp Cons. Cons Cons Cons Table 3: Composite Reliability, AVE, and Latent Variable Correlations CR AVE C ISP F Clar Comp Cons CR = Composite Reliability; AVE = Average Variance Extracted Diagonal elements display the square root of AVE for factors measured with reflective items. 7