探討影響組織成員遵守資安政策意圖或抗拒的因素：應用資訊安全政策合規性統一模型

Exploring the Impacts of Factors on Organizational Members Intention to comply with information security policy: Using A Unified of Information Security Policy Compliance(UMISPC).

李家安(CHIA-AN LEE)

指導教授 ： 吳錦波

淡江大學/商管學院/資訊管理學系碩士在職專班/碩士(2019年)

https://doi.org/10.6846/TKU.2019.00426

摘要

組織對資訊技術（IT）的快速增長使用已經徹底改變了資產和關鍵資源，因為數位化，使得其更易於轉移M. T. Siponen (2005); Warkentin and Siponen (2015)。現代化的組織大量利用資訊系統與網路為基礎，建構出整合組織內外舉凡政策、財務、法務、生產、進銷存等資訊流，快速提供組織決策時資訊，提升組織生產效率與快速反應能力，其中流竄的資訊關係著組織的生存，也包含商業機密與個人隱私的敏感資料，組織必須制定適當、合理、可被接受、符合工作性質與個人任務的資安政策，以抵禦資安威脅。至今，對資訊系統安全(ISS)行為的研究已產生數十項理論來解釋資訊安全政策的合規性，對此Moody, Siponen, and Pahnila (2018)提出了一個統一模型，稱為資訊安全政策合規性統一模型(UMISPC)，整合了先前十一項理論，提供決策者了解組織成員遵守資安政策意圖的因素，為資安教育或干預活動提供基礎。本研究使用資訊安全政策合規性統一模型，在台灣進行實證研究，以 SmartPLS3.0分析結果證實，資訊安全政策合規性統一模型具有顯著的解釋力，與以往使用單一理論，如中立化理論及保護動機理論來解釋資訊安全政策合規性有所不同，可提供管理者在制定資組織安全政策時作為參考。

關鍵字

資訊安全政策 ； UMISPC ； 統一模型

並列摘要

Organizations' rapid growth in the use of information technology (IT) has revolutionized assets and critical resources, as digitalization makes it easier to transfer M. T. Siponen (2005); Warkentin and Siponen (2015). The modern organization is based on a large number of information systems and networks, and integrates information flow such as policy, finance, legal affairs, production, and invoicing in the organization, providing information on organizational decision-making and improving organizational productivity and rapid response. The rogue information is related to the survival of the organization. It also contains sensitive information about trade secrets and personal privacy. The organization must formulate appropriate and reasonable, acceptable, and work-related and personal tasks to protect against the security threat. To date, research on information system security (ISS) behavior has produced dozens of theories to explain the compliance of information security policies. Moody, Siponen, and Pahnila (2018) proposed a unified model called information security policy. The Uniformity Compliance Model (UMISPC) integrates the previous eleven theories to provide decision makers with an understanding of the factors in which members of the organization comply with the intent of the security policy and provides the basis for education or intervention. This study used the unified model of information security policy compliance to conduct empirical research in Taiwan. The results of SmartPLS3.0 analysis confirmed that the unified model of information security policy compliance has significant explanatory power, and used a single theory, such as neutralization theory. And the theory of protection motivation to explain the differences in information security policy compliance, can provide managers as a reference when formulating the organization's security policy.

並列關鍵字

UMISPC ； Information Security Policy Compliance ； Unified Model

參考文獻

Bandura, A. (1977). Self-efficacy: toward a unifying theory of behavioral change. Psychological review, 84(2), 191.

Ajzen, I. (1985). From intentions to actions: A theory of planned behavior. In Action control (pp. 11-39): Springer.

Akers, R. L., Krohn, M. D., Lanza-Kaduce, L., & Radosevich, M. (1979). Social learning and deviant behavior: A specific test of a general theory. American sociological review, 636-655.

Ashforth, B. E., & Mael, F. (1989). Social identity theory and the organization. Academy of management review, 14(1), 20-39.

Ashforth, B. E., Rogers, K. M., & Corley, K. G. (2011). Identity in organizations: Exploring cross-level dynamics. Organization science, 22(5), 1144-1156.