從嚇阻理論觀點探討員工資訊安全行為意圖

Understanding information security behavioral intentions: A Deterrence Approach

高珮庭(Pei-Ting Kao)

指導教授 ： 施盛寶

淡江大學/管理學院/資訊管理學系碩士班/碩士(2012年)

https://doi.org/10.6846/TKU.2012.01073

摘要

現今企業的環境下，組織內的相關資訊與資訊科技基礎建設以及個人電腦往往遭受到威脅，除了透過資安技術方式，已有許多研究開始著重在資訊安全管理與組織員工的資安行為，以確保組織內部的資訊安全。對於組織員工的資訊安全行為，在嚇阻理論應用於探討員工從事資訊安全行為意圖的這些研究得到的結果顯示，嚇阻的嚴重性與確定性對員工資安行為的影響效果，並不十分一致；同時，也有研究指出嚇阻方式的有效與否，會受個人或環境因素的影響，著眼於此，本研究考量員工內在心理層面，根據Kelman所提出之社會影響理論來了解員工內在心理承諾，對嚇阻方式與員工資訊安全行為意圖之間的關係。本研究針對天下雜誌在2011年公佈的500大服務業的公司，抽樣聯絡對方公司的資訊人員，總共收回168份問卷。研究結果顯示透過嚴重性懲罰與確定性偵測的方式會正向影響員工資訊安全行為意圖，而員工內在心理層面對組織之承諾會增強嚇阻方式與資訊安全行為意圖之間的關係。未來企業可以本研究為參考依據，了解組織內員工遵從資訊安全行為的意圖，除了透過嚇阻的方式外，也必須考量到員工對公司承諾的心理層面狀態。

關鍵字

嚇阻理論 ； 資訊安全行為意圖 ； 社會影響理論 ； 組織承諾

並列摘要

In the dynamic enterprise environment, information technology infrastructure and the computers in organizations often suffer from security threats. In addition to the research on information security technology, many literatures have studied information security from management side, such as managing the information security behavior of employees to ensure internal information security of the organizations. Deterrence theory, therefore, has been employed to investigate employees’ information security behavior. However, these researches showed inconsistent results that perceived severity and perceived certainty may not both affect individuals’ behaviors because of the contextual effects influenced by the individual or environmental factors. Draw on this issue, based on the social influence theory proposed by Kelman, this study tend to understand the effects of the employees’ organizational commitment on the relations between the deterrence and employees’ information security behavior intention. We collected 168 samples from top 500 service companies on the list of CommonWealth magazine in 2011. The results showed that severity of punishment and certainty of detection had positive effects on employees’ information security behavior intention. In addition, employees' psychological aspects of organizational commitment enhanced the effects of deterrence on information security behavior intention. From this study, we implied that management has to notice the psychological part of employees’ commitment to the organizations when introducing disciplinary actions in companies.

並列關鍵字

deterrence theory ； information security behavioral intention ； social influence theory ； organizational commitment

參考文獻

Ajzen, I. 1991. "The Theory of Planned Behavior," Organizational behavior and human decision processes (50:2), pp 179-211.

Akers, R.L. 1990. "Rational Choice, Deterrence, and Social Learning Theory in Criminology: The Path Not Taken," J. Crim. L. & Criminology (81:3), pp 653-676.

Alavi, M., and Leidner, D.E. 2001. "Review: Knowledge Management and Knowledge Management Systems: Conceptual Foundations and Research Issues," Mis Quarterly (25:1), pp 107-136.

Albrechtsen, E. 2007. "A Qualitative Study of Users' View on Information Security," Computers & Security (26:4), pp 276-289.

Anderson, C., and Agarwal, R. 2006. "Practicing Safe Computing: Message Framing, Self-View, and Home Computer User Security Behavior Intentions," ICIS 2006 Proceedings.