Facing constant cyberattacks, organizations should use IT security tools, train employees, and motivate them to comply with security policies. Accordingly, employees’ extra-role security behaviors can benefit organizations as an additional line of defense. Drawing on organizational climate theory, we examined the psychological mechanisms through which organizational security climate could shape extra-role security behaviors. These mechanisms, such as employees' increased organizational security concern and a broader definition of their perceived security-related responsibilities, were found to have a full mediating effect between organizational security climate and extra-role security behaviors. This research contributes to the information security literature by presenting an empirically validated model that provides nuanced insights into the role of organizational climate in shaping extra-role security behaviors.

Insiders have the potential to do a great deal of damage, given their legitimate access to organisational assets and the trust they enjoy. Organisations can only mitigate insider threats if they understand what the different kinds of insider threats are, and what tailored measures can be used to mitigate the threat posed by each of them. Here, we derive VISTA (inclusiVe InSider Threat tAxonomy) based on an extensive literature review and a survey with C-suite executives to ensure that the VISTA taxonomy is not only scientifically grounded, but also meets the needs of organisations and their executives. To this end, we map each VISTA category of insider threat to tailored mitigations that can be deployed to reduce the threat.

As an important construct in IS area, self-efficacy of individuals to engage in information security behaviors has been previously studied. We replicated one such study, which tested the influence of self-efficacy in information security (SEIS) on end user’s information security behavior. In our work, four out of six hypotheses were supported. By using different samples, our finding supported the original model and provided more research opportunities to apply this construct and model to different contexts and situations.

Digital/virtual gift purchasing and giving (gifting thereafter) is a business model that has emerged in the context of the social live streaming service (SLSS). In this study, we argue that both SLSS and its gifting model are largely established upon the application of game and game-like design elements and principles in the non-game environment – a process known as gamification. The system and content qualities of SLSS gamification exercise activating effects on users’ intrinsic and extrinsic motivations for gifting behavior – a transactional process that can serve as a novel model for the electronic commerce (E-Commerce) industry to leverage customers’ transactional behaviors. Built upon the gamification literature, this study develops a research model to investigate SLSS gamification and its motivating effects on users’ gifting behaviors. The model is validated using a cross-sectional field survey of 697 SLSS users. The theoretical and practical implications as well as limitations and future research are discussed in the Chinese E-Commerce context.

Social media services become a hotbed for rumors and lies during health crises such as the COVID-19 pandemic. While previous literature studies the negative role that social media users play in spreading rumors during crises, this study explores how users can be motivated to combat COVID-19 rumors. We build a research model that is based on the Awareness-Motivation-Capability framework and empirically test our model using data collected from 279 Chinese social media users. Our results show that rumor combating behavior, defined as users’ actions to discourage others from sharing information from unverified sources, is influenced directly by the personal norm, altruism, social ties, and knowledge, and indirectly by perceived severity and perceived vulnerability through the personal norm. Our study highlights the importance of prosocial behavior such as rumor combating on social media during health crises.

The relationship between abusive supervision and employee workplace deviance has received much attention. Conceptualizing information systems (IS) misuse as a form of workplace deviance, the literature on IS security lacks a theoretical and empirical investigation of the relationship between abusive supervision and employee IS misuse. Drawing on retaliation, displaced aggression, and neutralization, we develop and empirically test a research model of the relationships among abusive supervision, neutralization, and two types of employees’ IS misuse. Results of a two-stage survey of 203 responses showed that when individuals perceived abusive supervision, they were likely to invoke the metaphor of the ledger as a neutralization technique to rationalize their engagement in IS misuse. Our results also reveal that employees’ reactions to abusive supervision could be influenced by their tenure with supervisor. These findings contribute to the IS security field and provide important guidance for learning how leaders influence employees’ IS security behaviors.

Information systems security is a major organizational concern. This study examines the role of vicarious experience on an individual's behavioral intent to perform a secure recommended response. The protection motivation theory model is expanded to include vicarious experience, which was examined through the separate constructs of vicarious threat experience and vicarious response experience. This study closes a gap in the literature by including vicarious experience in the PMT model and confirming its role as a significant direct influence on the PMT threat and coping constructs, and thus on the PMT model's ability to explain the variance of an individual's intent to perform secure behaviors. Additionally, vicarious experience measures were multi-item reflective scales rather than the single item measures that are more typically used to measure experience. Implications for theory and practice are discussed.

Modern organizations face significant information security threats, to which they respond with various managerial techniques. It is widely believed that “one size does not fit all” for achieving employee information security policy compliance; nevertheless, it is yet to be determined which techniques work best to different organizational employees. We further this research stream by finding that different levels of users might be effectively motivated by different types of coercive and empowering techniques that are suitable to their level and position in the organizational chart. Our results suggest that participation in the ISP decision-making process might prove to be a more effective approach to motivate lower-level employees toward compliance and that enhancing the meaningfulness of policy compliance could be the preferred method among higher levels of management. Members within each level of the organization can be effectively influenced to comply with ISPs when such strategies are customized for their level.

Bring Your Own Device (BYOD) programs permit employees to use personal devices to access organizational information. Users gain convenience, while employers benefit from increased productivity and reduced IT expense. Security boundaries must extend to personal devices to mitigate data exfiltration, thereby infringing on employees’ privacy by monitoring their personal devices. These monitoring mechanisms play a critical role in employee participation in a BYOD program. Our results demonstrate that the BYOD monitoring mechanisms and privacy concerns suppress the benefits of increased job performance expectancy when evaluating whether to participate in a BYOD program. This research identifies that tasks measured, frequency of monitoring, and organizational control are significant impediments to behavioral intention for BYOD participation.

Insiders represent a major threat to the security of an organization’s information resources. Previous research has explored the role of dispositional and situational factors in promoting compliant behavior, but these factors have not been studied together. In this study, we use a scenario-based factorial survey approach to identify key dispositional and situational factors that lead to information security policy violation intentions. We obtained 317 observations from a diverse sample of insiders. The results of a general linear mixed model indicate that dispositional factors (particularly two personality meta-traits, Stability and Plasticity) serve as moderators of the relationships between perceptions derived from situational factors and intentions to violate information security policy. This study represents the first information security study to identify the existence of these two meta-traits and their influence on information security policy violation intentions. More importantly, this study provides new knowledge of how insiders translate perceptions into intentions based on their unique personality trait mix.

Teachers play a key role in adoption of technologies for classroom use. This study surveyed teachers regarding their intention to use tablet technology to interact with students and other teachers through smart school websites technology. The Unified Theory of Acceptance and Use of Technology (UTAUT) served as the theoretical framework for this study, which was then augmented with context-specific determinants of adoption that captured teachers’ perceptions of the effects of technology on interactions with students and peers. The results showed no resistance among teachers with regard to trying different ways of working with tablets to achieve better learning, unlike other studies using the UTAUT constructs that have found negative reactions to implementing new technologies in the workplace. This is a crucial finding, since teacher appraisals affect the ways in which this technology can be employed to foster learning through technology facilitated interactions.

Information systems (IS) and IS research have been transformed by the globalization of organizations, of IT processes, and of perspectives on IT phenomena. China and other Eastern cultures are cont...

As we are continually confronted with increasingly sophisticated electronic messages, distinguishing messages that are valid from irrelevant, malicious, or otherwise undeserving of the recipient's attention has become an extremely important task. The present study leverages the lens of information manipulation theory (IMT) to analyze the impact of perceived message quality and quantity on perceived source competence and message honesty, and their subsequent impact on perceived risk, which is an individual's assessment of the potential harm that could result from accepting a deceitful message as valid. We administered phishing scenarios to subjects and evaluated their responses to survey items related to the given scenario. The data indicate that perceived message honesty, third-party support, and technology anxiety influence risk perceptions of a message. In addition, message quality, as defined by IMT, strongly influences individual perceptions of honesty.

Data loss represents a significant threat to individuals and organizations. Based on Protection Motivation Theory (PMT) and service convenience literature, a theoretical model is developed to empirically assess how the threat of data loss and the convenience of cloud-based backup solutions affect a user's intentions to adopt the cloud as a sufficient backup alternative. The factorial survey method was employed, using realistic vignettes to orthogonally manipulate the independent variables and offer more experimental control. Hypotheses were tested using 152 individuals recruited from a large southeastern university. Results from the study indicate that users who perceive the cloud to seamlessly back up their data with minimal effort and replicate their data across all of their devices are more likely to adopt the cloud for data backups. Further, it is determined that individuals who feel they are more vulnerable to data loss and perceive the data loss as severe will also leverage the cloud when backing up their data. Convenience is more influential than threat perceptions when individuals are evaluating cloud adoption, providing implications for individual users exploring the possibility of cloud-based storage solutions.

We utilize choice-based conjoint analysis (CBC), a novel methodological approach for IS decision-making research, to investigate the relative importance of the critical factors in the decision models of consumers when evaluating intention to use mobile office services. From a survey of working professionals, we extract the hierarchy of relative importance of each critical factor influencing the adoption decision. We found that moderate usefulness is the threshold that vendors should try to achieve and simple design does not differ significantly from the design with moderate complexity. The applicability of CBC analysis in IS research is established; guidelines and implications for IT designers, managers, and researchers are presented. Our findings enable practitioners to pursue practical questions such as: 1) which factors are consumers most concerned with when electing to adopt MO technology for professional communications? and 2) what is the tradeoff that consumers might make for accepting and adopting MO technology?

Instant messaging (IM) technologies are being rapidly deployed in the workplace. Current studies largely focus on the adoption of IM and how IM is used. Little research has been conducted to understand the potential impact of using IM in the workplace. This paper theorizes and empirically tests how the frequency of IM interruptions and the position power of message sender could interact with an individual’s polychronic orientation, that is, multitasking preference, and jointly influence employee satisfaction and subjective task complexity. The present study illustrates that polychronic knowledge workers are more satisfied with the multitasking work process deploying IM technology than monochronic ones. In addition, the effect of interruptions is dependent upon an individual’s polychronic orientation. The increase in interruption frequency only reduces the process satisfaction of monochronic individuals but not polychronic individuals. Further, the polychronic orientation of message receivers also influences how they process information. When IM messages are sent from their supervisors, monochronic individuals tend to prioritize tasks and perceive a lower level of overall task complexity. The information processing of polychronic individuals seem to be less influenced by the position power of message sender.

Throughout the world, sensitive personal information is now protected by regulatory requirements that have translated into significant new compliance oversight responsibilities for IT managers who have a legal mandate to ensure that individual employees are adequately prepared and motivated to observe policies and procedures designed to ensure compliance. This research project investigates the antecedents of information privacy policy compliance efficacy by individuals. Using Health Insurance Portability and Accountability Act compliance within the healthcare industry as a practical proxy for general organizational privacy policy compliance, the results of this survey of 234 healthcare professionals indicate that certain social conditions within the organizational setting (referred to as external cues and comprising situational support, verbal persuasion, and vicarious experience) contribute to an informal learning process. This process is distinct from the formal compliance training procedures and is shown to influence employee perceptions of efficacy to engage in compliance activities, which contributes to behavioural intention to comply with information privacy policies. Implications for managers and researchers are discussed.

Modern global economic and political conditions, technological infrastructure, and socio-cultural developments all contribute to an increasingly turbulent and dynamic environment for organizations,...

To trust means to have expectations about others’ (the trustees’) socially acceptable behavior. One of the central effects of this trust in the context of IT adoption is to increase the perceived usefulness (PU) of Information Technology (IT) associated with the trustee’s agency. One way of increasing this trust is through greater sociocultural similarity. Taking previous research into the realm of electronic voting, this paper posits that because trust is culture-dependent, it should decrease considerably as cultural diversity and differentiation increases. To investigate the role of trust in IT adoption in different cultures where dissimilar concepts of socially acceptable behavior exist, this study compares trust-related perceptions of an emerging IT (i.e., electronic voting) between the United States of America (USA) and the Republic of South Africa (RSA). More specifically, the question was addressed by comparing the unique circumstances of the cultural changes in the RSA with the more socially integrated mainstream USA culture. In both cultures, a perceived sociocultural similarity between the individual and the agency in charge of the electronic voting IT contributed to both the establishment of trust and to an increase in the perceived usefulness of the IT, supporting and extending the extrapolations of past propositions to this new realm. However, only in the USA did trust contribute to the PU of the IT. The results suggest that when cultural diversity is large, trust becomes of lesser importance, perhaps because it can no longer reduce social uncertainty. Implications for researchers and governmental voting agencies are discussed, and future research directions are proposed.