Journal Article

Toward a Theory of Information Systems Security Behaviors of Organizational Employees: A Dialectical Process Perspective

Siponen, Mikko, Karjalainen, Mari, Sarker, Suprateek

2019

Overview

Practice-/policy-oriented abstract: Understanding why employees do or do not comply with information systems security (ISS) procedures is an imperative in today’s organizations whose futures often depend on how well they protect and harness information assets. We use a predominantly inductive approach to develop a theoretical understanding of how employees’ reasons for engaging to ISS behaviors (ISSBs) change over time, using ideas from dialectics as our scaffolding. Our dialectical view of this process suggests that explanations for engaging in different ISSBs change over time as individuals seek to balance contradictory demands. Furthermore, our view suggests that new experiences and external events initiate a process of reevaluating tensions that can in turn lead to behavioral changes. Based on our observations and interpretation, we conclude that it is beneficial for ISS practitioners not only to be aware of factors that seem to promote compliance with ISSPs, but also to pay attention to the importance of opposing values and pressures, triggers, and ways to resolve the existing tensions related to an individual’s ISSBs. This will likely enable awareness about the dilemmas that individuals confront in ISS-related situations and potentially contribute to the design of better controls and procedures for ensuring compliant ISSBs. The various guidelines, procedures, and policies referred to as information systems security procedures (ISSPs) underlie information systems security behaviors (ISSBs) of many employees in organizations. Understanding the reasons for ISSBs—that is, why employees do or do not comply with ISSPs—is an imperative in today’s organizations, given that information is a valuable asset. In our study, we observed that employees’ reasons for engaging in ISSBs, such as selecting a password, locking a computer, and using a USB memory device, changed over time. Noting that the dynamic nature of ISSBs has not yet received sufficient consideration in information systems security (ISS) research, we use a predominantly inductive approach to develop a theoretical understanding of the ISSB change process, sensitized by ideas from dialectics. Our dialectical process view suggests that explanations for engaging in different ISSBs are not static but change over time as individuals seek to deal with, or balance, tensions or contradictory demands. Furthermore, our view suggests that “change triggers” (e.g., new experiences and external events) initiate a process of reevaluating tensions that can, in turn, lead to changes in ISSBs. A number of implications for future research and practice emerge from this dialectical understanding of the ISSB change process. The online appendix is available at https://doi.org/10.1287/isre.2018.0827 .

• Publisher: INFORMS,Institute for Operations Research and the Management Sciences
• Subject: Behavior / case study / Cybersecurity / Data buses / Data entry / Data integrity / Data security / Dialectical materialism / Dialectics / Employees / Information systems / information systems security behavior / interpretive research / Locking / Memory devices / Organizations / process theory / Sensitivity analysis / Workers