User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach

References

• Ajzen I.Attitudes, Personality, and Behavior (1988) (Dorsey Press, Chicago) Google Scholar
• Alder G. S., Noel T. W., Ambrose M. L. Clarifying the effects of Internet monitoring on job attitudes: The mediating role of employee trust. Inform. Management (2006) 43(7):894–903Crossref, Google Scholar
• Alm J., McKee M. Audit certainty, audit productivity, and taxpayer compliance. National Tax J. (2006) 59(4):801–816Crossref, Google Scholar
• AMA 2005 Electronic monitoring and surveillance survey. (2005) (American Management Association, New York) Google Scholar
• Anderson J. C., Gerbing D. W. Structural equation modeling in practice: A review and recommended two-step approach. Psych. Bull. (1988) 103(3):411–423Crossref, Google Scholar
• Armstrong J. S., Overton T. S. Estimating nonresponse bias in mail surveys. J. Marketing Res. (1977) 14):396–402Crossref, Google Scholar
• Bachman R., Paternoster R., Ward S. The rationality of sexual offending: Testing a deterrence/rational choice conception of sexual assault. Law Soc. Rev. (1992) 26(2):343–372Crossref, Google Scholar
• Banerjee D., Cronan T. P., Jones T. W. Modeling IT ethics: A study in situational ethics. MIS Quart. (1998) 22(1):31–60Crossref, Google Scholar
• Baskerville R., Siponen M. An information security meta-policy for emergent organizations. Logist. Inform. Management (2002) 15(5/6):337–346Crossref, Google Scholar
• Berinato S. The global state of information security 2005. CIO Magazine (2005) 15(September):60–72Google Scholar
• BSA Second annual BSA and IDC global software piracy study. (2005) (Business Software Alliance, Washington, D.C.) Google Scholar
• Carnes G. A., Englebrecht T. D. An investigation of the effect of detection risk perceptions, penalty sanctions, and income visibility on tax compliance. J. Amer. Taxation Assoc. (1995) 17(1):26–41Google Scholar
• Chin W., Marcoulides G. A. The partial least squares approach to structural equation modeling. Modern Methods For Business Research (1998) (Lawrence Erlbaum Associates, Mahwah, NJ) 295–336Google Scholar
• Chin W., Marcolin B. L., Newsted P. R. A partial least squares latent variable modeling approach for measuring interaction effects: Results from a Monte Carlo simulation study and an electronic mail emotion/adoption study. Inform. Systems Res. (2003) 14(2):189–217Link, Google Scholar
• Christensen A., Eining M. M. Instructional case: Software piracy—Who does it impact? Issues Accounting Ed. (1994) 9(1):151–159Google Scholar
• Cole C. A. Deterrence and consumer fraud. J. Retailing (1989) 65(1):107–120Google Scholar
• Compeau D. R., Higgins C. A. Computer self-efficacy: Development of a measure and initial test. MIS Quart. (1995) 19(2):189–211Crossref, Google Scholar
• DeloitteGlobal Security Survey (2005) (New York)Google Scholar
• Dhillon G. Managing and controlling computer misuse. Inform. Management Comput. Security (1999) 7(4):171–175Crossref, Google Scholar
• Diamantopoulos A., Winklhofer H. M. Index construction with formative indicators: An alternative to scale development. J. Marketing Res. (2001) 38):269–277Crossref, Google Scholar
• Dubin J. A., Graetz M. J., Wilde L. L. The effect of audit rates on the federal individual income tax, 1977–1986. National Tax J. (1990) 43(4):395–409Google Scholar
• Ernst and YoungGlobal Information Security Survey (2003) (New York)Google Scholar
• Falk R. F., Miller N. B.A Primer for Soft Modeling (1992) (University of Akron Press, Akron, OH) Google Scholar
• Ferguson M., Sheehan M., Davey J., Watson B.Drink Driving Rehabilitation: The Present Context—A Road Safety Research Report (1999) (Centre for Accident Research and Road Safety, Brisbane, Australia) . Available online at: http://www.atsb.gov.au/publications/1999/pdf/Alc_Rehab_2.pdfGoogle Scholar
• Finch J. The vignette technique in survey research. Sociology (1987) 21(1):105–114Crossref, Google Scholar
• Finch J. H., Furnell S. M., Dowland P. S. Assessing IT security culture: System administrator and end-user. Proc. ISOneWorld Conf. (2003) Las Vegas, NV:16–20Google Scholar
• Foltz C. B. The impact of deterrent countermeasures upon individual intent to commit misuse: A behavioral approach. (2000) . Unpublished doctoral dissertation, University of Arkansas, FayettevilleGoogle Scholar
• Forcht K. A.Computer Security Management (1994) (Boyd & Fraser, Danvers, MA) Google Scholar
• Fornell C., Larcker D. F. Evaluating structural equation models with unobservable variables and measurement error. J. Marketing Res. (1981) 18(1):39–50Crossref, Google Scholar
• Forrester ResearchThe State of Data Security in North America (2007) (Cambridge, MA)Google Scholar
• Fotiva, Inc. Risky business: New survey shows almost 70 percent of e-mail-using employees have sent or received e-mail that may pose a threat to businesses. (2005) . Available online at: http://www.harrisinteractive.com/news/newsletters/clientnews/Fortiva2005.pdfGoogle Scholar
• Freeman J., Watson B. An application of Stafford and Warr's reconceptualisation of deterrence to a group of recidivist drink drivers. Accident Anal. Prevention (2006) 38):462–471Crossref, Google Scholar
• Furnell S. M., Gennatou M., Dowland P. S. A prototype tool for information security awareness and training. Logist. Inform. Management (2002) 15(5/6):352–357Crossref, Google Scholar
• Furnell S. M., Dowland P. S., Illingworth H. M., Reynolds P. L. Authentication and supervision: A survey of user attitudes. Comput. Security (2000) 19(6):529–539Crossref, Google Scholar
• Gaston S. J.Information Security: Strategies for Successful Management (1996) (CICA Publishing, Toronto) Google Scholar
• Gattiker U. E., Kelley H. Morality and computers: Attitudes and differences in moral judgments. Inform. Systems Res. (1999) 10(3):233–254Link, Google Scholar
• Gefen D., Straub D. A practical guide to factorial validity using PLS-graph: Tutorial and annotated example. Comm. AIS (2005) 16(5):91–109Google Scholar
• George J. F. Computer-based monitoring: Common perceptions and empirical results. MIS Quart. (1996) 20(4):459–480Crossref, Google Scholar
• Gibbs J. P.Crime, Punishment, and Deterrence (1975) (Elsevier, New York) Google Scholar
• Glenn D., Browne G. J., Wetherbe J. C. Why do Internet users stick with a specific web site? A relationship perspective. Internat. J. Electronic Commerce (2006) 10(4):105–141Crossref, Google Scholar
• Gopal R. D., Sanders G. L. Preventative and deterrent controls for software piracy. J. Management Inform. Systems (1997) 13(4):29–47Crossref, Google Scholar
• Grasmick H. G., Bryjak G. J. The deterrent effect of perceived severity of punishment. Soc. Forces (1980) 59(2):471–491Crossref, Google Scholar
• Grasmick H. G., Green D. E. Deterrence and the morally committed. Sociol. Quart. (1981) 22):1–14Crossref, Google Scholar
• Hair J. F., Anderson R. E., Tatham R. L., Black W. C.Multivariate Data Analysis (1998) (Prentice Hall, Englewood Cliffs, NJ) Google Scholar
• Hansche S. Designing a security awareness program: Part 1. Inform. Systems Security (2001) 9(6):14–22Crossref, Google Scholar
• Harrington S. J. The effect of codes of ethics and personal denial of responsibility on computer abuse judgments and intentions. MIS Quart. (1996) 20(3):257–278Crossref, Google Scholar
• Hoffer J. A., Straub D. W. The 9 to 5 underground: Are you policing computer crimes? Sloan Management Rev. (1989) 30(4):35–43Google Scholar
• Hollinger R. C., Clark J. P. Deterrence in the workplace: Perceived certainty, perceived severity, and employee theft. Soc. Forces (1983) 62(2):398–418Crossref, Google Scholar
• InformationWeek U.S. Information Security Research Report 2005. (2005) . United Business Media, LondonGoogle Scholar
• Jarvis C. B., Mackenzie P. M., Podsakoff P. M. A critical review of construct indicators and measurement model misspecification in marketing and consumer research. J. Consumer Res. (2003) 30(2):199–218Crossref, Google Scholar
• Kankanhalli A., Teo H.-H., Tan B. C. Y., Wei K.-K. An integrative study of information systems security effectiveness. Internat. J. Inform. Management (2003) 23(2):139–154Crossref, Google Scholar
• Keil M., Tan B., Wei K. K., Saarinen V., Tuunainen V., Wassenaar A. A cross-cultural study of escalation of commitment in software projects. MIS Quart. (2000) 24(2):299–325Crossref, Google Scholar
• Kerlinger F. N.Foundations of Behavioral Research (1986) 3rd ed.(Holt, Rinehart & Winston, New York) Google Scholar
• Kinsey K. A., Slemrod J. Deterrence and alienation effects of IRS enforcement: An analysis of survey data. Why People Pay Taxes (1992) (University of Michigan Press, Ann Arbor) 259–285Google Scholar
• Klepper S., Nagin D. The deterrent effect of perceived certainty and severity of punishment revisited. Criminology (1989) 27(4):721–746Crossref, Google Scholar
• Kohlberg L., Lickona T. Moral stages and moralization: The cognitive-developmental approach. Moral Development and Behavior (1976) (Holt, Rinehart, and Winston, New York) 31–53Google Scholar
• Lee J., Lee Y. A holistic model of computer abuse within organizations. Inform. Management Comput. Security (2002) 10(2):57–63Crossref, Google Scholar
• Lee S. M., Lee S.-G., Yoo S. An integrative model of computer abuse based on social control and general deterrence theories. Inform. Management (2004) 41(6):707–718Crossref, Google Scholar
• Leonard L. N. K., Cronan T. P. Illegal, inappropriate, and unethical behavior in an information technology context: A study to explain influences. J. Assoc. Inform. Systems (2001) 1(12):1–31Google Scholar
• Leonard L. N. K., Cronan T. P., Kreie J. What influences IT ethical behavior intentions—Planned behavior, reasoned action, perceived importance, individual characteristics? Inform. Management (2004) 42(1):143–158Crossref, Google Scholar
• Lin T.-C., Hsu M.-H., Kuo F.-Y., Sun P.-C. An intention model-based study of software piracy. Proc. 32nd Hawaii Internat. Conf. System Sci. (1999) (IEEE Computer Society, Maui, HI) Google Scholar
• Lindell M. K., Whitney D. J. Accounting for common method variance in cross-sectional research designs. J. Appl. Psych. (2001) 86(1):114–121Crossref, Google Scholar
• Loch K. D., Straub D., Kamel S. Diffusing the Internet in the Arab world: The role of social norms and techological culturation. IEEE Trans. Engrg. Management (2003) 50(1):45–63Crossref, Google Scholar
• MacCoun R. J. Drugs and the law: A psychological analysis of drug prohibition. Psych. Bull. (1993) 113(3):497–512Crossref, Google Scholar
• MacMath B., Prentice-Dunn S. Protection motivation theory and skin cancer risk: The role of individual differences in response to persuasive appeals. J. Appl. Soc. Psych. (2005) 35(3):621–643Crossref, Google Scholar
• Magklaras G. B., Furnell S. M. Insider threat prediction tool: Evaluating the probability of IT misuse. Comput. Security (2002) 21(1):62–73Crossref, Google Scholar
• Malhotra N. K., Kim S. S., Patil A. Common method variance in IS research: A comparison of alternative approaches and a reanalysis of past research. Management Sci. (2006) 52(12):1865–1883Link, Google Scholar
• Mason R. Four ethical issues of the information age. MIS Quart. (1986) 10(1):4–12Crossref, Google Scholar
• McNees M. P., Egli D. S., Marshall R. S., Schnelle J. F., Risley T. R. Shoplifting prevention: Providing information through signs. J. Appl. Behav. Anal. (1976) 9(4):399–405Crossref, Google Scholar
• Nagin D. S., Pogarsky G. Integrating celerity, impulsivity, and extralegal sanction threats into a model of general deterrence and evidence. Criminology (2001) 39(4):865–891Crossref, Google Scholar
• Nienstedt B. C. Testing deterrence: The effects of a DWI law and publicity campaigns. (1985) . Unpublished doctoral dissertation, Arizona State University, TempeGoogle Scholar
• Panko R. R., Beh H. G. Monitoring for pornography and sexual harassment. Comm. ACM (2002) 45(1):84–87Crossref, Google Scholar
• Paradice D. B. Ethical attitudes of entry-level MIS personnel. Inform. Management (1990) 18(3):143–151Crossref, Google Scholar
• Parker D. B.Fighting Computer Crime (1998) (John Wiley & Sons, New York) Google Scholar
• Paternoster R. The deterrent effect of the perceived certainty and severity of punishment: A review of the evidence and issues. Justice Quart. (1987) 4(2):173–217Crossref, Google Scholar
• Paternoster R. Decision to participate in and desist from four types of common delinquency: Deterrence and the rational choice perspective. Law Soc. Rev. (1989) 23(1):7–40Crossref, Google Scholar
• Patnayakuni R., Rai A., Seth N. Relational antecedents of information flow integration for supply chain coordination. J. Management Inform. Systems (2006) 23(1):13–49Crossref, Google Scholar
• Peace A. G., Galletta D. F., Thong J. Y. L. Software piracy in the workplace: A model and empirical test. J. Management Inform. Systems (2003) 20(1):153–177Crossref, Google Scholar
• Pechmann C., Zhao G., Goldberg M., Reibling E. What to convey in antismoking advertisements for adolescents: The use of protection motivation theory to identify effective message themes. J. Marketing (2003) 67(2):1–18Crossref, Google Scholar
• Peltier T. R. Implementing an information security awareness program. Inform. Systems Security (2005) 14(2):37–49Crossref, Google Scholar
• Pierce M. A., Henry J. W. Judgments about computer ethics: Do individual, co-worker, and company judgments differ? J. Bus. Ethics (2000) 28(4):307–322Crossref, Google Scholar
• Podsakoff P. M., Mackenzie S. B., Lee J. Y., Podsakoff N. P. Common method biases in behavioral research: A critical review of the literature and recommended remedies. J. Appl. Psych. (2003) 88(5):879–903Crossref, Google Scholar
• Quazi M. M. Effective drug-free workplace plan uses worker testing as a deterrent. Occupational Health Safety (1993) 62(6):26–31Google Scholar
• Richardson R.CSI/FBI Computer Crime and Security Survey (2007) (Computer Security Institute, San Francisco) Google Scholar
• Rogers R., Cacioppo J., Petty R. Cognitive and physiological processes in fear-based attitude change: A revised theory of protection motivation. Social Psychophysiology: A Sourcebook (1983) (Guilford, New York) 153–176Google Scholar
• Sacco V. F. Shoplifting prevention: The role of communication-based intervention strategies. Canadian J. Criminology (1985) 27(1):15–29Google Scholar
• Silberman M. Toward a theory of criminal deterrence. Amer. Sociol. Rev. (1976) 41(3):442–461Crossref, Google Scholar
• Skinner W. F., Fream A. M. A social learning theory analysis of computer crime among college students. J. Res. Crime Delinquency (1997) 34(4):495–518Crossref, Google Scholar
• Spitzmuller C., Stanton J. M. Examining employee compliance with organizational surveillance and monitoring. J. Occupational Organ. Psych. (2006) 79):245–272Crossref, Google Scholar
• Standage T. The weakest link. Economist (2002) 365(8296):11–16Google Scholar
• Stanton J. M., Weiss E. M. Electronic monitoring in their own words: An exploratory study of employees' experiences with new types of surveillance. Comput. Human Behav. (2000) 16(4):423–440Crossref, Google Scholar
• Stanton J. M., Stam K. R., Mastrangelo P. R., Jolton J. An analysis of end user security behaviors. Comput. Security (2005) 24(2):124–133Crossref, Google Scholar
• Straub D. W. Effective IS security: An empirical study. Inform. Systems Res. (1990) 1(3):255–276Link, Google Scholar
• Straub D. W., Nance W. D. Discovering and disciplining computer abuse in organizations: A field study. MIS Quart. (1990) 14(1):45–60Crossref, Google Scholar
• Straub D. W., Welke R. J. Coping with systems risk: Security planning models for management decision making. MIS Quart. (1998) 22(4):441–469Crossref, Google Scholar
• Strelan P., Boeckmann R. J. Why drug testing in elite sport does not work: Perceptual deterrence theory and the role of personal moral beliefs. J. Appl. Soc. Psych. (2006) 36(12):2909–2934Crossref, Google Scholar
• Theoharidou M., Kokolakis S., Karyda M., Kiountouzis E. The insider threat to information systems and the effectiveness of ISO17799. Comput. Security (2005) 24(6):472–484Crossref, Google Scholar
• Tittle C. R.Sanctions and Social Deviance: The Question of Deterrence (1980) (Praeger, New York) Google Scholar
• United Nations Conference on Trade and Development, Information Economy Report. (2005) Geneva, Switzerland http://www.unctad.org/en/docs/sdteecb20051overview_en.pdfGoogle Scholar
• Urbaczewski A., Jessup L. M. Does electronic monitoring of employee Internet usage work? Comm. ACM (2002) 45(1):80–83Crossref, Google Scholar
• Verespej M. A. Inappropriate Internet surfing. Indust. Week (2000) 29(3):59–64Google Scholar
• von Hirsch A., Bottoms A. E., Burney E., Wikstrom P. O.Criminal Deterrence and Sentence Severity: An Analysis of Recent Research (1999) (Oxford Publishing, Oxford, UK) Google Scholar
• von Solms R., von Solms B. From policies to culture. Comput. Security (2004) 23(4):275–279Crossref, Google Scholar
• Wentzel M. The social side of sanctions: Personal and social norms as moderators of deterrence. Law Human Behav. (2004) 28(5):547–567Crossref, Google Scholar
• Whitman M. E. Enemy at the gate: Threats to information security. Comm. ACM (2003) 46(8):91–95Crossref, Google Scholar
• Whitman M. E. In defense of the realm: Understanding the threats to information security. Internat. J. Inform. Management (2004) 24(1):43–57Crossref, Google Scholar
• Whitman M. E., Mattord H.Principles of Information Security (2005) (Course Technology, Boston) Google Scholar
• Whitman M. E., Townsend A. M., Alberts R. J., Khosrowpour M. Information systems security and the need for policy. Information Security Management: Global Challenges in the New Millennium (2001) (Idea Group Publishing, Hershey, PA) 9–18Crossref, Google Scholar
• Wiant T. L. Policy and its impact on medical record security. (2003) . Unpublished doctoral dissertation, University of Kentucky, LexingtonGoogle Scholar
• Witte D., Woodbury D. The effect of tax laws and tax administration on tax compliance: The case of the U.S. individual income tax. National Tax J. (1985) 38(1):1–13Google Scholar
• Workman M., Gathegi J. Punishment and ethics deterrents: A study of insider security contravention. J. Amer. Soc. Inform. Sci. Tech. (2007) 58(2):212–222Crossref, Google Scholar
• Wybo M. D., Straub D. W. Protecting organizational information resources. Inform. Resources Management J. (1989) 2(4):1–15Crossref, Google Scholar