본문 바로가기
KERD
논문KCI 등재

조직구성원의 정보보안 준수 및 미준수 원인에 대한 연구

A study on the information security compliance and non-compliance causes of organization employees

허성호|황인호
한국융합학회 (Korea Convergence Society)|2020.09|한국융합학회논문지 (Journal of the Korea Convergence Society)|제11권 제9호|pp. 229-242|DOI https://doi.org/10.15207/JKCS.2020.11.9.229

1

조회

0

다운로드

7

인용

0

참고문헌

키워드

조직몰입비가시성준수의도정보보안 정책정보보안 시스템정보보안 기술적 지원업무장애
주제분류학제간연구

초록

본 연구의 목적은 정보보안 준수의도에 영향을 주는 긍정적, 부정적 측면의 환경적 요인을 제시하고, 개인의 보안 준수의도와의 영향관계를 찾는 것이다. 연구대상은 정보보안 정책 및 기술을 적용하는 조직의 구성원들이며, 설문조사를 통하여 유효표본을 확보하였다. 분석과정에서 구조방정식모델링을 통해 연구모델에 대한 검증을 하였다. 측정변수는 정보보안 정책, 정보보안 시스템, 정보보안 기술적 지원, 업무장애, 비가시성, 조직몰입, 준수의도로 구성하여 분석에 활용하였다. 결과는 보안 준수요인인 정책, 시스템, 기술적 지원과 미준수 요인인 업무 장애가 각각 조직몰입에 영향을 주었으며, 준수의도로 이어지는 것을 확인하였다. 연구 모델의 검증 결과를 토대로 조직의 정보보안 준수 수준 향상을 위한 구성원들의 보안 준수 전략 수립의 방향성을 제시하였다.

Abstract

The purpose of this study is to present the environmental factors of positive and negative aspects that affect the information security compliance intention, and reveals the relationship of the individual's the security compliance intention. The subjects of this study are employees of organizations that apply information security policies and technologies, and effective samples were obtained through surveys. In the process of analysis, the study model was verified through structural equation modeling. The measurement variables consisted of security policy, security system, technical support, work impediment, security non-visibility, compliance intention and organizational commitment and used for analysis. The results confirmed that security compliance factors such as policy, system, technical support, and non-compliance factors, work impediment, respectively, had an impact on organizational commitment, leading to compliance intention. The verification result of the research model suggests the direction of establishing a security compliance strategy for employees to improve the level of information security compliance of the organization.

참고문헌 (50)

  1. "Cyber security market size, share & trends analysis report by component, by security type, by solution, by service, by deployment, by organization, by application, and segment Forecasts" (2019)[URL]
  2. Gartner, "A look at cyber-security spending in 2019: Where budgets are increasing and why", ~ (2019)
  3. 2019 data breach investigations report, "Verizon", ~ (2019)
  4. John D’Arcy, "Predicting employee information security policy compliance on a daily basis: The interplay of security-related stress, emotions, and neutralization", Information & Management, 56(7), pp.103151~ (2019), Elsevier BV[DOI]
  5. Inho Hwang, "Security Awareness: The First Step in Information Security Compliance Behavior", Journal of Computer Information Systems, pp.1~12 (2019), Informa UK Limited[DOI]
  6. 이항, "정보보안 종사자의 감정노동과 업무성과 간의 구조적 관계에 대한 융합연구", 한국융합학회논문지, 9(1), pp.67~74 (2018), 한국융합학회[DOI]
  7. Ryan West, "The psychology of security", Communications of the ACM, 51(4), pp.34~40 (2008), Association for Computing Machinery (ACM)[DOI]
  8. Mohammad I. Merhi, "Examining the impact of deterrence factors and norms on resistance to Information Systems Security", Computers in Human Behavior, 92, pp.37~46 (2019), Elsevier BV[DOI]
  9. Nader Sohrabi Safa, "Deterrence and prevention-based model to mitigate information security insider threats in organisations", Future Generation Computer Systems, 97, pp.587~597 (2019), Elsevier BV[DOI]
  10. Hui-Lien Chou, "An analysis of multiple factors relating to teachers' problematic information security behavior", Computers in Human Behavior, 65, pp.334~345 (2016), Elsevier BV[DOI]
  11. Clay Posey, "The Impact of Organizational Commitment on Insiders’ Motivation to Protect Organizational Information Assets", Journal of Management Information Systems, 32(4), pp.179~214 (2016), Informa UK Limited[DOI]
  12. Zauwiyah Ahmad, "Security monitoring and information security assurance behaviour among employees", Information & Computer Security, 27(2), pp.165~188 (2019), Emerald[DOI]
  13. Salvatore Aurigemma, "Deterrence and punishment experience impacts on ISP compliance attitudes", Information & Computer Security, 25(4), pp.421~436 (2017), Emerald[DOI]
  14. John D'Arcy, "Understanding Employee Responses to Stressful Information Security Requirements: A Coping Perspective", Journal of Management Information Systems, 31(2), pp.285~318 (2014), Informa UK Limited[DOI]
  15. Inho Hwang, "Examining technostress creators and role stress as potential threats to employees' information security compliance", Computers in Human Behavior, 81, pp.282~293 (2018), Elsevier BV[DOI]
  16. I. Hwang, "Why not comply with information security? An empirical approach for the causes of non-compliance", Online Information Review, 41(1), pp.1~17 (2017)[DOI]
  17. B. Bulgurcu, "Information security policy compliance : An empirical study of rationality-based beliefs and information security awareness", MIS Quarterly, 34(3), pp.523~548 (2010)
  18. Nader Sohrabi Safa, "An information security knowledge sharing model in organizations", Computers in Human Behavior, 57, pp.442~451 (2016), Elsevier BV[DOI]
  19. Larry J. Williams, "Job Satisfaction and Organizational Commitment as Predictors of Organizational Citizenship and In-Role Behaviors", Journal of Management, 17(3), pp.601~617 (1991), SAGE Publications[DOI]
  20. R. Mowday, "Employee-organizational linkages : The psychology of commitment, absenteeism and turnover" (1982), Academic Press
  21. Natalie J. Allen, "Affective, Continuance, and Normative Commitment to the Organization: An Examination of Construct Validity", Journal of Vocational Behavior, 49(3), pp.252~276 (1996), Elsevier BV[DOI]
  22. John P. Meyer, "Affective, Continuance, and Normative Commitment to the Organization: A Meta-analysis of Antecedents, Correlates, and Consequences", Journal of Vocational Behavior, 61(1), pp.20~52 (2002), Elsevier BV[DOI]
  23. Nader Sohrabi Safa, "Motivation and opportunity based model to reduce information security insider threats in organisations", Journal of Information Security and Applications, 40, pp.247~257 (2018), Elsevier BV[DOI]
  24. Tejaswini Herath, "Protection motivation and deterrence: a framework for security policy compliance in organisations", European Journal of Information Systems, 18(2), pp.106~125 (2017), Informa UK Limited[DOI]
  25. Shwadhin Sharma, "Do I really belong?: Impact of employment status on information security policy compliance", Computers & Security, 87, pp.101397~ (2019), Elsevier BV[DOI]
  26. Michael E. Whitman, "In defense of the realm: understanding the threats to information security", International Journal of Information Management, 24(1), pp.43~57 (2004), Elsevier BV[DOI]
  27. John D'Arcy, "User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach", Information Systems Research, 20(1), pp.79~98 (2009), Institute for Operations Research and the Management Sciences (INFORMS)[DOI]
  28. 임명성, "보안정책 준수 비용과 정보보안 중요성 인식 수준에 미치는 요인에 관한 연구: 중소기업을 중심으로", 한국융합학회논문지, 9(9), pp.69~81 (2018), 한국융합학회[DOI]
  29. Kenneth J. Knapp, "Information security policy: An organizational-level process model", Computers & Security, 28(7), pp.493~508 (2009), Elsevier BV[DOI]
  30. 정기선, "가족친화적 정책이 종업원들의 조직 몰입에 미치는 효과", 가족과 문화, 17(1), pp.59~84 (2005), 한국가족학회
  31. Susan C. Eaton, "If You Can Use Them: Flexibility Policies, Organizational Commitment, and Perceived Performance", Industrial Relations, 42(2), pp.145~167 (2003), Wiley[DOI]
  32. Lam‐for Kwok, "Information security management and modelling", Information Management & Computer Security, 7(1), pp.30~40 (1999), Emerald[DOI]
  33. Agata McCormac, "Individual differences and Information Security Awareness", Computers in Human Behavior, 69, pp.151~156 (2017), Elsevier BV[DOI]
  34. Ebru Yeniman Yildirim, "Factors influencing information security management in small- and medium-sized enterprises: A case study from Turkey", International Journal of Information Management, 31(4), pp.360~365 (2011), Elsevier BV[DOI]
  35. A. Da Veiga, "A framework and assessment instrument for information security culture", Computers & Security, 29(2), pp.196~207 (2010), Elsevier BV[DOI]
  36. Philip Shum, "Employees' affective commitment to change", European Journal of Marketing, 42(11, pp.12) (2008), 1346~1371[DOI]
  37. I. Cardoso, "Users’ commitment in information system implementation: The role of technological frames", Mediterranean Conference on Information Systems, pp.254~266 (2012), Springer
  38. Anna Mette Fuglseth, "The effects of technostress within the context of employee use of ICT", Computers in Human Behavior, 40, pp.161~170 (2014), Elsevier BV[DOI]
  39. T. S. Ragu-Nathan, "The Consequences of Technostress for End Users in Organizations: Conceptual Development and Empirical Validation", Information Systems Research, 19(4), pp.417~433 (2008), Institute for Operations Research and the Management Sciences (INFORMS)[DOI]
  40. Monideepa Tarafdar, "Crossing to the dark side", Communications of the ACM, 54(9), pp.113~120 (2011), Association for Computing Machinery (ACM)[DOI]
  41. R.K. Jena, "Technostress in ICT enabled collaborative learning environment: An empirical study among Indian academician", Computers in Human Behavior, 51, pp.1116~1123 (2015), Elsevier BV[DOI]
  42. N. G. Carr., "IT doesn’t matter", Harvard Business Review, 81(5), pp.41~49 (2003)
  43. Liisa Myyry, "What levels of moral reasoning and values explain adherence to information security rules? An empirical study", European Journal of Information Systems, 18(2), pp.126~139 (2017), Informa UK Limited[DOI]
  44. Mikko Siponen, "Compliance with Information Security Policies: An Empirical Investigation", Computer, 43(2), pp.64~71 (2010), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
  45. M. Aryeetey, "Understanding Employees’ Perspective of Quality of Work Life Indicators in Ghanaian Organizations", International Journal of Contemporary Business Studies, 3(3), pp.17~30 (2012)
  46. Sang M. Lee, "An integrative model of computer abuse based on social control and general deterrence theories", Information & Management, 41(6), pp.707~718 (2004), Elsevier BV[DOI]
  47. J. C. Nunnally, "Psychometric theory" (1978), McGraw-Hill
  48. Barbara H. Wixom, "An Empirical Investigation of the Factors Affecting Data Warehousing Success", MIS Quarterly, 25(1), pp.17~ (2001), JSTOR[DOI]
  49. Claes Fornell, "Evaluating Structural Equation Models with Unobservable Variables and Measurement Error", Journal of Marketing Research, 18(1), pp.39~ (1981), JSTOR[DOI]
  50. Philip M. Podsakoff, "Common method biases in behavioral research: A critical review of the literature and recommended remedies.", Journal of Applied Psychology, 88(5), pp.879~903 (2003), American Psychological Association (APA)[DOI]

관련 논문AI추천

조직원의 정보보안 정책 준수의도에 미치는 영향 연구: 계획된 행동이론, 공정성이론, 동기이론의 적용허성호, 황인호한국디지털정책학회 · 디지털융복합연구2018 · 제16권 제3호정보보안 준수 피로 및 정책저항에 영향을 미치는 정보보안 갈등 완화에 관한 연구황인호한국중소기업학회 · 중소기업연구2022 · 제44권 제2호정보보안정책태도와 준수행동의도성, 정보보안회피성이 정보보안위반행동에 미치는 영향 분석 -조절관점과 처벌관점을 중심으로-이려화, 허성호국제군사안보연구원 · 안보군사학연구2021 · 제18권 제2호군 조직구성원의 정보보안 정책준수 의도 및 태도에 영향을 미치는 요인에 관한 탐색적 연구: 정보통신단 부대원을 중심으로김범수, 김보라, 신지훈한국국방연구원 · 국방정책연구2018 · 제34권 제2호조직의 정보보안 목표 설정과 공정성이 보안정책 준수의도에 미치는 영향김승욱, 황인호한국디지털정책학회 · 디지털융복합연구2018 · 제16권 제2호군 장교의 정보보안 준수 의도에 영향을 미치는 요인김상영, 이태복방위사업연구소 · 선진국방연구2022 · 제5권 제1호

이 간행물의 다른 논문 (24건)

도로 위험 탐지를 위한 데이터 편향성 최적화 기반 연관 추론 모델류성은, 구병국, 김현진, 권혜정, 정경용, 박찬홍pp. 1-6다이나믹 토픽 모델을 활용한 D(Data)ㆍN(Network)ㆍA(A.I) 중심의 연구동향 분석우창우, 이종연pp. 21-29뇌졸중 환자의 상지기능 개선을 위한 과제 지향적 훈련과 진동 자극, 경두개 직류 전류 자극의 융합 효과김선호pp. 31-37치위생과 학생들의 성희롱 인식과 융합 요인최정희, 이성림pp. 39-44한국 청소년의 음료 섭취와 구강건강에 관한 융합적 연구윤정원pp. 45-50
원문 보기