본문 바로가기
KERD
논문KCI 등재

군 조직구성원의 정보보안 정책준수 의도 및 태도에 영향을 미치는 요인에 관한 탐색적 연구: 정보통신단 부대원을 중심으로

What Influences Soldier’s Intention and Attitude on the Information Security Policy Compliance?: A Case Study of One Signal Brigade Unit

김범수|신지훈|김보라
한국국방연구원 (Korea Institute for Defense Analyses)|2018.07|국방정책연구 (The Quarterly Journal of Defense Policy Studies)|제34권 제2호|pp. 7-46|DOI 10.22883/jdps.2018.34.2.001

2

조회

0

다운로드

7

인용

0

참고문헌

키워드

구조방정식모형structural equation model군 조직Information security정보보안military organization정책준수의도정책준수태도policy compliance intentionpolicy compliance attitude

초록

본 연구는 군 조직구성원의 정보보안 정책 준수 의도와 태도를 이해하기 위해 합리적 선택이론과 계획된 행동이론을 바탕으로 설문을 구성해 자료를 수집한 후 구조방정식모형 분석을 통해 연구 모형을 검증하였다. 그 결과 정보보안 정책 준수 의도에 영향을 미치는 요인은 정책에 대한 주관적 규범과 정책 준수에 대한 태도로 나타났다. 그리고 정책 준수 태도에 영향을 미치는 요인은 군에 대한 충성심, 정책 준수로 인한 내재적 이익과 보안 안전성, 정책 미준수로 인한 보안 취약성과 제재로 나타났다. 이 중 제재는 정책 준수 태도에 부정적인 영향을 미치는 것으로 나타났다. 본 연구는 군 조직 정보보안을 인적자원 관리 차원에서 다룬 실증 연구로서 향후 군 조직 내 정보보안 인적자원 관리를 위한 기초 자료로 활용될 수 있을 것이다.

Abstract

With special interests in the military, this study examined what would influence soldier’s intention and attitude on their information security policy compliance (ISPC). Structural equation modeling analyses of 332 soldiers’ data showed that the ISPC intention was affected by subjective norms and ISPC attitude. Then, the ISPC attitude was affected by one’s perceived security safety or security vulnerability, intrinsic benefits, and the loyalty to the military. This study, unlike other technology-oriented studies, focuses on human resources. Thus, it can contribute to the development of future information security management strategies for soldiers.

참고문헌 (84)

  2. 김동현, "국정원, 최근 6년간 외국 산업스파이 157건 적발", 연합뉴스, ~ (2017)
  3. 윤영채, "조직시민행동의 선행요인과 성과평가에 미치는 영향", 행정논총, 47(1), pp.209~232 (2009), 한국행정연구소
  4. 이강언, "한국군의 조직문화차원 리더십개발에 관한 연구", 한국전통상학연구, 16(1), pp.251~282 (2002)
  5. 이영재, "‘SNS로 군사기밀 샌다…’ 軍 보안위반 사례 증가", 연합뉴스, ~ (2015)
  6. 임명성, "정보보안 인식 교육의 효과에 대한 연구", 디지털융복합연구, 12(2), pp.27~37 (2014), 한국디지털정책학회[DOI]
  7. 한국인터넷진흥원, "2017 국가정보보호백서" (2017), 국가정보원･미래창조과학부･방송통신위원회･행정자치부
  8. 박병수, "군 내부 전용망 46일 넘게 악성코드에 무방비 노출", 한겨레, ~ (2016)
  9. Hair, J. F., "PLS 구조모델의 이해" (2014), 피엔씨미디어
  10. YTN, "‘기밀유출’ 기무사 소령 기소…‘고강도 개혁’ 착수", ~ (2015)
  11. Ajzen, I, "The Theory of Planned Behavior", Organizational Behavior and Human Decision Processes, 50(2), pp.179~211 (1991)
  12. "Constructing a TpB Questionnaire: Conceptual and Methodological Considerations" (2002)[URL]
  13. Al-Omari, A., "Information Security Policy Compliance: An Empirical Study of Ethical Ideology. System Sciences (HICSS)", 2013 46th Hawaii International Conference on System Sciences, pp.3018~3027 (2013)
  14. Barclay D., "The Partial Least Squares (PLS)Approach to Causal Modelling Personal Computer Adoption and Use as an Illustration", Technology Studies, 2(2), pp.285~309 (1995)
  15. Bochner, S., "Cross-Cultural Differences in the Self Concept", Journal of Cross-Cultural Psychology, 25(2), pp.273~283 (1994)
  16. Boss, S. R., "The Last Line of Defense: Motivating Employees to Follow Corporate Security Guidelines", The 28th International Conference on Information Systems (2007)
  17. Boss, S. R., "If Someone is Watching, I’ll Do What I’m Asked: Mandatoriness, Control, and Information Security", European Journal of Information Systems, 18, pp.151~164 (2009)
  18. Bulgurcu, B., "Information Security Policy Compliance: An Empirical Study of Rationality-based Beliefs and Information Security Awareness", MIS Quarterly, 34(3), pp.523~548 (2010)
  19. Campbell, K., "The Economic Cost of Publicly Announced Information Security Breaches: Empirical Evidence from the Stock Market", Journal of Computer Security, 11(3), pp.431~448 (2003)
  20. Cheng, C., "Cultural Meaning of Perceived Control: A Meta-Analysis of Locus of Control and Psychological Symptoms Across 18 Cultural Regions", Psychological Bulletin, 139(1), pp.152~188 (2013)
  21. Chin, W. W., "Modern Methods for Business Research" (1998), Erlbaum
  22. Chin, W. W., "A Partial Least Squares Latent Variable Modeling Approach for Measuring Interaction Effects Results from a Monte Carlo Simulation Study and an Electronic-Mail Emotion", Adoption Study, 2003, pp.14, 189~217
  23. Choi, I., "Situational Salience and Cultural Differences in the Correspondence Bias and Actor-Observer Bias", Personality and Social Psychology Bulletin, 24(9), pp.949~960 (1998)
  24. Cox, J., "Information Systems User Security: A Structured Model of the Knowing-Doing Gap", Computers in Human Behavior, 28(5), pp.1849~1858 (2012)
  25. Crossler, R. E., "Future Directions for Behavioral Information Security Research", Computers & Security, 32(1), pp.90~101 (2013)
  26. D’Arcy, J, "A Review and Analysis of Deterrence Theory in the IS Security Literature: Making Sense of the Disparate Findings", European Journal of Information Systems, 20, pp.643~658 (2011)
  27. D’Arcy, J., "User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach", Information Systems Research, 20(1), pp.79~98 (2009)
  28. Deci, E. L., "Intrinsic Motivation and Self-determination in Human Behavior" (1985), Plenum
  29. Delacre, M., "Why Psychologists Should by Default Use Welch’s t-test Instead of Student’s t-test with Unequal Group Sizes", International Review of Social Psychology, 30, pp.92~101 (2017)
  30. Dhillon, G., "Value-focused Assessment of Information System Security in Organizations", Information Systems Journal, 16(3), pp.293~314 (2006)
  31. Eagly, A. H., "The Psychology of Attitudes" (1993), Harcourt Brace Jovanovich College Publishers
  32. Eagly, A. H., "The Handbook of Social Psychology", pp.269~322 (1998), Oxford University Press
  33. Engel, J. F., "Consumer Behavior" (1995), Dryden Press
  34. Fishbein, M., "Readings in Attitude Theory and Measurement", pp.389~399 (1967), Wiley and Sons
  35. Fishbein, M., "Belief, Attitude, Intention and Behavior: An Introduction to Theory and Research" (1975), Addison-Wesley
  36. Fornell, C., "Two Structural Equation Models: LISREL and PLS Applied to Consumer Exit-voice Theory", Journal of Marketing Research, 19(4), pp.440~452 (1982)
  37. Fornell, C., "Evaluating Structural Equation Models with Unobservable Variables and Measurement Error", Journal of Marketing Research, 18(1), pp.39~50 (1981)
  38. Furnell, S. M, "A Prototype Tool for Information Security Awareness and Training", Logistics Information Management, 15(5, pp.6) (2002), 352~357
  39. Gefen, D., "Structural Equation Modeling and Regression: Guidelines for Research Practice", Communications of the AIS, 4, pp.1~77 (2000)
  40. Gundu, T, "Ignorance to Awareness: Towards an Information Security Awareness Process", South African Institute of Electrical Engineers, 104(2), pp.69~79 (2013)
  41. Guo, K. H., "Understanding Nonmalicious Security Violations in the Workplace: A Composite Behavior Model", Journal of Management Information Systems, 28(2), pp.203~236 (2011)
  42. Hair, J. F., "Multivariate Analysis" (1998), Prentice Hall International
  43. Hair, J. F., "Multivariate Data Analysis" (2006), Person Prentice Hall
  44. Harrington, S. J., "The Effect of Codes of Ethics and Personal Denial of Responsibility on Computer Abuse Judgments and Intentions", MIS quarterly, 20(3), pp.257~278 (1996)
  45. Herath, T., "Protection Motivation and Deterrence: A Framework for Security Policy Compliance in Organisations", European Journal of Information Systems, 18(2), pp.106~125 (2009)
  46. Hofstede, G. H., "Culture’s Consequences: Comparing Values, Behaviors, Institutions, and Organizations Across Nations" (2001), Sage
  47. Hogg, M., "Social Psychology" (2005), Prentice-Hall
  48. Hsu, J. S. C., "The Role of Extra-role Behaviors and Social Controls in Information Security Policy Effectiveness", Information Systems Research, 26(2), pp.282~300 (2015)
  49. Hu, Q., "Managing Employee Compliance with Information Security Policies: The Critical Role of Top Management and Organizational Culture", Decision Sciences, pp.615~660 (2012)
  50. Huselid, M. A., "The Impact of Human Resource Management Practices on Turnover, Productivity, and Corporate Financial Performance", Academy of Management Journal, 38(3), pp.635~672 (1995)
  51. Ifinedo, P., "Understanding Information Systems Security Policy Compliance: An Integration of the Theory of Planned Behavior and the Protection Motivation Theory", Computers & Security, 31(1), pp.83~95 (2012)
  52. Ifinedo, P., "Information Systems Security Policy Compliance: an Empirical Study of the Effects of Socialisation, Influence, and Cognition", Information &Management, 51(1), pp.69~79 (2014)
  53. Lebek, B., "Employees’Information Security Awareness and Behavior: A Literature Review", The 46th Annual Hawaii International Conference on System Sciences (HICSS) (2013)
  54. Lee, J., "A Holistic Model of Computer Abuse Within Organizations", Information Management & Computer Security, 10(2), pp.57~63 (2002)
  55. Markus, H. R., "The Self in Social Psychology", pp.339~371 (1999), Psychology Press
  56. McCarthy, B., "New Economics of Sociological Criminology", Annual Review of Sociology, 28, pp.417~442 (2002)
  57. Meyer, J. P., "A Three-component Conceptualization of Organizational Commitment", Human Resource Management Review, 1(1), pp.61~89 (1991)
  58. Meyer, J. P., "Affective, Continuance, and Normative Commitment to the Organization: A Meta-Analysis of Antecedents, Correlates, and Consequences", Journal of Vocational Behavior, 61, pp.20~52 (2002)
  59. Pahnila, S., "Employees’ Behavior towards IS Security Policy Compliance", The 40th Annual Hawaii International Conference on System Sciences (HICSS) (2007)
  60. Paternoster, R., "Rational Choice, Agency and Thoughtfully Reflective Decision Making: The Short and Long-term Consequences of Making Good Choices", Journal of Quantitative Criminology, 25(2), pp.103~127 (2009)
  61. Paternoster, R., "Sanction Threats and Appeals to Morality:Testing a Rational Choice Model of Corporate Crime", Law and Society Review, 30(3), pp.549~583 (1996)
  62. Pavlou, P. A., "Understanding and Prediction Electronic Commerce Adoption: An Extension of the Theory of Planned Behavior", MIS Quarterly, 30(1), pp.115~143 (2006)
  63. Peace, A. G., "Software Piracy in the Workplace:A Model and Empirical Test.", Journal of Management Information Systems, 20(1), pp.153~177 (2003)
  64. Peltier, T. R., "Information Security Risk Analysis" (2005), CRC Press
  65. Pfleeger, C. P., "Security in Computing" (2006), Pearson Education, Inc
  66. Ponemon Institutde, "Ponemon Institude Research Report: 2017 Cost of Data Breach Study" (2017), Ponemon Institute LLC, IBM Security
  67. Powers, E. L., "Employee Loyalty in the New Millennium. SAM", Advanced Management Journal, 65(3), pp.4~8 (2000)
  68. 2011 CSI Computer Crime and Security Survey, "2010", pp.2011, Richardson, R.
  69. Rogers, R., "Social Psychophysiology: A Sourcebook", pp.153~177 (1983), Guilford Press
  70. Rousseau, D. M., "New Hire Perceptions of Their Own and Their Employer’s Obligations: A Study of Psychological Contracts", Journal of Organizational Behavior, 11(5), pp.389~400 (1990)
  71. Siponen, M., "International Federation for Information Processing", pp.133~144 (2007), Springer
  72. Siponen, M. T, "Neutralization: New Insights into the Problem of Employee Information Systems Security Policy Violations", MIS Quarterly, 34(3), pp.487~502 (2010)
  73. Stallings, W., "Network Security Essentials" (2013), Pearson Education
  74. Stanton, J. M., "Analysis of End User Security Behaviors", Computers & Security, 24(2), pp.124~133 (2005)
  75. Straub, D. W., "Discovering and Disciplining Computer Abuse in Organizations: A Field Study", MIS Quarterly, 14(1), pp.45~60 (1990)
  76. Theoharidou, M., "The Insider Threat to Information Systems and the Effectiveness of ISO17799", Computers &Security, 24(6), pp.472~484 (2005)
  77. Thomson, K. L., "Cultivating an Organizational Information Security Culture", Computer Fraud & Security, 2006(10), pp.7~11 (2006)
  78. Triandis, H. C., "Individualism and Collectivism" (1995), Westview
  79. van den Berg, H., "The Impact of Affective and Cognitive Focus on Attitude Formation", Journal of Experimental Social Psychology, 42(3), pp.373~379 (2006)
  80. Warkentin M, "Behavioral and Policy Issues in Information Systems Security: The Insider Threat", European Journal of Information Systems, 18, pp.101~105 (2009)
  81. West, R., "The Psychology of Security", Communications of the ACM, 51(4), pp.34~40 (2008)
  82. Whitman, M. E., "Information Security Management: Global Challenges in the New Millennium", pp.9~18 (2001), Idea Group Publishing
  83. Yoo, Y., "Media and Group Cohesion: Relative Influences on Social Presence, Task Participation, and Group Consensus", MIS Quarterly, 25(3), pp.371~390 (2001)
  84. Zhang, J., "Impact of Perceived Technical Protection on Security Behaviors", Information Management & Computer Security, 17(4), pp.330~340 (2009)

관련 논문AI추천

군 장교의 정보보안 준수 의도에 영향을 미치는 요인김상영, 이태복방위사업연구소 · 선진국방연구2022 · 제5권 제1호군 조직구성원의 보안 심리적 동기, 개인특성과 보안준수행동 간의 관계에 관한 연구박의천, 전기석국방보안연구소 · 국방과 보안2021 · 제3권 제2호조직구성원의 정보보안 준수 및 미준수 원인에 대한 연구허성호, 황인호한국융합학회 · 한국융합학회논문지2020 · 제11권 제9호조직원의 정보보안 정책 준수의도에 미치는 영향 연구: 계획된 행동이론, 공정성이론, 동기이론의 적용허성호, 황인호한국디지털정책학회 · 디지털융복합연구2018 · 제16권 제3호군내 구성원의 내재적 동기가 보안 행동에 미치는 영향연구 - 계획된 행동이론(TPB)을 중심으로김대권, 김두환한국공안행정학회 · 한국공안행정학회보2020 · 제29권 제3호정보보안정책태도와 준수행동의도성, 정보보안회피성이 정보보안위반행동에 미치는 영향 분석 -조절관점과 처벌관점을 중심으로-이려화, 허성호국제군사안보연구원 · 안보군사학연구2021 · 제18권 제2호

이 간행물의 다른 논문 (5건)

다문화 군인에 대한 장교들의 인식과 군 정책 방향이윤수pp. 47-71공군사관학교 출신 장교의 이직의도와구조적 선행요인에 관한 연구: 심리적 임파워먼트와 조직사회화의 조절효과구륜회, 정예슬, 손영우, 임정인pp. 73-110민·군 갈등관리와 협력적 로컬 거버넌스의 유효성에관한 연구: 공군의 민·관·군협의체 운영사례를 중심으로심준섭, 김지수pp. 111-138‘전략기반 전력기획’과 한국군의 전력구조 개편 방안박창희pp. 139-169군 태양광발전 시설 운영 모델 분석서근영, 최동현pp. 171-189
원문 보기