정보보안문화와 경영진 리더십이 조직 구성원의 정보보안 행동에 미치는 영향
Impacts of Information Security Culture and Management Leadership Styles on Information Security Behaviors
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
본 연구는 개인적 요인에 초점을 맞춘 기존 연구를 확장하여, 조직의 환경적 요인(정보보안문화, 경영진 리더십)이 조직 구성원의 정보보안 행동(정보보안정책 준수 의도, 정보보안 참여 의도)에 미치는 영향을 살펴본다. 본 연구는 금융기관 구성원 236명으로부터 데이터를 수집하였으며, 본 연구에서 개발한 모형을 구조방정식모형으로 분석하였다. 분석 결과, 정보보안문화는 정보보안정책 준수 의도와 정보보안 참여 의도에 모두 긍정적인 영향을 주었다. 거래적 리더십은 정보보안정책 준수 의도와 정보보안 참여 의도에 모두 긍정적인 영향을 주었지만, 변혁적 리더십은 정보보안 참여 의도에만 긍정적인 영향을 주었다.
Abstract
This research investigates the impacts of information security (IS) culture and management leadership styles on employee’s security behaviors (IS policies compliance, IS participation) in financial institutions. This study use the survey data collected from 236 employees of financial institutions. This research shows that IS culture has a positive effect on both behavioral intentions to comply with IS policies and the intentions to actively participate in information security activities. Transactional leadership has a positive impact on the IS policies compliance intentions and to participate in information security activities. In contrast, transformational leadership has a positive impact on the intentions to participate in information security activities, but not on the IS policies compliance intentions.
참고문헌 (58)
- Under cyber attack. EY’s Global Information Security Survey 2013, "van Kessel, P", Ernst & Young, ~ (2013)
- Survey on Information Security-Business, "Korea Internet & Security Agency", ~ (2020)
- Kreicberge, "Internal threat to information security-countermeasures and human factor with SME", Ph.D, pp.2020
- Siponen, M., "Neutralization: new insights into the problem of employee information systems security policy violations", MIS quarterly, 34(3), pp.487~502 (2010)
- Padayachee, K., "Taxonomy of compliant information security behavior", Computers & Security, 31(5), pp.673~680 (2012)
- Bulgurcu, B. H., "Information security policy compliance : An empirical study of rationality‐based beliefs and information security awareness", MIS Quarterly, 34(3), pp.523~548 (2010)
- D’Arcy, J., "User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach", Information Systems Research, 20(1), pp.79~98 (2009)
- Herath, T., "Protection motivation and deterrence: a framework for security policy compliance in organisations", European Journal of Information Systems, 18(2), pp.106~125 (2009)
- Ifinedo, P., "Understanding information systems security policy compliance: An integration of the theory of planned behavior and the protection motivation theory", Computers & Security, 31(1), pp.83~95 (2012)
- 황인호, "조직의 정보보안 문화 형성이 조직 구성원의 보안 지식 및 준수의도에 미치는 영향 연구", 경영정보학연구, 18(1), pp.1~23 (2016), 한국경영정보학회[DOI]
- Knapp, K. J., "Information security: management’s effect on culture and policy", Information Management & Computer Security, 14(1), pp.24~36 (2006)
- Ernest Chang, S, "Exploring organizational culture for information security management", Industrial Management & Data Systems, 107(3), pp.438~458 (2007)
- Molm, L. D., "Structure, action, and outcomes: The dynamics of power in social exchange", American Sociological Review, 55(3), pp.427~447 (1990)
- Hu, Q, "Does deterrence work in reducing information security policy abuse by employees?", Communications of the ACM, 54(6), pp.54~60 (2011)
- Hsu, J. S. C, "The role of extra-role behaviors and social controls in information security policy effectiveness", Information Systems Research, 26(2), pp.282~300 (2015)
- McIlwraith, A., "Information Security and Employee Behaviour: How to Reduce Risk Through Employee Education. Training and Awareness" (2021), Routledge
- Schein, E. H., "The corporate culture survival guide" (2019), John Wiley & Sons
- Niekerk, J. A., "Understanding information security culture: A conceptual framework", Proceedings of the ISSA 2006 from Insights to Foresight Conference, pp.21~30 (2006)
- Humaidi, N., "Leadership styles and information security compliance behavior: The mediator effect of information security awareness", International Journal of Information and Education Technology, 5(4), pp.311~318 (2015)
- Bass, B. M, "Improving organizational effectiveness through transformational leadership" (1993), Sage
- Karlsson, F., "Information security culture- state-of-the-art review between 2000 and 2013", Information & Computer Security, 23(3), pp.246~285 (2013)
- Alhogail, A., "Information security culture: a definition and a literature review", 2014 World Congress on Computer Applications and Information Systems (WCCAIS), pp.1~7 (2014)
- 김혜정, "정보보호 거버넌스 효율성 제고를 위한 조직원의 정보보호 행위에 관한 실증 연구", 한국전자거래학회지, 18(1), pp.147~164 (2013), 한국전자거래학회[DOI]
- Schlienger, T., "Information security culture-from analysis to change", South African Computer Journal, 2003(31), pp.46~52 (2003)
- Martins, A., "Information security culture. Security in the information society" (2002), Springer
- Alnatheer, M., "Understanding and measuring information security culture", Proceedings of the 16th Pacific Asia Conference on Information Systems (PACIS), pp.144~ (2012)
- Nasir, A., "A dimension-based information security culture model and its relationship with employees’security behavior: A case study in Malaysian higher educational institutions", Information Security Journal: A Global Perspective, 28(3), pp.55~80 (2019)
- Burns, J. M., "Leadership" (2012), Open Road Media
- Jung, D. I., "Transformational leadership in work groups: The role of empowerment, cohesiveness, and collective-efficacy on perceived group performance", Small group research, 33(3), pp.313~336 (2002)
- Bass, B. M., "Leadership and performance beyond expectations" (1985), Free Press
- Bass, B. M, "Predicting unit performance by assessing transformational and transactional leadership", Journal of Applied Psychology, 88(2), pp.207~218 (2003)
- Bono, J. E., "Personality and transformational and transactional leadership : A metaanalysis", Journal of Applied Psychology, 89(5), pp.901~910 (2004)
- Liu, J, "Transformational leadership and employee well‐being: The mediating role of trust in the leader and selfefficacy", Applied Psychology, 59(3), pp.454~479 (2010)
- Rafferty, A. E., "Dimensions of transformational leadership: Conceptual and empirical extensions", The leadership quarterly, 15(3), pp.329~354 (2004)
- Stewart, J., "Transformational leadership: An evolving concept examined through the works of Burns, Bass, Avolio, and Leithwood", Canadian Journal of Educational Administration and Policy, 54, pp.1~29 (2006)
- Avolio, B. J., "Re‐examining the components of transformational and transactional leadership using the Multifactor Leadership", Journal of occupational and organizational psychology, 72(4), pp.441~462 (1999)
- Bass, B. M., "Transformational leadership and the falling dominoes effect", Group & Organization Studies, 12(1), pp.73~87 (1987)
- Geijsel, F, "Transformational leadership effects on teachers’commitment and effort toward school reform", Journal of educational administration, 41(3), pp.228~256 (2003)
- Sadeghi, A., "Transformational leadership and its predictive effects on leadership effectiveness", International Journal of Business and Social Science, 3(7), pp.186~197 (2012)
- 김우진, "호텔기업의 변혁적, 거래적 리더십이 조직시민행동에 미치는 영향 : 임파워먼트의 조절변수 역할검증을 중심으로", 호텔경영학연구, 19(3), pp.173~198 (2010), 한국호텔외식관광경영학회
- 고시성, "한국 국방조직 구성신분별 효과적 리더십 유형에 관한 연구", 한국정책과학학회보, 15(2), pp.111~139 (2011), 한국정책과학학회
- Zhu, Y, "Individual behavior : In-role and extra-role", International Journal of Business Administration, 4(1), pp.23~27 (2013)
- Boss, S. R, "If someone is watching, I’ll do what I’m asked: mandatoriness, control, and information security", European Journal of Information Systems, 18(2), pp.151~164 (2009)
- Posey, C., "Insiders’ protection of organizational information assets : development of a systematics-based taxonomy and theory of diversity for protection-motivated behaviors", MIS Quarterly, pp.1189~1210 (2013)
- Wall, J. D., "Control-related motivations and information security policy compliance:The role of autonomy and efficacy", Journal of Information Privacy and Security, 9(4), pp.52~79 (2013)
- Van Dyne, L., "Helping and voice extra-role behaviors: Evidence of construct and predictive validity", Academy of Management Journal, 41(1), pp.108~119 (1998)
- Ngo, L., "Assessing the level of IT security culture improvement: Results from three Australian SMEs", 200935th Annual Conference of IEEE Industrial Electronics, pp.3189~3195 (2009)
- D’Arcy, J., "Security culture and the employment relationship as drivers of employees’security compliance", Information Management & Computer Security, 22(5), pp.474~489 (2014)
- 권중생, "혁신적 조직문화가 인적자원의 혁신성과 조직몰입에 미치는 영향", 경영연구, 26(1), pp.153~182 (2011), 한국산업경영학회[DOI]
- Jaeger, L., "When Colleagues Fail: Examining the Role of Information Security Awareness on Extra-Role Security Behaviors", Proceedings of the Twenty-Sixth European Conference on Information Systems (ECIS), pp.124~ (2018)
- 박재영, "조직의 정보보안 분위기가 조직 구성원의 정보보안 참여 행동에 미치는 영향", 정보시스템연구, 29(4), pp.57~76 (2020), 한국정보시스템학회
- Kessler, S. R., "Information security climate and the assessment of information security risk among healthcare employees", Health informatics journal, 26(1), pp.461~473 (2020)
- Lebek, B., "Transformational Leadership and Employees’ Information Security Performance: The Mediating Role of Motivation and Climate", Proceedings of the 35th International Conference on Information Systems (ICIS) (2014)
- Podsakoff, P. M., "Transformational leader behaviors and their effects on followers’ trust in leader, satisfaction, and organizational citizenship behaviors", The leadership quarterly, 1(2), pp.107~142 (1990)
- Guhr, N., "The impact of leadership on employees’ intended information security behaviour : An examination of the full‐range leadership theory", Information Systems Journal, 29(2), pp.40~362 (2019)
- Fornell, C., "Evaluating structural equation models with unobservable variables and measurement error", Journal of marketing research, 18(1), pp.39~50 (1981)
- D’Arcy, J., "The multifaceted nature of security culture and its influence on end user behavior", Proceedings of IFIP TC8International Workshop on Information Systems Security Research, pp.145~157 (2009)
