본문 바로가기
KERD
논문KCI 등재

조직원의 정보보안 정책 준수의도에 미치는 영향 연구: 계획된 행동이론, 공정성이론, 동기이론의 적용

A Study on the Influence of Information Security Compliance Intention of Employee: Theory of Planned Behavior, Justice Theory, and Motivation Theory Applied

허성호|황인호
한국디지털정책학회 (The Society of Digital Policy & Management)|2018.03|디지털융복합연구 (Journal of Digital Convergence)|제16권 제3호|pp. 225-236|DOI https://doi.org/10.14400/JDC.2018.16.3.225

0

조회

0

다운로드

14

인용

0

참고문헌

키워드

제재Theory of Planned BehaviorSanctionOrganizational Identification계획된행동이론Justice Theory공정성이론정보보안 준수의도조직일체화Information Security Compliance Intention

초록

조직은 정보 보안 기술에 대한 지속적인 투자를 통하여 다른 기업들보다 정보자원에 대한 경쟁력을 높이고 있다. 그러나 정보보안 기술 및 정책을 실행에 옮기는 조직원의 정보보안에 대한 관심이 상대적으로 저조하다. 본 연구는 정보보안 분야에 계획된 행동이론, 공정성이론, 그리고 동기이론을 적용하여 조직원의 정보보안 준수의도를 높이기 위한 메커니즘을 찾는다. 연구대상은 정보보안 정책을 도입한 조직의 조직원들이며, 서베이를 통하여 유효샘플 383개를 수집하였다. 연구가설 검증은 구조방정식 모델링을 실시하였다. 결과는 조직공정성, 외재적 동기(제재), 내재적 동기(조직일체화)가 계획된 행동이론의 세부 요인들에 영향을 주고 개인의 정보보안준수의도에 영향을 주는 것으로 나타났다. 분석 결과는 조직의 보안 정책에 대한 조직원들의 준수의도 향상을 위한 전략적 접근 방향을 제시한다.

Abstract

Organizations continue to invest in the security of information technology as a means to be more competitive than others in their industry do. However, there is a relatively lack of interest in the information security compliance of employees who implement information security technologies and policies of organization. This study finds mechanisms for enhancing security compliance by applying theory of planned behavior, justice theory, and motivation theory in information security field. We use structural equation modeling to verify the research hypotheses, and conducted a survey on the employees of organization with information security policy. The results showed that organizational justice, sanction, and organizational identification affect the factors of the planned behavior theory and affect the employee's compliance intention. As a result, this research suggested directions for strategic approach for enhancing employee’s compliance intention on organization’s security policy.

참고문헌 (54)

  1. IDC, "Worldwide Semiannual Security Spending Guide", ~ (2016)
  2. 도정민, "전사적 보안협업을 위한 핵심성공요인에 관한 연구", 디지털융복합연구, 12(10), pp.235~242 (2014), 한국디지털정책학회[DOI]
  3. I. Hwang, "Examining technostress creators and role stress as potential threats to employees' information security compliance", Computers in Human Behavior, 81, pp.282~293 (2018)
  4. B. Bulgurcu, "Information security policy compliance: An empirical study of rationality-based beliefs and information security awareness", MIS Quarterly, 34(3), pp.523~548 (2010)
  5. A. Vance, "Motivating IS security compliance : Insights from habit and protection motivation theory", Information &Management, 49(3), pp.190~198 (2012)
  6. I. Hwang, "Why not comply with information security? An empirical approach for the causes of non-compliance", Online Information Review, 41(1), pp.1~17 (2017)
  7. S. R. Boss, "What do systems users have to fear? Using fear appeals to engender threats and fear that motivate protective security behaviors", MIS Quarterly, 34(3), pp.523~548 (2015)
  8. 김대진, "조직 구성원의 정보보안정책 준수행동에 대한 연구 : 수정된 Triandis 모델의 적용", 디지털융복합연구, 14(4), pp.209~220 (2016), 한국디지털정책학회[DOI]
  9. 박철주, "보안 대책이 지속적 보안 정책 준수에 미치는 영향", 디지털융복합연구, 10(4), pp.23~35 (2012), 한국디지털정책학회[DOI]
  10. Y. Chen, "Organizations' information security policy compliance:Stick or carrot approach?", Journal of Management Information Systems, 29(3), pp.157~188 (2012)
  11. J. D'Arcy, "User awareness of security countermeasures and its impact on information systems misuse : A deterrence approach", Information Systems Research, 20(1), pp.79~98 (2009)
  12. Q. Hu, "Does deterrence work in reducing information security policy abuse by employees?", Communications of the ACM, 54(6), pp.54~60 (2011)
  13. K. H. Guo, "The effects of multilevel sanctions on information security violations: A mediating model", Information & Management, 49(6), pp.320~326 (2012)
  14. T. Herath, "Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness", Decision Support Systems, 47(2), pp.154~165 (2009)
  15. J. Y. Son, "Out of fear or desire? Toward a better understanding of employees’ motivation to follow IS security policies", Information & Management, 48(7), pp.296~302 (2011)
  16. A. B. Ruighaver, "Organizational security culture : extending the end-user perspective", Computers & Security, 26(1), pp.56~62 (2007)
  17. J. A. Colquitt, "On the dimensionality of organizational justice: A construct validation of a measure", Journal of Applied Psychology, 86(3), pp.386~400 (2001)
  18. Y. Zhang, "It's not fair… or is it? The role of justice and leadership in explaining work stressor–job performance relationships", Academy of Management Journal, 57(3), pp.675~697 (2014)
  19. R. West, "The psychology of security", Communications of the ACM, 51(4), pp.34~40 (2008)
  20. K. D. Loch, "Threats to information systems: today's reality. yesterday's understanding", MIS Quarterly, 16(2), pp.173~186 (1992)
  21. 2016 Data Breach Investigations Report, "Verizon", ~ (2016)
  22. M. Siponen, "Compliance with information security policies: An empirical investigation", Computer, 43(2), pp.64~71 (2010)
  23. 정태석, "기업의 지속적 정보보안 강화를 위한 접근법 개발", 디지털융복합연구, 10(2), pp.1~10 (2012), 한국디지털정책학회[DOI]
  24. 한진영, "정보보안 준수의도에 대한 사회심리적 요인 분석: 정보보안과 조직시민행동이론 융합", 디지털융복합연구, 13(8), pp.133~144 (2015), 한국디지털정책학회[DOI]
  25. 임명성, "조직 구성원들의 정보보안 정책 준수행위 의도에 관한 연구", 디지털융복합연구, 10(10), pp.119~128 (2012), 한국디지털정책학회
  26. 황인호, "조직구성원의 정보보안 정책 준수의도: 계획된 행동이론, 목표설정이론, 억제이론의 적용", 디지털융복합연구, 14(7), pp.155~166 (2016), 한국디지털정책학회[DOI]
  27. I. Ajzen, "theory of planned behavior", Organizational Behavior and Human Decision Processes, 50(2), pp.179~211 (1991)
  28. J. Cox, "Information systems user security: A structured model of the knowing–doing gap", Computers in Human Behavior, 28(5), pp.1849~1858 (2012)
  29. N. S. Safa, "Information security conscious care behaviour formation in organizations", Computers & Security, 53, pp.65~78 (2015)
  30. J. Zhang, "Impact of perceived technical protection on security behaviors", Information Management & Computer Security, 17(4), pp.330~340 (2009)
  31. A. C. Johnston, "Fear appeals and information security behaviors : An empirical study", MIS Quarterly, 34(3), pp.549~566 (2010)
  32. W. R. Flores, "Shaping intention to resist social engineering through transformational leadership, information security culture and awareness", Computers & Security, 59, pp.26~44 (2016)
  33. N. S. Safa, "An information security knowledge sharing model in organizations", Computers in Human Behavior, 57, pp.442~451 (2016)
  34. M. Siponen, "Employees’ adherence to information security policies:An exploratory field study", Information & Management, 51(2), pp.217~224 (2014)
  35. C. Posey, "The impact of organizational commitment on insiders’motivation to protect organizational information assets", Journal of Management Information Systems, 32(4), pp.179~214 (2015)
  36. H. L. Chou, "An analysis of multiple factors relating to teachers' problematic information security behavior", Computers in Human Behavior, 65, pp.334~345 (2016)
  37. R. Cropanzano, "How regulatory focus impacts the process-by-outcome interaction for perceived fairness and emotions", Organizational Behavior and Human Decision Processes, 105(1), pp.36~51 (2008)
  38. P. M. Muchinsky., "Psychology Applied to Work:An Introduction to Industrial and Organizational Psychology" (2006), Cengage Learning
  39. P. E. Spector, "Industrial and Organizational Psychology. Research and. Practice" (2008)
  40. T. A. Judge, "Organizational justice and stress: The mediating role of work-family conflict", Journal of Applied Psychology, 89(3), pp.395~404 (2004)
  41. J. R. Fu, "Understanding why consumers engage in electronic word-of-mouth communication: Perspectives from theory of planned behavior and justice theory", Electronic Commerce Research and Applications, 14(6), pp.616~630 (2015)
  42. H. Zhang, "The mediating roles of organizational justice on the relationships between HR practices and workplace outcomes: an investigation in China", The International Journal of Human Resource Management, 20(3), pp.676~693 (2009)
  43. M. L. Ambrose, "The role of overall justice judgments in organizational justice research : a test of mediation", Journal of Applied Psychology, 94(2), pp.491~500 (2009)
  44. T. Y. Chou, "The organizational citizenship behavior of IS personnel: Does organizational justice matter?", Information & Management, 50(2), pp.105~111 (2013)
  45. O. Demirtas, "Ethical leadership influence at organizations: Evidence from the field", Journal of Business Ethics, 126(2), pp.273~284 (2015)
  46. C. Yoon, "Theory of planned behavior and ethics theory in digital piracy: An integrated model", Journal of Business Ethics, 100(3), pp.405~417 (2011)
  47. C. C. Pinder, "Work motivation in organizational behavior" (1998), Prentice Hall
  48. E. M. Fair, "Effects of rewards, competition and outcome on intrinsic motivation", Journal of Instructional Psychology, 19(1), pp.3~ (1992)
  49. K. H. Guo, "Understanding nonmalicious security violations in the workplace: A composite behavior model", Journal of Management Information Systems, 28(2), pp.203~236 (2011)
  50. H. Li, "Understanding compliance with internet use policy from the perspective of rational choice theory", Decision Support Systems, 48(4), pp.635~645 (2010)
  51. J. E. Dutton, "Organizational images and member identification", Administrative Science Quarterly, 39(2), pp.239~263 (1994)
  52. J. C. Nunnally, "Psychometric theory" (1978), McGraw-Hill
  53. B. H. Wixom, "An empirical investigation of the factors affecting data warehousing success", MIS Quarterly, 25(1), pp.17~41 (2001)
  54. C. Fornell, "Evaluating structural equation models with unobservable variables and measurement error", Journal of Marketing Research, 18(1), pp.39~50 (1981)

관련 논문AI추천

조직의 정보보안 목표 설정과 공정성이 보안정책 준수의도에 미치는 영향김승욱, 황인호한국디지털정책학회 · 디지털융복합연구2018 · 제16권 제2호정보보안 정책 인식과 정보보안 관여성, 준수 의도성이 정보보안 행동에 미치는 영향 분석: 보상 차원과 공정성 차원을 중심으로허성호, 황인호중소기업융합학회 · 융합정보논문지2020 · 제10권 제12호조직구성원의 정보보안 준수 및 미준수 원인에 대한 연구허성호, 황인호한국융합학회 · 한국융합학회논문지2020 · 제11권 제9호군 조직구성원의 정보보안 정책준수 의도 및 태도에 영향을 미치는 요인에 관한 탐색적 연구: 정보통신단 부대원을 중심으로김범수, 김보라, 신지훈한국국방연구원 · 국방정책연구2018 · 제34권 제2호군 장교의 정보보안 준수 의도에 영향을 미치는 요인김상영, 이태복방위사업연구소 · 선진국방연구2022 · 제5권 제1호정보보안정책태도와 준수행동의도성, 정보보안회피성이 정보보안위반행동에 미치는 영향 분석 -조절관점과 처벌관점을 중심으로-이려화, 허성호국제군사안보연구원 · 안보군사학연구2021 · 제18권 제2호

이 간행물의 다른 논문 (31건)

베이비붐 세대의 여가활동이 ICT 이용 능력에 미치는 영향오주현pp. 1-12대학생 핵심역량 증진을 위한 스마트러닝기반 비교과교육의 효과강선영, 김현우pp. 27-35대학생들의 언어학습전략, 언어학습믿음과 영어듣기성취 이해조혜원pp. 37-45서울시 성동구 교육복지센터의 역할 및 발전방안에 관한 연구권성철pp. 47-58국내 플립러닝의 학습효과에 관한 메타분석조보람, 이정민pp. 59-73
원문 보기