본문 바로가기
KERD
논문KCI 등재

조직의 정보보안 목표 설정과 공정성이 보안정책 준수의도에 미치는 영향

A Study on the Influence of Organizational Information Security Goal Setting and Justice on Security Policy Compliance Intention

김승욱|황인호
한국디지털정책학회 (The Society of Digital Policy & Management)|2018.02|디지털융복합연구 (Journal of Digital Convergence)|제16권 제2호|pp. 117-126|DOI https://doi.org/10.14400/JDC.2018.16.2.117

0

조회

0

다운로드

7

인용

0

참고문헌

키워드

분배공정성절차공정성Procedural Justice정보공정성Distribution JusticeInformational Justice정보보안 정책 준수의도정보보안 목표 설정Information Security Policy Compliance IntentionSecurity Goal Setting

초록

전 세계적인 정보보안 위협의 증대에 따라 조직들은 보다 전문화된 정보보안 정책 및 시스템을 도입 및 활용에 투자 비중을 높이고 있다. 정보보안은 보안 시스템 및 정책을 이행하는 조직원들의 참여가 무엇보다 필요하며, 조직 내부의 보안 수준을 높이기 위해서는 조직원들의 정보보안 준수의도 향상을 위한 조직의 체계적인 지원이 무엇보다 필요하다. 본 연구는 정보보안 분야에 공정성이론과 목표설정이론을 적용하여 조직원의 정보보안 준수의도를 높이기 위한 매커니즘을 찾는다. 즉, 보안정책 목표설정이 조직원들의 보안관련 공정성 인식수준에 긍정적인 영향을 미치고, 공정성은 준수의도에 긍정적인 영향을 미친다는 연구모델 기반 가설 검증을 실시한다. 연구대상은 정보보안 정책을 도입한 조직의 조직원들이며, 설문조사를 통하여 유효샘플 383개를 수집하였다. 연구가설 검증은 구조방정식 모델링을 실시하였다. 보안정책 목표 요인(목표 난이도, 목표 구체성)이 조직원의 보안관련 공정성 인식을 높이며, 보안관련 공정성(분배, 절차, 그리고 정보 공정성)이 준수의도에 긍정적 영향을 주는 것으로 나타났다. 결과는 조직의 보안 정책에 대한 조직원들의 준수의도 향상을 위한 전략적 접근 방향을 제시한다.

Abstract

The threat to information security is growing globally. To this, organizations are increasing the weight of adapting and operating the more specialized information security policy and system. Information security requires participation from the employees who execute the security system and policy, and to increase the level of organization’s internal security, requires organization’s systematic support to improve employees’ information security compliance intention. This research finds the mechanism for improving employee’s information security compliance intention by applying justice theory and goal setting theory in information security. We use structural equation modeling to verify the research hypothesis, and conducted a survey on the employees of organization with information security policy. In other words, this research performs verification of the research model based hypothesis which claims that security policy goal setting has positive influence on employee’s level of security related justice recognition, and claims that justice has positive influence on compliance intention. The object of study is the employees of the organization that adapts information security policy, and 383 valid samples were collected via survey. Structural equation modeling was performed to verify the research hypothesis. The result shows that security policy goal factor (goal difficulty, goal specificity) improves employee’s security related justice recognition, and that security related justice (distribution, process, and information justice) has positive influence on compliance intention. The result suggests the strategic approach directions for improving employees’ compliance intention on organization’s security policy.

참고문헌 (47)

  1. IDC, "Worldwide semiannual security spending guide", ~ (2016)
  2. K. D. Loch, "Threats to information systems: today's reality, yesterday's understanding", MIS Quarterly, 16(2), pp.173~186 (1992)
  3. 2017 data breach investigations report, "Verizon", ~ (2017)
  4. 황인호, "조직의 정보보안 환경이 조직구성원의 보안 준수의도에 미치는 영향", 정보시스템연구, 25(2), pp.51~77 (2016), 한국정보시스템학회[DOI]
  5. 김대진, "조직 구성원의 정보보안정책 준수행동에 대한 연구 : 수정된 Triandis 모델의 적용", 디지털융복합연구, 14(4), pp.209~220 (2016), 한국디지털정책학회[DOI]
  6. I. Hwang, "Why not comply with information security? An empirical approach for the causes of non-compliance", Online Information Review, 41(1), pp.1~17 (2017)
  7. J. D'Arcy, "User awareness of security countermeasures and its impact on information systems misuse : A deterrence approach", Information Systems Research, 20(1), pp.79~98 (2009)
  8. T. Herath, "Encouraging information security behaviors in organizations : Role of penalties, pressures and perceived effectiveness", Decision Support Systems, 47(2), pp.154~165 (2009)
  9. B. Bulgurcu, "Information security policy compliance : An empirical study of rationality-based beliefs and information security awareness", MIS Quarterly, 34(3), pp.523~548 (2010)
  10. M. Siponen, "Compliance with information security policies : An empirical investigation", Computer, 43(2), pp.64~71 (2010)
  11. Q. Hu, "Does deterrence work in reducing information security policy abuse by employees?", Communications of the ACM, 54(6), pp.54~60 (2011)
  12. Y. Chen, "Organizations' information security policy compliance : Stick or carrot approach?", Journal of Management Information Systems, 29(3), pp.157~188 (2012)
  13. 박철주, "보안 대책이 지속적 보안 정책 준수에 미치는 영향", 디지털융복합연구, 10(4), pp.23~35 (2012), 한국디지털정책학회[DOI]
  14. A. Vance, "Motivating IS security compliance : Insights from habit and protection motivation theory", Information &Management, 49(3), pp.190~198 (2012)
  15. 황인호, "조직구성원의 정보보안 정책 준수의도: 계획된 행동이론, 목표설정이론, 억제이론의 적용", 디지털융복합연구, 14(7), pp.155~166 (2016), 한국디지털정책학회[DOI]
  16. R. H. Moorman., "Relationship between organizational justice and organizational citizenship behaviors : Do fairness perceptions influence employee citizenship?", Journal of Applied Psychology, 76(6), pp.845~855 (1991)
  17. J. A. Colquitt., "On the dimensionality of organizational justice : a construct validation of a measure", Journal of Applied Psychology, 86(3), pp.386~400 (2001)
  18. M. T. Tsai, "Understanding knowledge sharing between IT professionals–an integration of social cognitive and social exchange theory", Behaviour & Information Technology, 31(11), pp.1069~1080 (2012)
  19. Y. Zhang, "It's not fair… or is it? The role of justice and leadership in explaining work stressor–job performance relationships", Academy of Management Journal, 57(3), pp.675~697 (2014)
  20. R. West., "The psychology of security", Communications of the ACM, 51(4), pp.34~40 (2008)
  21. 임명성, "조직 구성원들의 정보보안 정책 준수행위 의도에 관한 연구", 디지털융복합연구, 10(10), pp.119~128 (2012), 한국디지털정책학회
  22. A. Vance, "Motivating IS security compliance : Insights from habit and protection motivation theory", Information &Management, 49(3), pp.190~198 (2012)
  23. P. M. Muchinsky, "Psychology applied to work:An introduction to industrial and organizational psychology" (2006), Cengage Learning
  24. P. E. Spector, "Industrial and organizational psychology. Research and Practice" (2009)
  25. T. A. Judge, "Organizational justice and stress : the mediating role of work-family conflict", Journal of Applied Psychology, 89(3), pp.395~404 (2004)
  26. H. Li, "Exploring the effects of organizational justice, personal ethics and sanction on internet use policy compliance", Information Systems Journal, 24(6), pp.479~502 (2014)
  27. Z. Ouyang, "Organizational justice and job insecurity as mediators of the effect of emotional intelligence on job satisfaction : A study from China", Personality and Individual Differences, 76, pp.147~152 (2015)
  28. C. B. Meyer., "Allocation processes in mergers and acquisitions : An organizational justice perspective", British Journal of Management, 12(1), pp.47~66 (2001)
  29. S. W. Hystad, "Moral disengagement as a mechanism between perceptions of organisational injustice and deviant work behaviours", Safety Science, 68, pp.138~145 (2014)
  30. J. Y. Son, "Procedural justice to enhance compliance with non-work-related computing(NWRC)rules : Its determinants and interaction with privacy concerns", International Journal of Information Management, 36(3), pp.309~321 (2016)
  31. H. Zhang, "The mediating roles of organizational justice on the relationships between HR practices and workplace outcomes : an investigation in China", The International Journal of Human Resource Management, 20(3), pp.676~693 (2009)
  32. E. A. Locke, "New directions in goal-setting theory", Current Directions in Psychological Science, 15(5), pp.265~268 (2006)
  33. E. A. Locke, "Building a practically useful theory of goal setting and task motivation : A 35-year odyssey", American Psychologist, 57(9), pp.705~717 (2002)
  34. B. E. Wright, "Job satisfaction in the public sector : The role of the work environment", The American Review of Public Administration, 33(1), pp.70~90 (2003)
  35. B. E. Wright., "The role of work context in work motivation : A public sector application of goal and social cognitive theories", Journal of Public Administration Research and Theory, 14(1), pp.59~78 (2004)
  36. J. M. Diefendorff, "Work motivation. International encyclopedia of the social &behavioral sciences", Elsevier, pp.680~686 (2015)
  37. C. C. Pinder., "Work motivation in organizational behavior" (1998), Prentice Hall
  38. E. A. Locke, "Work motivation and satisfaction : Light at the end of the tunnel", Psychological Science, 1(4), pp.240~246 (1990)
  39. A. B. Ruighaver, "Organisational security culture : Extending the end-user perspective", Computers & Security, 26(1), pp.56~62 (2007)
  40. I. Koskosas., "Goal setting and trust in a security management context", Information Security Journal : A Global Perspective, 17(3), pp.151~161 (2008)
  41. A. Li, "The effects of participation in goal setting and goal rationales on goal commitment : An exploration of justice mediators", Journal of Business and Psychology, 19(1), pp.37~51 (2004)
  42. Y. Chen, "Organizations' information security policy compliance : Stick or carrot approach?", Journal of Management Information Systems, 29(3), pp.157~188 (2012)
  43. J. C. Nunnally., "Psychometric theory" (1978), McGraw-Hill
  44. B. H. Wixom, "An empirical investigation of the factors affecting data warehousing success", MIS Quarterly, 25(1), pp.17~41 (2001)
  45. C. Fornell, "Evaluating structural equation models with unobservable variables and measurement error", Journal of Marketing Research, 18(1), pp.39~50 (1981)
  46. P. M. Podsakoff, "Common method biases in behavioral research : A critical review of the literature and recommended remedies", Journal of Applied Psychology, 88(5), pp.879~903 (2003)
  47. L. J. Williams, "An alternative approach to method effects by using latent-variable models : Applications in organizational behavior research", Journal of Applied Psychology, 79(3), pp.323~331 (1994)

관련 논문AI추천

조직원의 정보보안 정책 준수의도에 미치는 영향 연구: 계획된 행동이론, 공정성이론, 동기이론의 적용허성호, 황인호한국디지털정책학회 · 디지털융복합연구2018 · 제16권 제3호정보보안 정책 인식과 정보보안 관여성, 준수 의도성이 정보보안 행동에 미치는 영향 분석: 보상 차원과 공정성 차원을 중심으로허성호, 황인호중소기업융합학회 · 융합정보논문지2020 · 제10권 제12호조직공정성이 보안정책준수의지와 조직신뢰에 미치는 영향 : 산업보안업무 종사자를 중심으로이종호한국산업보안연구학회 · 한국산업보안연구2022 · 제12권 제2호조직구성원의 정보보안 준수 및 미준수 원인에 대한 연구허성호, 황인호한국융합학회 · 한국융합학회논문지2020 · 제11권 제9호정보보안 준수 피로 및 정책저항에 영향을 미치는 정보보안 갈등 완화에 관한 연구황인호한국중소기업학회 · 중소기업연구2022 · 제44권 제2호조직공정성이 보안관련 업무스트레스 및 부정적 행동에 미치는 영향안상준, 황인호한국컴퓨터정보학회 · 한국컴퓨터정보학회논문지2019 · 제24권 제11호

이 간행물의 다른 논문 (27건)

음성인식기술의 노인간병 적용을 위한 정책연구육현승, 조병철, 전수영, 김갑년pp. 9-17An Evaluation Model of IT Investment Effect김락상pp. 27-36북한이탈주민에 관한 주관성 연구 : Q방법론적 접근안이수pp. 37-45육군 병사들의 커플관계에 관한 연구 : 군 생활 스트레스, 커플관계 탄력성, 그리고 군 생활 적응의 관계전지경pp. 47-56학교 밖 청소년의 생활실태와 행복감 관련 변인홍은영, 황연경pp. 57-64
원문 보기