The effects of multilevel sanctions on information security violations: A mediating model

Authors:
Ken H. Guo;Yufei Yuan
Affiliations:
College of Business, Western New England University, 1215 Wilbraham Road, Springfield, MA 01119, USA;DeGroote School of Business, McMaster University, 1280 Main St W, Hamilton, ON, L8P 4M4 Canada
Venue:
Information and Management
Year:
2012

Citing 8
Cited 0

Software Piracy in the Workplace: A Model and Empirical Test

Journal of Management Information Systems
Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness

Decision Support Systems
User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach

Information Systems Research
Neutralization: new insights into the problem of employee systems security policy violations

MIS Quarterly
User participation in information systems security risk management

MIS Quarterly
Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness

MIS Quarterly
Out of fear or desire? Toward a better understanding of employees' motivation to follow IS security policies

Information and Management
An integrative study of information systems security effectiveness

International Journal of Information Management: The Journal for Information Professionals

Quantified Score

Hi-index	0.00

Visualization

Abstract

We proposed and empirically tested a mediating model for examining the effects of multilevel sanctions on preventing information security violations in the workplace. The results of the experiment suggested that personal self-sanctions and workgroup sanctions have significant deterrent effects on employee security violations, but that the effect of organizational sanctions becomes insignificant when the other two types of sanctions are taken into account. Theoretically, the study pointed out the importance of personal self-sanctions and informal workgroup sanctions. Practically, our results suggested that an ''influencing'' strategy may be more effective than an ''enforcing'' one in information security management.