English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

INTRODUCTION Anxiety around the security of Information Systems (IS) in many organizations has gained fundamental traction in recent years because of the threats posed by insider employees (Browne, Lang, & Golden, 2015). A primary catalyst for anxiety has been IS security incidents commonly caused by employees who are non-compliant with IS security policies. Employee non-compliance with IS security policies has been noted to lead to breaches that have cost organizations millions of dollars in losses (Herath & Rao, 2009). Academic literature points to increased empirical studies on security compliance and violations, in an effort to understand and provide ways organizations could mitigate security threats that emanate from non-compliance of security policies by employees. An investigation of scholarly work around systems security violations points to various perspectives that would enlighten the understanding of these violations. While violation of security policies may be maliciously intended, Vroom and von Solms (2004) contend that most violations result from negligence and ignorance. Management's response to violations of negligence and ignorance is often owning up to failure in IS security governance and the programmes meant to encourage compliance. According to Herath and Rao (2009), empirical evidence suggests that employees seldom comply with policies and moreover many allude to convenience to justify non-compliance. Deterrence theory used in IS research has suggested that unwelcome behavior and behavior that could lead to noncompliance "can be deterred through a certain, swift, and/or severe threat of punishment" (Herath & Rao, 2009). Punishment resulting from non-compliance is a central element of management decision making process and should not be seen as an easy task. It is because of such unease in decision making that many scholars have embarked on understanding inherent underlying complexities and consequences of violations (Eranova & Prashntham, 2016). COMPLEXITIES IN UNDERSTANDING IS SECURITY POLICY VIOLATIONS In context to the discipline of information systems, violation of security policy could be argued as inherently complex and would require a more profound understanding as to why and how security violations occur. The "problem" concerning IS security policy violations is an understanding represented in research as that of a continuum between those violations that are voluntary and malicious in nature against those that are non-voluntary and non-malicious. Nested within this continuum of security violations is a deeper but less explicit understanding of violations, in this case as 'paradoxical' and failure by research and practice to engage violations as paradoxes. Problematizing violations (critically reflecting on IS security violations) is therefore to be seen as beneficial to scholar and practice. Scholars and practitioners in IS have attempted to problematize IS security violations and to suggest appropriate interventions from various other lenses such as neutralization (Barlow, Warkentin, Ormond, & Dennis, 2013; Siponen & Vance, 2010) and rationalization (Browne et al., 2015; Bulgurcu, Cavusoglu, & Benbasat, 2010; Vance & Siponen, 2012; Wei & Hsu, 2014). Other empirical studies on security violations have drawn on popular IS theories such as Deterrence theory (Straub, 1990), Protection Motivation (Warkentin, Malimage, & Malimage, 2012; Siponen, Mahmood, & Pahnila, 2014; Browne et al., 2015), which are seen as normative and prescriptive. In order to better understand the theoretical predisposition of IS security policy violation, this article builds on previous published work on IS security policy violations (Njenga, 2016). What has not been explained from the said work is that these violations can be construed uniquely as paradoxes. The paradox perspective, borrowed from the discipline of management, is therefore introduced as an insightful lens in this article. …

Understanding Internal Information Systems Security Policy Violations as Paradoxes