Does deterrence work in reducing information security policy abuse by employees?

By Qing Hu, Zhengchuan Xu, Tamara Dinev, Hong Ling. Communications of the ACM, 2011

346 citations recorded by the source corpus.

Subfields: Information Systems, Sociology and Political Science

View Paper: https://www.semanticscholar.org/paper/3a357661a8949e4b6b4cbe95e6a9e98894365857

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Sociology and Political Science

Citations in the corpus

Beyond Deterrence: An Expanded View of Employee Computer Abuse (2013, background): “These internal human threats fall along a continuum as indicated in Figure 1, and this range of behaviors is also articulated by Hu et al. (2011) and Guo et al. (2011).”
Why Do Adults Engage in Cyberbullying on Social Media? An Integration of Online Disinhibition and Deindividuation Effects with the Social Structure and Social Learning Model (2016, background): “Notably, we measured costs and benefits more generally, as is often the case in RCT applications to deviant behaviors (e.g., Bulgurcu et al. 2010; Hu et al. 2011), so that our adult respondents could best define what they considered to be costs and benefits for themselves.”
Information systems security policy compliance: An empirical study of the effects of socialisation, influence, and cognition (2014, background): “, deterrence theory, among IS security researchers [20,28,30,43], we decided to include constructs from that theory as part of the control variables.”
Future directions for behavioral information security research (2013, background): “We are aware of only a few studies that used known hackers as the informants, such as Young et al. (2007) and Hu et al. (2011b), but most of the research remains at the exploratory stage with limited sample sizes.”
Understanding Employee Responses to Stressful Information Security Requirements: A Coping Perspective (2014, result): “This finding is inconsistent with some security compliance studies [14, 29, 40], although others have reported that sanctions did not influence policy noncompliance [27, 33, 61].”
What Do Systems Users Have to Fear? Using Fear Appeals to Engender Threats and Fear that Motivate Protective Security Behaviors (2015, methodology): “A key example is that Siponen et al. (2010), Hu et al. (2011), and Lowry et al. (2013) use scenarios to study their security phenomena.”
An Enhanced Fear Appeal Rhetorical Framework: Leveraging Threats to the Human Asset Through Sanctioning Rhetoric (2015, background): “In a context similar to the current study and in line with the underlying assumptions of deterrence theory, Hu et al. (2011) found no support for the influence of sanction celerity on policy violation intentions.”
Managing Employee Compliance with Information Security Policies: The Critical Role of Top Management and Organizational Culture (2012, background): “…theories (Herath & Rao, 2009b; Myyry, Siponen, Pahnila, Vartiainen, & Vance, 2009; Bulgurcu, Cavusoglu, & Benbasat, 2010; Johnston & Warkentin, 2010) and criminological theories (Straub, 1990; Willison & Backhouse, 2006; D’Arcy, Havav, & Galletta, 2009; Siponen & Vance, 2010; Hu et al., 2011).”