Security Policy Violations Research Articles

Exploring the factors influencing information security policy compliance and violations: A systematic literature review

Despite advancements in security technology, the prevalence of insider threats has been on the rise in recent years. Organizations implement Information Security Policies (ISPs) that outline the expected security-related behavior and compliance standards for employees. Ensuring and enhancing ISP compliance and reducing violations is crucial for organizations to maintain their security posture. This Systematic Literature Review (SLR) aims to synthesize the existing research on ISP compliance and violations to identify the underlying factors behind employee policy violations and delve into the factors that promote compliance with ISPs. In order to provide a theoretical foundation for understanding these behaviors, this SLR identifies the prominent theories used to explain ISP compliance and violation. A comprehensive search is conducted across different academic databases, applying defined inclusion and exclusion criteria to select the relevant studies between 2012 and 2023. To understand intentional violations, we categorize and analyze studies on ISP violations based on Moral Disengagement, Neutralization and Deterrence, Stress, and Monitoring mechanisms. For ISP compliance, we categorize and analyze studies based on individual-level decision-making and organizational-level factors. We identified forty-seven factors that influence compliance behavior and forty-one factors that determine non-compliance behavior. Fourteen common factors were identified from prior literature, which were determinants of both compliance and violation behaviors, with opposite directions of influence. By considering both compliance and noncompliance simultaneously, organizations can develop more effective strategies for enhancing compliance and mitigating noncompliance.

Network Intrusion Detection and Anomaly Classification

A software application known as an intrusion detection system (IDS) is utilized to monitor networks for any unauthorized or malicious activities that may violate security policies related to system confidentiality, integrity, and availability. Our thesis involved conducting extensive literature reviews on various types of IDS, anomaly detection methods, and machine learning algorithms that can be utilized for detection and classification. IDS are crucial for safeguarding advanced communication networks and were initially designed to identify specific patterns, signatures, and rule violations. In recent years, machine learning and deep learning approaches have been employed in the field of network intrusion detection, providing promising alternatives. Our proposed system involved identifying noisy features through causal intervention, preserving only those features that had a causality with cyberattacks. The ML algorithm was then utilized to make a preliminary classification to select the most relevant types of cyberattacks, ultimately leading to the detection of unique labeled cyberattacks through the counterfactual detection algorithm. Keywords—Intrusion Detection System (IDS), anomaly detection, machine learning algorithms, deep learning, causal intervention, cyberattack classification, and counterfactual detection.

Information security policy effectiveness: a managerial perspective of the financial industry in Vietnam

Purpose Information security (InfoSec) policy violations are of great concern to all organisations worldwide, especially in the financial industry. Although the importance of InfoSec policy has been highlighted for many decades, InfoSec breaches still occur due to a low level of employee compliance and a lack of engagement and competence in high-level management. However, previous studies have primarily investigated the behavioural aspects of InfoSec policy compliance at the individual level rather than the managerial factors involved in constructing InfoSec policy and developing its effectiveness. Thus, drawing on neo-institutional theory and a transformational leadership framework, this research investigated the influence of external mechanisms and transformational leadership on InfoSec policy effectiveness. Design/methodology/approach The research model was implemented using field survey data from professional managers in the financial sector. Findings The results reported that neo-institutional mechanisms and transformational leadership shape InfoSec policy effectiveness in an organisation. Originality/value This study broadens current InfoSec policy research from an individual level to a managerial perspective and enhances the existing literature on neo-institutional and transformational leadership in the context of InfoSec. It highlights the need to evaluate InfoSec policy based on external factors and to support transformational leadership styles that promote InfoSec policy enforcement and effectiveness.

A Study on the Navigating Cybersecurity Challenges in the Digital-era

In today's era Navigating cybersecurity concerns is a top priority for individuals, corporations, and governments in today's digital landscape. This in-depth research explores the complex realm of cybersecurity, looking at the new dangers and the methods used to successfully counter them. The swift growth of digital technologies, encompassing cloud computing and the widespread use of Internet of Things devices, has greatly expanded the attack surface, revealing weaknesses that malevolent actors can promptly take advantage of. Gaining an understanding of these weaknesses is essential to creating strong defenses. The present study centers on pivotal components of cybersecurity strategy, commencing with the pivotal function of encryption in safeguarding confidential information. An essential layer of security is provided by encryption methods and protocols, which prevent unauthorized users from reading data. Furthermore, the application of multi-factor authentication is examined as a crucial security precaution. The security of digital assets is greatly increased by MFA, which requires users to submit several kinds of authentication, such as passwords, biometric information, or security tokens. The study also explores the significance of intrusion prevention systems and intrusion detection systems in preventing unwanted access. IDS keeps an eye on networks for unusual behavior or security policy violations and instantly notifies administrators of any hazards. people can learn how to spot and avoid social engineering scams. Organizations may greatly lower the chance of successful cyber intrusions by arming users with knowledge. Finally This report concludes by emphasizing how urgent it is to address cybersecurity issues in the digital age. A proactive, multi-layered protection plan is essential due to the increasing sophistication and pervasiveness of cyber threats.

Investigate the Roles of Sanctions, Psychological Capital, and Organizational Security Resources Factors in Information Security Policy Violation

Investigate the Roles of Sanctions, Psychological Capital, and Organizational Security Resources Factors in Information Security Policy Violation

Not all information security-related stresses are equal: the effects of challenge and hindrance stresses on employees’ compliance with information security policies

ABSTRACT Information security-related stresses (SRSs) are widely considered to play a negative role in the workplace, motivating employees' violation of information security policies (ISPs). However, researchers have neglected to challenge SRS and its role in promoting positive security actions. Therefore, this study aimed to explore the effect of both challenge and hindrance SRSs on employees' intention to comply with ISPs and the moderating mechanisms of regulatory focus in the relationship between SRSs and ISP compliance. Using survey data from 489 employees in Chinese enterprises, we applied a PLS-SEM method to test hypotheses. Our study found that the hindrance SRS had a negative effect on ISP compliance intention, differently, challenge SRS motivates employees to comply with ISPs. Our study also found prevention focus acted as a positive moderator in the relationship between hindrance SRS and compliance intention, while promotion focus had no effect on this relationship; Promotion focus positively moderated the relationship between challenge SRS and compliance intention, and prevention focus negatively moderated the relationship between challenge SRS and compliance intention. These findings provide new knowledge by examining the different effects and the boundary conditions to understand how two types of SRS influence employees' informaiton security dicisions.

The role of ethical climates in employee information security policy violations

In the context of information security, the organizational social environment plays an important role in deterring employee violations of the Information Security Policy (ISP). As extant research has not yet determined the role ethical climates may play, this study seeks to understand their influence on employee ISP violations. To this end, we classified ISPs into two major categories: those related to communal information technology (IT) resources in the organization, such as databases or software applications, and those related to connective IT resources, such as email or Internet access. Then, we explored how rules-, performance-, and friendship-oriented organizational ethical climates affect ISP violations. Based on a survey of 177 professionals employed in the United States, we found that rules-oriented and friendship-oriented ethical climates deter ISP violations, whereas a performance-oriented one does not. Moreover, rules- and friendship-oriented ethical climates lead to fewer communal ISP violations, while performance-oriented ethical climates lead to more connectivity ISP violations. These findings underscore the importance of considering the type of IT resources that an ISP aims to protect as well as the ethical climate of an organization in order to better understand the causes of ISP violations.

The Role of Psychological Capital, Sanction and Organization Security Resources in Enhancing the Security behaviour of Employees who Violate Security Policies

The Role of Psychological Capital, Sanction and Organization Security Resources in Enhancing the Security behaviour of Employees who Violate Security Policies

The impact of work pressure and work completion justification on intentional nonmalicious information security policy violation intention

As businesses have had to change how they operate due to the coronavirus pandemic, the need for remote work has risen. With the continuous advancements in technology and increases in typical job demands, employees need to increase their work productivity beyond regular work hours in the office. This type of work environment creates even more opportunities for security breaches due to employees intentionally violating information security policy violations. Although explicitly prohibited by information security policies (ISP), organizations have observed that employees bring critical data out of the office to complete their work responsibilities remotely. Consequently, developing a deeper understanding of how work pressure may influence employees to violate ISPs intentionally is crucial for organizations to protect their critical information better. Based upon the fraud triangle theory, this study proposes the opportunity to copy critical data, work pressure, and work completion justification as the primary motivational factors behind why employees copy critical company data to unsecured storage devices to work at home. A survey was conducted of 207 employees from a marketing research firm. The results suggest that opportunity, work pressure, and work completion justification are positively related to nonmalicious ISP violation intentions. Furthermore, the interaction effect between work completion justification and work pressure on the ISP violation intention is significant and positive. This study provides new insights into our understanding of the roles of work pressure and work completion justification on intentional nonmalicious ISP violation behaviors.

Subject review: Intrusion Detection System (IDS) and Intrusion Prevention System (IPS)

Intrusion detection system (IDS) is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents, which are violations or imminent threats of violation of computer security policies. An intrusion prevention system (IPS) is software that has all the capabilities of an intrusion detection system and can also attempt to stop possible incidents. If anomaly traffic pass through the network IDS would generate a false positive which means it only detects the malicious traffic, takes no action and generates only alerts but IPS detects the malicious traffic or suspicious activity, takes the actions like terminate, block or drop the connections. This paper provides an explanation of network intrusion, detection, and prevention to overcome them.

Bad Employees: Examining Deviant Security Behaviors

ABSTRACT Control balance theory (CBT) is a control-based theory of deviant behavior When imbalances in control between an individual and their environment exist, deviant behavior can occur. However, sufficient violation motivation and the facilitating conditions must exist. Past research has shown that technology itself often provides the means for deviant behavior among organizational employees. Presently, research on employee deviance using technology is underdeveloped in the field of Information Systems. Further, no work has been done to explore CBT in the context of Information Systems Security Policy violations, which are often a form of technology-facilitated deviant behavior. This study examines, for the first time, Tittle’s full set of proposed constructs, including fear, in the context of technology-based employee security deviance. This research uses CBT to demonstrate the importance of understanding the interplay between technology and employee deviance and the role of organizations in preventing it.

A model‐based framework for inter‐app Vulnerability analysis of Android applications

AbstractAndroid users install various apps, such as banking apps, on their smart devices dealing with user‐sensitive information. The Android framework, via Inter‐Component Communication (ICC) mechanism, ensures that app components (inside the same app or on different apps) can communicate. The literature works have shown that this mechanism can cause security issues, such as app security policy violations, especially in the case of Inter‐App Communication (IAC). Despite the plethora of research on detecting security issues in IAC, detection techniques face fundamental ICC challenges for improving the precision of static analysis. Challenges include providing comprehensive and scalable modeling of app specification, capturing all potential ICC paths, and enabling more effective IAC analysis. To overcome such challenges, in this paper, we propose a framework called VAnDroid2, as an extension of our previous work, to address the security issues in multiple components at both intra‐ and inter‐app analysis levels. VAnDroid2, based on Model‐Driven Reverse Engineering, has extended our previous work as per following: (1) providing a comprehensive Intermediate Representation (IR) of the app which supports extracting all the ICC information from the app, (2) extracting high‐level representations of the apps and their interactions by omitting the details that are not relevant to inter‐app security analysis, and (3) enabling more effective IAC security analysis. This framework is implemented as an Eclipse‐based tool. The results of evaluating VAnDroid2 w.r.t. correctness, scalability, and run‐time performance, and comparing with state‐of‐the‐art analysis tools well indicate that VAnDroid2 is a promising framework in the field of Android inter‐app security analysis.

The valued coexistence of protection motivation and stewardship in information security behaviors

Organizations need to consider different managerial approaches to motivate security compliance behavior as more employees work outside of the office. This study examines two approaches for motivating security compliance behaviors in a changing work environment. We examine protection motivation and stewardship-based strategic approaches to determine their effectiveness towards influencing information security behaviors. Independently, each approach has received demonstrable evidence of contributing to organizational behaviors. However, as the nature of work changes (e.g., hoteling, traveling, working from home), it also changes the security risk landscape for organizations, rendering the effectiveness of previous security controls debatable. This study contends there is value to management in integrating both protection motivation and stewardship approaches in this context. A research model is developed that integrates both approaches; protection motivation and stewardship concepts. We find that constructs consistent with protection motivation theory are more likely to explain decreases in security policy violations than stewardship theory. Further, by combining protection motivation and stewardship perspectives, this study's results supplement our understanding of security policy violations in a changing work environment. We show that the two together account for 51 percent of the variance, and thus both have value. Our findings suggest that a PMT-based strategy is a stronger approach for influencing compliance behavior. Therefore, it is important for organizations to continue focusing their efforts on threat communications as well as enhancing employees’ abilities to respond. However, we also show that organizations should build a sense of belonging with their employees such that their employees become stewards of the organization's resources.

Method of Forming Various Configurations of Telecommunication System Using Moving Target Defense

The purpose of this paper is to improve the effectiveness of the Moving Target Defense (MTD)-based protection method, which reduces the problem of using traditional network protection tools due to the static nature of network services and configurations. Options for solving the problems of choosing an adequate time interval for activating the technology of MTD and its application in networks are given. A new approach is proposed, which consists in creating a set of system configurations and changing it when an attack is detected and determined. The design implementation was tested on a network model using software defined networks (SDN). The advantages of the proposed method are highlighted, among which the most significant are: simple operation scheme, ability to deploy the system without the use of software-defined networks and absence of violations of security policies within the system.

Network Services Anomalies in NFV: Survey, Taxonomy, and Verification Methods

Network Function Virtualization (NFV) has emerged as a disruptive networking architecture whose galloping evolution is prompting enterprises to outsource network functions to the cloud and ultimately harvest the fruits of cloud computing, including elasticity, pay-as-you-go billing model, and on-demand services provisioning. However, many reluctant enterprises oppose the benefits of this outsourcing to their critical and pressing concerns about security, trust, and compliance. The latter anticipate possible security and QoS policy violations stemming from dishonest behaviors by cloud providers, attacks by co-resident competitors, misconfiguration by cloud administrators, or implementations flaws by NFV developers. As a result, migrating sensitive workloads to the cloud requires enterprises to first assess risks by gaining knowledge of possible network services’ anomalies and second, to build trust in the cloud by designing effective mechanisms to detect such anomalies. This survey provides scrutiny of network services anomalies that may occur in the NFV environments. We first present a taxonomy of network service anomalies and analyze their negative impacts on critical service attributes, including security and performance. Second, we compare and classify the existing anomalies’ verification mechanisms from the literature. Finally, we point out the literature gap and identify future research directions for anomalies verification in NFV.

Investigation of information security policy violations among oil and gas employees: A security-related stress and avoidance coping perspective

Information security is one of the most crucial considerations in digitising Oil and Gas (O&G) organisations. For ensuring information security policy compliance, O&G organisations enforce heavy security requirements. The purpose of this article is to assess how O&G employees cope with stressful information security tasks and how security-related stress (SRS) is related to information security policy violations among O&G employees in developing countries. Based on the coping theory, this article develops a theoretical framework to examine O&G employees’ intention to violate information security policies. The framework is tested using a survey of 270 managers/executives from 150 Malaysian O&G organisations. The results indicated that O&G employees perceive security requirements as stressful to follow and adopt avoidance coping strategies that lead them to violate organisational information security policies. For practitioners, the study findings demonstrate the prevalence of technostress in O&G organisations and suggest alternative mechanisms to address the stressful effects of information security requirements. This article contributes to the information system security literature by testing procrastination and psychological detachment with SRS in the context of developing countries' O&G organisations’ employees and provides an understanding of how O&G employees adopt avoidance coping.

An Assessment of Employee Knowledge, Awareness, Attitude towards Organizational Cybersecurity in Cameroon

In our increasingly digitized and interconnected society, people are poorly protected against cyberthreats, with the main reason being user behavior. Human behavior and actions are unpredictable in nature and this make human an important element and enabler of cybersecurity. The objective of the study is promotion of adoption of non-technical countermeasures (such as user awareness) for a comprehensive and holistic way to manage cyber security in organizations in Cameroon. We conducted a subjective study to measure the level of employees’ knowledge and general awareness, risky behavior they engage in, and attitude toward various aspects of cybersecurity and cyberthreats to show the need for user education, training, and awareness. For the study described in this paper, a self-report questionnaire was developed and data were collected from 214 participants. The results of a descriptive statistic percentage indicated that less than 50% of respondents have completed or has regular training program. We find that over 61% of the participants do not have sufficient knowledge of their organization cyber security policies. Among other findings, the over 60% of employees’ mistakes or violations of security policy are not disciplined or penalized is a demonstration of lack of legal status of cyber-attacks. Cyber resilience in any organization is a responsibility shared by both management and employees. Proactive human management element that can actively hunt for malicious activity and indicators of compromise is recommended.

Efficient Autonomous Defense System Using Machine Learning on Edge Device

As a large amount of data needs to be processed and speed needs to be improved, edge computing with ultra-low latency and ultra-connectivity is emerging as a new paradigm. These changes can lead to new cyber risks, and should therefore be considered for a security threat model. To this end, we constructed an edge system to study security in two directions, hardware and software. First, on the hardware side, we want to autonomically defend against hardware attacks such as side channel attacks by configuring field programmable gate array (FPGA) which is suitable for edge computing and identifying communication status to control the communication method according to priority. In addition, on the software side, data collected on the server performs end-to-end encryption via symmetric encryption keys. Also, we modeled autonomous defense systems on the server by using machine learning which targets to incoming and outgoing logs. Server log utilizes existing intrusion detection datasets that should be used in real-world environments. Server log was used to detect intrusion early by modeling an intrusion prevention system to identify behaviors that violate security policy, and to utilize the existing intrusion detection data set that should be used in a real environment. Through this, we designed an efficient autonomous defense system that can provide a stable system by detecting abnormal signals from the device and converting them to an effective method to control edge computing, and to detect and control abnormal intrusions on the server side.

Vigorous IDS on Nefarious Operations and Threat Analysis Using Ensemble Machine Learning

The geometric increase in the usage of computer networking activities poses problems with the management of network normal operations. These issues had drawn the attention of network security researchers to introduce different kinds of intrusion detection systems (IDS) which monitor data flow in a network for unwanted and illicit operations. The violation of security policies with nefarious motive is what is known as intrusion. The IDS therefore examine traffic passing through networked systems checking for nefarious operations and threats, which then sends warnings if any of these malicious activities are detected. There are 2 types of detection of malicious activities, misuse detection, in this case the information about the passing network traffic is gathered, analyzed, which is then compared with the stored predefined signatures. The other type of detection is the Anomaly detection which is detecting all network activities that deviates from regular user operations. Several researchers have done various works on IDS in which they employed different machine learning (ML), evaluating their work on various datasets. In this paper, an efficient IDS is built using Ensemble machine learning algorithms which is evaluated on CIC-IDS2017, an updated dataset that contains most recent attacks. The results obtained show a great increase in the rate of detection, increase in accuracy as well as reduction in the false positive rates (FPR).

Examining the Neural Basis of Information Security Policy Violations: A Noninvasive Brain Stimulation Approach

Nonmalicious information security policy (ISP) violations can cause organizations significant harm. Here, we aim to extend the understanding of why employees engage in such acts. A large body of ISP violation research is based on the tenet that people violate ISPs to obtain personal benefits, as explained by rational choice and expectancy theories. But this assumption has only been weakly tested, using mostly correlational approaches. Our objective is to improve the causal basis for this argument by using a noninvasive brain stimulation (NIBS) technique, which actually modulates brain activity in regions of the brain that process value/gain assessments. Therefore, it can substantially increase the claim of causality—that expected rewards lead to ISP violations. To do so, we build on expectancy theory and neuroscience knowledge to theorize why reducing the excitability of neurons in the left dorsolateral prefrontal cortex (L DLPFC) can lower the endorsement of ISP violations. We test this idea in four experiments in which we use a NIBS technique called high-definition direct current stimulation (HD-tDCS). Our findings support the assertion that the L DLPFC is likely involved in the expectancy theory of ISP violations, and that endorsing such violations can be experimentally adjusted with NIBS techniques. These findings extend the understanding of cybersecurity behaviors, improve the causal support for the common assumption made by rational choice theory studies that ISP violations are motivated through perceived benefits, point to the need to consider the L DLPFC in research on positively valenced (or attractive) technology-mediated actions, and pave the way for future use of brain stimulation techniques for stronger causality claims in information systems research.