The effects of moral disengagement and organizational ethical climate on insiders’ information security policy violation behavior

An Investigation of Employees' Intention to Comply with Information Security System-A Mixed Approach Based on Regression Analysis and fsQCA

Employee security compliance behavior has become an important safeguard to protect the security of corporate information assets. Focusing on human factors, this paper discusses how to regulate and guide employees' compliance with information security systems through effective methods. Based on protection motivation theory (PMT), a model of employees' intention to comply with the information security system was constructed. A questionnaire survey was adopted to obtain 224 valid data points, and SPSS 26.0 was applied to verify the hypotheses underlying the research model. Then, based on the results of a regression analysis, fuzzy set qualitative comparative analysis (fsQCA) was used to explore the conditional configurations that affect employees' intention to comply with the information security system from a holistic perspective. The empirical results demonstrated that perceived severity, perceived vulnerability, response efficacy, and self-efficacy all positively influenced the employees' intention to comply with the information security system; while rewards and response costs had a negative effect. Threat appraisal had a greater effect on employees' intention to comply with the information security system compared to response appraisal. The fsQCA results showed that individual antecedent conditions are not necessary to influence employees' intention to comply with an information security system. Seven pathways exist that influence an employees' intention to comply with an information security system, with reward, self-efficacy, and response cost being the core conditions having the highest probability of occurring in each configuration of pathways, and with perceived severity and self-efficacy appearing in the core conditions of configurations with an original coverage greater than 40%. Theoretically, this study discusses the influence of the elements of PMT on employees' intention to comply with an information security system, reveals the mechanism of influence of the combination of the influencing factors on the outcome variables, and identifies the core factors and auxiliary factors in the condition configurations, providing a new broader perspective for the study of information security compliance behavior and providing some theoretical support for strengthening enterprise security management. Practically, targeted suggestions are proposed based on the research results, to increase the intention of enterprise employees to comply with information security systems, thereby improving the effectiveness of enterprise information security management and the degree of information security in enterprises.

Does bad gossiping trigger for targets to hide knowledge in morally disengaged? New multi-level insights of team relational conflict

Purpose

Despite the recent extending research on knowledge hiding, there is still scant research on social stressor phenomena-related contextual antecedent factors and new cognitive mechanisms of knowledge hiding behaviors. To shed new light on this unexplored gap, this research explores the multi-level moderated mediation model that examines how and when negative gossip experienced by targets in the workplace induces their knowledge hiding from coworkers drawing from the lens of social learning and cognitive theories. More specifically, this study aims to evaluate the relationship between negative workplace gossip and knowledge hiding via moral disengagement, and this mediation effect is also moderated by team relational conflict as a novel boundary condition.

Design/methodology/approach

This study collected multi-wave 338 employees’ data from 68 teams of cross-sectional industries in China, which were nested within teams. The collected nested nature data were analyzed by employing multi-level analysis based on hierarchical linear modeling.

Findings

The results suggested that negative workplace gossip first triggers moral disengagement and thereby, leads to knowledge hiding. Furthermore, the direct positive association between negative workplace gossip and moral disengagement was strengthened by increasing intra-team relational conflict. In addition, the mediation effect of moral disengagement between negative workplace gossip and knowledge hiding was also strengthened through increasing intra-team relational conflict.

Originality/value

This study first empirically examines the multi-level model using a new underlying mechanism (moral disengagement) and team-level boundary condition (relational conflict) and enriches the current literature on knowledge management and workplace gossip. Theoretical and practical implications of these findings and future research lines are also discussed, which will facilitate practitioners and academicians to curb counterproductive knowledge behavior.

The COVID-19 pandemic: The mitigating role of government and hotel support of hotel employees in Egypt

We investigated the effect of government support of hotels on hotels' employee support (namely, health support, staff retention, and staff training) and consequently on employee job satisfaction and organizational commitment, through the moderating role of perceived overall organizational justice and ethical climate, during the COVID-19 pandemic. Using a quantitative approach and a framework that drew on the stakeholder and organizational support theories, we collected data from 669 employees in Egyptian hotels through a web-based survey. The results support the proposed framework and show a positive effect of government support through the strengthened perception of perceived overall organizational justice. Surprisingly, findings indicated that the association between job satisfaction and organizational commitment is significantly and negatively influenced by hotel ethical climate. Furthermore, job satisfaction partially mediates the association between hotels' support of employees and organizational commitment. The study holds important implications for both theory and practice.

Hospital Staff's Adherence to Information Security Policy: A Quest for the Antecedents of Deterrence Variables

Information security has come to the forefront as an organizational priority since information systems are considered as some of the most important assets for achieving competitive advantages. Despite huge capital expenditures devoted to information security, the occurrence of security breaches is still very much on the rise. More studies are thus required to inform organizations with a better insight on how to adequately promote information security. To address this issue, this study investigates important factors influencing hospital staff’s adherence to Information Security Policy (ISP). Deterrence theory is adopted as the theoretical underpinning, in which punishment severity and punishment certainty are recognized as the most significant predictors of ISP adherence. Further, this study attempts to identify the antecedents of punishment severity and punishment certainty by drawing from upper echelon theory and well-acknowledged international standards of IS security practices. A survey approach was used to collect 299 valid responses from a large Taiwanese healthcare system, and hypotheses were tested by applying partial least squares-based structural equation modeling. Our empirical results show that Security Education, Training, and Awareness (SETA) programs, combined with internal auditing effectiveness are significant predictors of punishment severity and punishment certainty, while top management support is not. Further, punishment severity and punishment certainty are significant predictors of hospital staff’s ISP adherence intention. Our study highlights the importance of SETA programs and internal auditing for reinforcing hospital staff’s perceptions on punishment concerning ISP violation, hospitals can thus propose better internal strategies to improve their staff’s ISP compliance intention accordingly.

Avoidance behaviour towards using pirated software: testing a seven-component model on SME employees

Purpose

This research aims to develop and test a conceptual model for shaping small and medium enterprise (SME) employees' avoidance behaviour towards using pirated software. The model specifies the components of morality, spirituality, emotional intelligence and ethical values that influence employees' avoidance behaviour towards using pirated software.

Design/methodology/approach

A conceptual framework was developed and tested on the basis of information technology and management literature by using data from 275 influential and active employees of SMEs. Data were collected via a survey and analysed through covariance-based structural equation modeling (CB-SEM).

Findings

In the context of SMEs, employees' avoidance behaviour towards using pirated software is motivated by significant moral antecedents. Moral equity and judgement significantly influence employees' avoidance behaviour towards using pirated software when moral emotion mediates such a relationship. In addition, individual spirituality significantly moderates the relationship between moral equity and moral emotion. Employees' emotional intelligence optimises the strength of the relationship between moral judgement and moral emotion. Employees' likelihood to engage in unethical behaviour decreases when they exhibit strong ethical values in the relationship between moral emotion and their behaviour towards using pirated software.

Research limitations/implications

This study offers theoretical support for employees' avoidance behaviour towards using pirated software. The findings of this cross-sectional work have limited generalisability. Single-country data may not be generalised to SME employees in other countries. Thus, cross-country analysis and additional measures and antecedents must be developed and identified in the future.

Practical implications

Policymakers and managers should consciously review the proposed seven-component model that causes SME employees to avoid the use of pirated software. Ethical standards that lessen the use of pirated software can be improved if managers and policymakers understand the components of moral equity and judgement that influence moral emotions.

Originality/value

This study is the first to examine the specific antecedents of the ethical standards and avoidance behaviours of SME employees towards the use of pirated software. As such, it provides a foundation for further studies on this critical area and software piracy in the context of SMEs in an emerging economy, which is limited in current literature.

The “Right” recipes for security culture: a competing values model perspective

Purpose

This study argues that the effect of perceived organizational culture on the formation of security-related subjective norms and the level of compliance pressure will vary based on how the employees perceive their organization's cultural values. These perceptions reflect on the assumptions and principles that organizations use to guide their security-related behaviors. To make these arguments, we adopt the competing values model (CVM), which is a model used to understand the range of organizational values and resulting cultural archetypes.

Design/methodology/approach

This study conducted a survey of working professionals in the banking and higher education industries and used partial least squares (PLS)-structural equation model (SEM) to analyze the data. In a series of post hoc analyses, we ran a set of multi-group analyses to compare the perceived organizational cultural effects between the working professionals in both industries.

Findings

Our study reveals that perceived organizational cultures in favor of stability and control promoted more positive security-related behaviors. However, the different effects were more pronounced when comparing the effects between the working professionals in both industries.

Originality/value

This study is one of the few that examines which cultural archetypes are more effective at fostering positive security behaviors. These findings suggest that we should be cautious about generalizing the effects of organizational culture on security-related actions across different contexts and industries.