Information Security Effectiveness: Conceptualization and Validation of a Theory

International Journal of Information Security and Privacy (IJISP)

Volumn 1, Issue 2, 2007, Pages 37-60

  Knapp, Kenneth J ^a   Marshall, Thomas E ^b   Rainer, R Kelly ^b   Ford, F Nelson ^b  

^a UNITED STATES AIR FORCE ACADEMY   (United States)

^b AUBURN UNIVERSITY   (United States)

Author keywords

information security; organizational effectiveness; organizational IS; structural equation modeling; survey development; top management support

Indexed keywords

EID: 85001799501     PISSN: 19301650     EISSN: 19301669     Source Type: Journal    
DOI: 10.4018/jisp.2007040103     Document Type: Article

References (54)

1. Ariss, S.S. (2002). Computer monitoring: Benefts and pitfalls facing management. Information & Management, 39(7), 553–558.
2. Bagchi, K., & Udo, G. (2003). An analysis of the growth of computer and internet security breaches. Communications of the AIS, 12(46), 684–700.
3. Baskerville, R.L., & Myers, M.D. (2004). Special issue on action research in information systems: Making IS research relevant to practice. Forward. MIS Quarterly, 28(3), 329–335.
4. Benbasat, I., & Zmud, R.W. (1999). Empirical research in information systems: The practice of relevance. MIS Quarterly, 23(1), 3–16.
5. Bollen, K.A. (1989). Structural equations with latent variables. New York: John Wiley & Sons.
6. Campbell, D.T., & Fiske, D.W. (1959). Convergent and discriminant validation by the multi-trait-multimethod matrix. Psychological Bulletin, 56(2), 81–105.
7. Computer Emergency Response Team (CERT). (2004). CERT statistics. Retrieved May 2004, from http://www.cert.org/stats/ cert_stats.html#incidents.
8. DeVellis, R.F. (2003). Scale development. Theory and applications (2nd ed.) (Vol. 26). Thousand Oaks, CA: Sage Publications.
9. Dhillon, G., & Backhouse, J. (2001). Current directions in IS security research: Towards socio-organizational perspectives. Information Systems Journal, 11(2), 127–153.
10. Facteau, J.D., Dobbins, G.H., Russell, J.E.A., Ladd, R.T., & Kudisch, J.D. (1995). The infuence of general perceptions of training environment on pretraining motivation and perceived training transfer. Journal of Management, 21(1), 1–25.
11. Files, J. (2006, June 29). Missing laptop with veterans' data is found. New York Times.
12. Frazier, P.A., Barron, K.E., & Tix, A.P. (2004). Testing moderator and mediator effects in counseling psychology. Journal of Counseling Psychology, 51(1), 115–134.
13. Galal, G.H. (2001). From contexts to constructs: The use of grounded theory in operationalising contingent process models. European Journal of Information Systems, 10, 2–14.
14. Garg, A., Curtis, J., & Halper, H. (2003). The fnancial impact of IT security breaches: What do investors think? Information Systems Security, 12(1), 22–34.
15. Gefen, D. (2003). Assessing unidimensionality through LISREL: An explanation and example. Communications of the AIS, 12, 23–46.
16. George, J.F. (1996). Computer-based monitoring: Common perceptions and empirical results. MIS Quarterly, 20(4), 459–480.
17. Ghoshal, S. (2005). Bad management theories are destroying good management practices. Academy of Management Learning & Education, 4(1), 75–91.
18. Glaser, B.G., & Strauss, A.L. (1967). The discovery of grounded theory: Strategies for qualitative research. New York: Aldine Publishing Company.
19. Gopal, R.D., & Sanders, G.L. (1997). Preventive and deterrent controls for software piracy. Journal of Management Information Systems, 13(4), 29–47.
20. Gordon, L.A., Loeb, M.P., Lucyshyn, W., & Richardson, R. (2005). 10th annual CSI/FBI computer crime and security survey. San Francisco, CA: Computer Security Institute.
21. Harrington, S.J. (1996). The effect of codes of ethics and personal denial of responsibility on computer abuse judgments and intentions. MIS Quarterly, 20(3), 257–278.
22. Hinkin, T.R. (1998). A brief tutorial on the development of measures for use in survey questionnaires. Organizational Research Methods, 1(1), 104–121.
23. Hofstede, G. (1993). Cultural constraints in management theories. Academy of Management Journal, 7(1), 81–94.
24. Jarvenpaa, S.L., & Ives, B. (1991). Executive involvement and participation in the management of information technology. MIS Quarterly, 15(2), 205–221.
25. Jasperson, J.S., Carte, T.A., Saunders, C.S., Butler, B.S., Croes, H.J.P., & Zheng, W. (2002). Power and information technology research: A metatriangulation review. MIS Quarterly, 26(4), 397–459.
26. Kankanhalli, A., Hock-Hai, T., Bernard, C.Y.T., & Kwok-Kee, W. (2003). An integrative study of information systems security effectiveness. International Journal of Information Management, 23(2), 139–154.
27. Karahanna, E., Evaristo, R., & Srite, M. (2004). Methodological issues in MIS crosscultural research. In M.E. Whitman & A.B. Woszczynski (Eds.), The handbook of information systems research (pp. 166–177). Hershey, PA: Idea Group Publishing.
28. Kotulic, A.G., & Clark, J.G. (2004). Why there aren't more information security research studies. Information & Management, 41(5), 597–607.
29. Leach, J. (2003). Improving user security behavior. Computers & Security, 22(8), 685–692.
30. Lee, S.M., Lee, S.G., & Yoo, S. (2004). An integrative model of computer abuse based on social control and general deterrence theories. Information & Management, 41(6), 707–718.
31. MacKinnon, D.P., Krull, J.L., & Lockwood, C. (2000). Mediation, confounding, and suppression: Different names for the same effect. Prevention Science, 2, 15–27.
32. McCoy, S., Galletta, D.F., & King, W.R. (2005). Integrating national culture into IS research: The need for current individual-level measures. Communications of the Association for Information Systems, 15, 211–224.
33. Nunnally, J. (1978). Psychometric theory. New York: McGraw-Hill.
34. Orlikowski, W. (1993). CASE tools as organizational change: Investigating incremental and radical changes in systems development. MIS Quarterly, 17(3), 309–340.
35. Parker, D.B. (1981). Computer security management. Reston, VA: Reston Publishing Company.
36. Peace, A.G., Galletta, D.F., & Thong, J.Y.L. (2002). Software piracy in the workplace: A model and empirical test. Journal of Management Information Systems, 20(1), 153–177.
37. Podsakoff, P.M., MacKenzie, S.B., Lee, J.Y., & Podsakoff, N.P. (2003). Common method bias in behavioral research: A critical review of the literature and recommended remedies. Journal of Applied Psychology, 88(5), 879–903.
38. Podsakoff, P.M., & Organ, D.W. (1986). Self-reports in organizational research: Problems and prospects. Journal of Management, 12(4), 531–544.
39. Segars, A.H., & Grover, V. (1998). Strategic information systems planning success: An investigation of the construct and its measurement. MIS Quarterly, 22(2), 139–163.
40. Sharma, R., & Yetton, P. (2003). The contingent effects of management support and task interdependence on successful information systems implementation. MIS Quarterly, 27(4), 533–555.
41. Spector, P.E. (1994). Using self-report questionnaires in OB research: A comment on the use of a controversial method. Journal of Organizational Behavior, 15, 385–392.
42. Srinivasan, A. (1985). Alternative measures of system effectiveness: Associations and implications. MIS Quarterly, 9(3), 243–253.
43. Straub, D.W. (1990). Effective IS security: An empirical study. Information Systems Research, 1(3), 255–276.
44. Straub, D.W., Boudreau, M.C., & Gefen, D. (2004). Validating guidelines for IS positivist research. Communications of the AIS, 13(24), 380–427.
45. Straub, D.W., Limayem, M., & Karahanna-Evaristo, E. (1995). Measuring system usage: Implications for IS theory testing. MIS Quarterly, 41(8), 1328–1342.
46. Straub, D.W., & Nance, W.D. (1990). Discovering and disciplining computer abuse in organizations: A feld study. MIS Quarterly, 14(1), 45–60.
47. Straub, D.W., & Welke, R.J. (1998). Coping with systems risk: Security planning models for management decision making. MIS Quarterly, 22(4), 441–469.
48. Strauss, A., & Corbin, J. (1998). Basics of qualitative research. Techniques and procedures for developing grounded theory (2nd ed.). Thousand Oaks, CA: Sage.
49. Strickland, L.H. (1958). Surveillance and trust. Journal of Personality, 26, 200–215.
50. Venkatraman, N., & Ramanujam, V. (1987). Measurement of business economic performance: An examination of method convergency. Journal of Management, 13(1), 109–122.
51. von Solms, R., & von Solms, B. (2004). From policies to culture. Computers & Security, 23, 275–279.
52. Wasserman, J.J. (1969). Plugging the leaks in computer security. Harvard Business Review, 47(5), 119–129.
53. Williams, L.J., Cote, J.A., & Buckley, M.R. (1989). Lack of method variance in self-reported affect and perceptions at work: Reality or artifact? Journal of Applied Psychology, 74, 462–468.
54. Yang, K.S. (1986). Will societal modernization eventually eliminate cross-cultural psychological differences. In M.H. Bond (Ed.), The cross-cultural challenge to social psychology. Newbury Park, CA: Sage.