Search

We conducted a design-science research project to improve an organization's compound problems of (1) unsuccessful employee phishing prevention and (2) poorly received internal security training. To do so, we created a gamified security training system focusing on two factors: (1) enhancing intrinsic motivation through gamification and (2) improving security learning and efficacy. Our key theoretical contribution is proposing a recontextualized kernel theory from the hedonic-motivation system adoption model that can be used to assess employee security constructs along with their intrinsic motivations and coping for learning and compliance. A six-month field study with 420 participants shows that fulfilling users' motivations and coping needs through gamified security training can result in statistically significant positive behavioral changes. We also provide a novel empirical demonstration of the conceptual importance of "appropriate challenge" in this context. We vet our work using the principles of proof-of-concept and proof-of-value, and we conclude with a research agenda that leads toward final proof-in-use. [ABSTRACT FROM AUTHOR]

The pressures associated with the speed of competition, including the digitalization of workspaces, are increasing the need for modern organizations to drive employee satisfaction and engagement. Integrating gamification into the workplace has been identified as a possible strategy to promote employee participation, engagement and loyalty. Gamification is defined as the application of game design elements in a non‐game context, which, in this case, is the workplace. This article presents a 12‐month longitudinal study designed to investigate the role of gamification in fostering job satisfaction and engagement. The findings from a sample of 398 employees, including both treatment and control groups from a large multinational company that introduced a gamified human resource management (HRM) system, revealed the effects of certain gamification experiential outcomes related to driving employee satisfaction and engagement at work. Overall, our study highlights the possibilities of employing gamified HRM systems to influence employee attitudes and behavior at work. [ABSTRACT FROM AUTHOR]

LinkedIn, with over 1.5 million Groups, has become a popular place for business employees to create private groups to exchange information and communicate. Recent research on social networking sites (SNSs) has widely explored the phenomenon and its positive effects on firms. However, social networking's negative effects on information security were not adequately addressed. Supported by the credibility, persuasion and motivation theories, we conducted 1) a field experiment, demonstrating how sensitive organizational data can be exploited, followed by 2) a qualitative study of employees engaged in SNSs activities; and 3) interviews with Chief Information Security Officers (CISOs). Our research has resulted in four main findings: 1) employees are easily deceived and susceptible to victimization on SNSs where contextual elements provide psychological triggers to attackers; 2) organizations lack mechanisms to control SNS online security threats, 3) companies need to strengthen their information security policies related to SNSs, where stronger employee identification and authentication is needed, and 4) SNSs have become important security holes where, with the use of social engineering techniques, malicious attacks are easily facilitated. [ABSTRACT FROM AUTHOR]

Scholars and practitioners agree that the future of payment is mobile contactless payment (MCP). However, while many projects concerning the implementation of MCP solutions have been started, MCP is still not available in most countries. Concerning this fact, studies on the obstacles to MCP implementation conclude that the formation of interorganizational relationships (IORs) is an important aspect to the success of any MCP project. In this study, the authors research the influence of organizational culture on IORs in the French MCP service, Cityzi. They conducted interviews with executives of the main organizations involved and collected data about the organizational culture using a quantitative questionnaire. The results revealed that the organizations involved in Cityzi emphasize a developmental culture that drives innovation and competition between the organizations involved, which leads to rivalry between them. The authors conclude that the centralized structure around a coordinating organization that displays a group culture supports the implementation of MCP systems. [ABSTRACT FROM AUTHOR]

'Nobody ever got fired for buying IBM,' was a widely used cliché in the 1970s in the corporate IT (information technology) world. Since then, the traditional process of purchasing software has dramatically changed, challenged by the advent of open source software (OSS). Since its inception in the 1980s, OSS has matured, grown, and become one of the important driving forces of the enterprise ecosystem. However, it has also brought important IT security risks that are impacting the OSS IT adoption decision-making process. The recent Heartbleed bug demonstrated the grandeur of the issue. While much of the noise relates to the amplification of perceived risks by the popular mass media coverage, the effect is that many enterprises, mainly for risk reasons, have still chosen not to adopt OSS. We investigated 'how do information security related characteristics of OSS affect the risk perception and adoption decision of OSS' by conducting an online survey of 188 IT decision-makers. The proposed Open Source Risk Adoption Model offers novel insights on the importance of the perceived risk antecedents. Our research brings new theoretical contributions, such as understanding the perceived IT security risk (PISR) relationship with adoption intention (AI) in the OSS context, for researchers and important insights for IT information professionals. We have found that IT security risk has a significant role in OSS adoption intention. Our results offer possible future research directions and extend existing theoretical understanding of OSS adoption. [ABSTRACT FROM AUTHOR]

In 2011, the CEO of Atos, Thierry Breton, announced an unprecedented move for the company. The global information services giant would become a 'zero' email company with the objective of eradicating internal email use and replacing it with blueKiwi - enterprise social network software. This case serves to teach the challenges and key lessons behind the social collaboration transformation in a large organization where 76,000 employees switched to a new mode of collaboration. The approach of how to become a zero email company is detailed, highlighting the importance of the first-order and second-order change. The case helps to understand what it takes to shift organizational culture and employee mindset, as well as what challenges and barriers need to be overcome to make such an important step on a large organizational scale. [ABSTRACT FROM AUTHOR]

Purpose - The purpose of this literature review is to analyze current trends in information security and suggest future directions for research. Design/methodology/approach - The authors used literature review to analyze 1,588 papers from 23 journals and 5 conferences. Findings - The authors identified 164 different theories used in 684 publications. Distribution of research methods showed that the subjective-argumentative category accounted for 81 per cent, whereas other methods got very low focus. This research offers implications for future research directions on information security. They also identified existing knowledge gaps and how the existing themes are studied in academia. Research limitations/implications - The literature review did not include some dedicated security journals (i.e. Cryptography). Practical implications - The study reveals future directions and trend that the academia should consider. Originality/value - Information security is top concern for organizations, and this research analyzed how academia dealt with the topic since 1977. Also, the authors suggest future directions for research suggesting new research streams. [ABSTRACT FROM AUTHOR]

Purpose – The purpose of this paper is to reveal factors that impact information governance within the mobile technology implementation in organizations in the dual-use context.Design/methodology/approach – Case study methodology was used and 15 semi-structured interviews were conducted with records and information management (RIM) and information security professionals from different types of organizations.Findings – There are three main findings. First, stakeholder support is critical to drive the change and leverage organizational security culture. Second, records mobility with data security dimension represents the biggest challenge for RIM stakeholders. Third, mobile strategy and security framework are two must-win areas for a successful mobile implementation.Research limitations/implications – The paper does not include any end-user perspective in interviews and this end-user context is missing.Practical implications – Awareness through education and training of employees needs to be given very particular attention in the future mobile implementations. Moreover, management and employee support is the critical component of the effective information security governance framework implementation. Finally, mobile strategy needs undergo a very precise and detailed planning process to ensure the right technology acceptance by users.Originality/value – The paper closes an existing research gap and provides useful insights to record management professionals and practitioners on factors that impact effective information governance implementation within the mobile dual-use context. [ABSTRACT FROM AUTHOR]