ITR: Behavioral Information Security: The Politics, Motivation, and Ethics of Information Security in Work Organizations

许多信息安全技术解决方案只有在个人和群体有效实施时才能发挥良好作用。本提案通过关注“行为信息安全”来解决这一约束，行为信息安全被定义为组织内影响信息系统可用性、机密性和完整性的人类行为的复合体。通过利用社会科学和组织科学的理论，这种方法试图促进对组织中安全相关行为的性质和前因的理解。这些调查人员先前的研究表明，冲突的组织亚文化，不适当的组织激励措施，沟通障碍，以及行为的道德标准混乱，所有这些都干扰了组织中信息安全的有效实施。拟议的研究将建立在这一已完成和正在进行的工作，以制定一个理论框架的行为信息安全的组织。该框架将明确解决组织在控制行为方面的利益与个人权利之间的紧张关系（例如，自决、言论、隐私）。该项目将使用多案例研究方法观察和记录组织中与安全相关的行为。 团队成员将进行一系列的现场采访和工作观察与工人，管理人员和信息技术专业人员在10到20个组织的业务在研究团队的区域，包括小型和大型组织，盈利和非盈利组织，并可能是一个政府组织。 该团队将识别和分析特定的社会配置、权力动态、学习机会、行动自由和个人特征，这些因素会影响员工决定如何遵守、抵制或改进规定的信息安全行为。采访和观察数据的汇编，转录和分析将导致一个初步的理论框架的发展和测试。研究人员将通过会议、学术期刊投稿、从业人员简要文章以及项目网站的开发来传播项目成果。在项目结束时，他们将编译一个数据档案，供其他学者使用，其中包括所有transmittance的去识别版本。 此外，该项目打算与行业新闻界合作，研究信息安全的行为方法。 该项目有可能提高医院和公用事业等关键基础设施组织的信息安全实践的有效性。由于信息安全的成本在许多行业持续上升，它在许多部门也具有潜在的经济效益。然而，同时，通过关注工人的关切，结果可能有助于组织避免侵犯或削弱工人个人的权利。

Many technical solutions to information security only function well when operationalized effectively by individuals and groups of people. The present proposal addresses this constraint by focusing on "behavioral information security," defined as the complexes of human action within organizations that influence the availability, confidentiality, and integrity of information systems. By harnessing theories from the social and organizational sciences, this approach attempts to advance the understanding of the nature and antecedents of security-related behavior in organizations. Prior research by these investigators has revealed that conflicting organizational subcultures, inappropriate organizational incentives, communication barriers, and disconcerted ethical standards for behavior each and all interfere with the effective enactment of information security in organizations. The proposed research will build on this completed and in-progress work to develop a theoretical framework for behavioral information security in organizations. The framework will explicitly address the tension between organizations' interests in controlling behavior and individuals' rights (e.g., self determination, speech, privacy). The project will observe and document security-related behavior in organizations, using a multiple case study approach. Team members will conduct a series of onsite interviews and job observations with workers, managers, and information technology professionals at ten to twenty organizations with operations in the research team's regional area, including small and large organizations, for profit and non-profit organizations, and possibly a governmental organization. The team will identify and analyze the specific social configurations, power dynamics, learning opportunities, freedom of action, and personal characteristics that influence how workers decide to comply with, resist, or improve upon prescribed information security behavior. Compilation, transcription, and analysis of interview and observational data will lead to the development and testing of a preliminary theoretical framework. Investigators will disseminate project results through conferences, scholarly journal submissions, and brief practitioner articles and through the development of a project website. At the close of the project, they will compile a data archive for use by other scholars that includes de-identified versions of all transcriptions. Additionally, the project intends to work with the trade press on behavioral approaches to information security. This project has the potential to enhance the effectiveness of information security practices in critical infrastructure organizations such as hospitals and utilities. Because the cost of information security continues to rise in many industries, it also has potential economic benefits in many sectors. Simultaneously, however, by attending to the concerns of workers, the results may help organizations to avoid infringing upon or diminishing individual workers' rights.