Journal of Management Information Systems

News

Absence of Self-Control Is a Predictor of Proneness to Information Security Violations

14 May 2015

A recent study published in the Journal of Management Information Systems (JMIS) and widely covered in the media shows that absence of self-control is a predictor of an employee becoming a security risk in organizations.

The paper published in the Spring 2015 issue of JMIS by Qing Hu, Robert West, and Laura Smarandescu of Iowa State University titled "The Role of Self-Control in Information Security Violations: Insights from A Cognitive Neuroscience Perspective" was covered in online news sites, blogs, and newspapers around the globe. The authors were interviewed by various news services about the implications of their research for organizations, highly concerned at present about their information security. The researchers used a brain imaging technology, electroencephalography (EEG), to examine the brain activation levels and regions of individuals in scenario-based laboratory experiments in which the subjects were considering information security violations.

The researchers found that self-control, a relatively stable behavioral characteristic in most adults, is a major factor that differentiates whether an individual may or may not violate established information security policies and procedures in organizations. Individuals with low self-control display lower levels of neural activities in brain regions known to perform cognitive control functions that govern rational behavior. They also use less time to make decisions related to information security violations. Thus, these individuals pose a greater threat to organizational information security. These findings question the effectiveness of security-education training commonly used in organizations, given the strong evidence of neurological roots of low self-control. The authors advocate assigning the right individuals to sensitive positions based on psychological screening, using tools such as self-control measurement to improve the overall level of information security in organizations.

A sample of news media report about this research: