Employees are expected to behave securely, and the definition of “securely” is often written down in a myriad of security policies. Yet, people do not always comply with security policies or make use of available tools. Gartner documents in their research that 69% of all employees intentionally bypass cybersecurity guidance, and 93% behave consciously and deliberately insecurely when they have to.
Is Non-Compliance a Question of Motivation?
The alleged answer to this challenge is often a lack of awareness or enforcement. Another observation, that people with a lesser sense of belonging to an organisation are more likely to be socially engineered, led a team of researchers from the University of Warwick to investigate more closely.
The motivation to comply with a security policy is often considered as a gentleman agreement between organisations and their employees. The other side of the agreement are perks and benefits. As long as employees feel that these agreements are upheld, (e.g., flexible working hours, bonuses, or the Christmas party) there is mutual respect and understanding. Both sides play by the written and unwritten rules of the employment relationship.
However, as the employment relationship continues, further expectations are established, such as the possibility to work from home on a Tuesday morning to make the school run. When expectations that have been established are not met, employees might become unhappy or even disgruntled–and that is the tricky part, as respecting unwritten and silent understandings is inherently challenging.
Psychological Context Breach Can Lead to Non-Compliance
Psychological Context Breach can lead to non-compliance through unmet expectations and disgruntlement. The researchers at the University of Warwick investigated the effect of Psychological Contract Breach (PCB) on the Intention to Comply with Information Security Policies (ICI). They considered intrinsic motivation (attitudes, self-efficacy, and perceived fairness) and extrinsic motivation (subjective norms, sanction severity, and sanction certainty).
The findings are intriguing. The higher the PCB the lower the ICI. PCB has a negative effect on attitude and perceived fairness (intrinsic motivation) but does not affect sanction severity and sanction certainty (extrinsic motivation). People with high PCB are much harder to coach or train, as they lack intrinsic motivation. PCB opens up Pandora’s box of social engineering as PCB fosters negative beliefs against the organisation.
Organisations with great leadership and a well-established security culture reduce PCB by striving to fulfil their employees psychological contracts and strive to improve attitudes towards ISP compliance. Here is a list of measures to help:
- Foster open communication and trust: Build trust in supervisors and clarify specific obligations related to job content, career development, organisational policies, leadership, social contacts, work-life balance, job security, and rewards.
- Empower through support and interaction: Encourage high social interaction, perceived organisational support, and trust.
- Adopt persuasive management: Utilise a persuasive management style rather than an assertive one.
- Address perceived unfairness: Identify the reasons why requirements for Information Security Policy (ISP) are perceived as unfair.
- Cultivate a robust cybersecurity culture: Instill a cybersecurity culture to mitigate behaviours stemming from high PCB.
- Invest in cultural transformation: Commit to investments that facilitate cultural transformation6.
Building a Positive Security Culture is Key
Secure behaviour is enabled through easy-to-use tools, policy frameworks defining the guard rails of desirable behaviour, and intrinsic motivation to contribute to the security of an organisation. In other words, good security programs are holistic programs that bring together people, process, and technology to secure an organisation.
Advocating for the importance of human risk management to foster a security culture in the organisation cannot be understated. Security culture is the intangible outcome of a healthy cybersecurity mindset that helps to protect an organisation–the thing everyone is doing when they believe no one is looking. A good culture means employees are self-motivated, engage with cybersecurity and consider security also their responsibility. Organisations with a healthy security culture are less likely to fall victim to phishing attacks because users are more likely to behave securely. Good culture fosters secure behaviour.
