Researchers at Washington State University recently examined and compared two approaches for motivating security compliance behaviors among remote workers.
Fear of what could go wrong is perhaps the greatest motivator when it comes to getting remote workers to protect their employer’s assets, according to their recent study.
Employees need to feel that it is a big deal if a breech happens. So, the number one thing employers can do is clearly communicate what the threats are and how serious they could be, according to the researchers. Typically, the employee’s job is to make something or sell something, not to make good security choices, even if it is critical for their organization.
Protection motivation theory posits that organizations can encourage secure behaviors among the remote workers through fear appeals, threat messages and promoting self-efficacy, or the ability to respond to a particular threat. Managers should ensure that applicable security guidelines, plans and policies flow down to their teams. Many employees do not work in security day to day, and some may have never worked remotely before. Companies should review plans to ensure that organizations are prepared for responding to a data breach or security incident.
The second approach WSU Associate Professor of Information Systems Robert E. Crossler and his collaborators examined was stewardship theory.
Stewardship theory is a form of reciprocal agreement that tries to motivate the employee’s behavior through a sense of moral responsibility that is not forced. In this approach, management attempts to get the employee to buy into the organization’s overall vision while giving them organizational support to act independently when confronted with a security threat.\
The three survey scenarios describe common policy violations that are relevant to remote work situations, such as:
- the use of unauthorized storage devices,
- logging off a sensitive account when it is not in use, and
- refraining from sharing one’s password with others.
As part of the study, each respondent randomly read one of three of the scenarios and then indicated their likelihood to act in a certain way based on various protection motivation and stewardship theory factors. Although working from home would seem to require relying on concepts more consistent with stewardship theory, the study showed that an approach that relied on the fear and threats emphasized in protection motivation theory was far more effective at preventing employees from violating security policy than a strictly stewardship-based approach.
One novel aspect of the study was that Crossler and his collaborators also considered a security approach that integrated factors of the two theories together.
Promoting a sense of collectivism, a concept from stewardship theory that emphasizes the mutual benefits of good behavior for both the employee and the employer, helped increased the efficacy of protection motivation theory-based methods.
“Basically, what we found was that the more workers felt that their organization’s resources were their own, the more likely they were to respond in the desired way,” he said. “Instilling a sense of collectivism in employees is only going to help enhance people’s likelihood of protecting security policies.”
According to the study, a protection motivation theory approach to IT security would back-fire and result in security misbehaviors. As a result of their analysis, the authors recommend that companies should consider removing or reducing surveillance practices that are a common aspect of protection motivation theory. Where such removal is impracticable, employers should consider providing employees with contextual reasons for performing such monitoring.
The recent study was one of the first studies that brought stewardship theory and protection motivation theory together in the context of IT security for people working from home. While stewardship theory did not work as well as protection motivation, the results suggested that managerial decisions informed by a stewardship perspective can help to provide a further understanding of security policy violations that motivates employees to make the right decision.