关键词: 信息系统, 信息安全, 委托人——代理人理论, 激励机制, 信息安全遵从行为, 惩罚

Abstract: The influence of the certainty and severity of penalty on the information security compliance behaviors of employees has been an issue of debate in the previous studies. In the present work, the compliance effort level on the information security policy is viewed to be a consequence of the dynamical game between the organization and its employee individual. An information security compliance game model is proposed, and then combined with the principal-agent theory to explore the influence of penalty on the information security compliance behavior of the employee. The incentive mechanisms of the certainty and the appropriateness of penalty on the compliance behavior are first considered, and then are further analyzed by using numerical simulation. Several significant results are obtained: (1)The organization (the principal) can design an optimal incentive contract which includes appropriate penalty for motivating the employee (an agent) to comply with the information security policy; (2)The certainty and the appropriateness of penalty are effective in motivating employee’s compliance; (3)The appropriateness of penalty can be determined in terms of the risk aversion of the employee, the compensation, the external benefit and the probability of the negative outcome of non-compliance. These theoretical insights are expected to provide useful reference for managers to understand and manage the information security compliance behaviors of employees in the organizational setting.

Key words: information system, information security, principal-agent theory, incentive mechanism, information security compliance behavior, penalty