Why Deterrence is not Enough: The Role of Endogenous Motivations on Employees' Information Security Behavior

Information systems security (ISS) is an increasingly critical issue for companies worldwide. In 2013 cybercrime has caused losses worth US $113 billion affecting 378m victims (Norton Symantec Cybercrime Report 2013). Besides criminal attacks and system malfunctions, human error is the major reason for information security incidents. Hence, refining our understanding how employees’ behavior regarding information security can be explained and...