User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach

Key finding

User awareness of security policies, SETA programs and computer monitoring each deterred intentions to misuse IS, working through perceived sanctions. Perceived severity of sanctions mattered more than certainty, and the effect varied with individuals' morality.

Why it matters

Evidence that sanction-based deterrence can reduce intentional misuse, a counterpoint to purely non-punitive approaches (though it concerns deliberate misuse, not phishing susceptibility).

Informs

• Does not shame, punish, or publicly name people who click challenges

Cite

D'Arcy, J., Hovav, A., & Galletta, D. (2009). User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach. Information Systems Research, 20(1). https://doi.org/10.1287/isre.1070.0160