The Influence of Ethical Beliefs and Attitudes,Norms,and Prior Outcomes on Cybersecurity Investment Decisions

Abstract

Recent data breaches underscore the importance of organizational cybersecurity. However, the high costs of such security can force chief financial officers (CFOs) to make difficult financial and ethical trade-offs that have both business and societal implications. We employ a 2 × 2 randomized experiment that varies both an observed scenario CFO’s investment decision (invest/not invest in security) and organizational outcomes (positive/negative) to investigate these trade-offs. Participant managers assess the observed CFO’s investment behavior and indicate their own intentions to invest. Results indicate that when the observed scenario CFO invests in security, managers primarily follow their peers when making investment decisions. However, when the observed CFO does not invest in security, managers make their own decisions by engaging in more in-depth reasoning that includes assessment of the seriousness of consequences, as well as the ethical and societal considerations. Moderated mediation findings further deconstruct and corroborate these relationships.

Keywords

ethical reasoning hacking risk information system security

Get full access to this article

View all access options for this article.

References

Ajzen

(1991). The theory of planned behavior. Organizational Behavior and Human Decision Processes, 50, 179–211.

Ajzen

Fishbein

(1980). Understanding attitudes and predicting social behavior. Prentice Hall.

Akers

R. L.

Jennings

W. G.

(2016). Social learning theory. In Piquero

A. R.

(ed.), The handbook of criminological theory (Vol. 4, pp. 230–240). John Wiley & Sons.

Albaum

Peterson

R. A.

(2006). Ethical attitudes of future business leaders. Business & Society, 45, 300–321.

Aleassa

Pearson

J. M.

McClurg

(2011). Investigating software piracy in Jordan: An extension of the theory of reasoned action. Journal of Business Ethics, 98, 663–676.

Alexander

C. A.

Becker

H. J.

(1978). The use of vignettes in survey research. Public Opinion Quarterly, 42, 93–104.

Andriotis

A. M.

Ensign

R. L.

(2019, August). Capital one cyber staff raised concerns before hack. The Wall Street Journal. http://www.wsj.com

Armerding

(2018). The 18 biggest data breaches of the 21st century. CSO. Retrieved March, 2020, from https://www.csoonline.com/article/2130877/data-breach/the-biggest-data-breaches-of-the-21st-century.html

Bana

Brynjolfsson

Jin

Steffen

Wang

(2021). Cybersecurity hiring in response to data breaches [Working paper]. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3806060

10.

Bandura

(1969). Social-learning theory of identificatory processes. In Goslin

D. A.

(ed.), Handbook of socialization theory and research (pp. 213–262). Rand McNally & Company.

11.

Barnett

(2001). Dimensions of moral intensity and ethical decision making: An empirical study. Journal of Applied Social Psychology, 31, 1038–1057.

12.

Barnett

Bass

Brown

(1996). Religiosity, ethical ideology and intentions to report a peer’s wrongdoing. Journal of Business Ethics, 15(11), 1161–1174.

13.

Baumgartner

K. T.

Ernst

C. A.

Fischer

T. M.

(2022). How corporate reputation disclosers affect stakeholders’ behavioral intentions: Mediating mechanisms of perceived organizational performance and corporate reputation. Journal of Business Ethics, 175, 1–29. https://doi.org/10.1007/s10551-020-04642-x

14.

Baur

Soucek

Kühnen

Baumeister

R. F.

(2020). Unable to resist the temptation to tell the truth or to lie for the organization: Identification makes the difference. Journal of Business Ethics, 167, 643–662.

15.

Blau

(2017, June 7). The behavioral economics of why executives underinvest in cybersecurity. Harvard Business Review. https://hbr.org/2017/06/the-behavioral-economics-of-why-executives-underinvest-in-cybersecurity

16.

Bloomfield

Nelson

M. W.

Soltes

(2016). Gathering data for archival, field, survey, and experimental accounting research. Journal of Accounting Research, 54, 341–395.

17.

Bose

Leung

(2013). The impact of adoption of identity theft countermeasures on firm value. Decision Support Systems, 55, 753–763.

18.

Breitinger

Bonardi

(2019). Firms, breach of norms, and reputation damage. Business & Society, 58, 1143–1176.

19.

Buchheit

Dalton

D. W.

Pollard

T. J.

Stinson

S. R.

(2019). Crowdsourcing intelligent research participants: A student versus MTurk comparison. Behavioral Research in Accounting, 31(2), 93–106.

20.

Burton

B. K.

Hegarty

W. H.

(1999). Some determinants of student corporate social responsibility orientation. Business & Society, 38, 188–205.

21.

Cavusoglu

Mishra

Raghunathan

S. A.

(2004). Framework for evaluating IT security investments. Communications of the ACM, 47(7), 87–92.

22.

Chai

Kim

Rao

H. R.

(2011). Firms’ information security investment decisions: Stock market evidence of investors’ behavior. Decision Support Systems, 50, 651–661.

23.

Chang

M. K.

(1998). Predicting unethical behavior: A comparison of the theory of reasoned action and the theory of planned behavior. Journal of Business Ethics, 17, 1825–1834.

24.

Cheng

Walton

(2019). Do nonprofessional investors care about how and when data breaches are disclosed? Journal of Information Systems, 33(3), 163–182.

25.

Christensen

S. L.

Kohls

(2003). Ethical decision making in times of organizational crisis. Business & Society, 42, 328–358.

26.

Cohen

Holder-Webb

Sharp

Pant

(2007). The effects of perceived fairness on opportunistic behavior. Contemporary Accounting Research, 24, 1119–1138.

27.

Cooper

L. A.

Weber

(2021). Does benefit corporation status matter to investors? An exploratory study of investor perceptions and decisions. Business & Society, 60, 979–1008.

28.

Culnan

M. J.

Williams

C. C.

(2009). How ethics can enhance organizational privacy: Lessons from the ChoicePoint and TJX data breeches. MIS Quarterly, 33, 673–687.

29.

Curtis

Williams

I. M.

(2014). The impact of culture and training on code of conduct effectiveness reporting of observed unethical behavior. Research on Professional Responsibility and Ethics in Accounting, 18, 1–31.

30.

Dagar

Pandey

Navare

(2022). How yoga-based practices build altruistic behavior? Examining the role of subjective vitality, self-transcendence, and psychological capital. Journal of Business Ethics, 175, 1–16.

31.

Dennis

B. S.

Buchholtz

A. K.

Butts

M. M.

(2009). The nature of giving: A theory of planned behavior examination of corporate philanthropy. Business & Society, 48, 360–384.

32.

Fielder

Panaousis

Malacaria

Hankin

Smeraldi

(2016). Decision support approaches for cyber security investment. Decision Support Systems, 86, 13–23.

33.

Fishbein

Ajzen

(1975). Belief, attitude, intention, and behavior. Addison-Wesley.

34.

Fishbein

Ajzen

(2010). Predicting and changing behavior. Psychology Press.

35.

Fleischman

G. M.

Valentine

S. R.

(2019). How outcome information affects ethical attitudes and intentions to behave. Behavioral Research in Accounting, 31(2), 1–15.

36.

Fleischman

G. M.

Valentine

S. R.

Finn

D. W.

(2007). Ethical reasoning and equitable relief. Behavioral Research in Accounting, 19, 107–132.

37.

Fornell

Larcker

D. F.

(1981). Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, 18, 39–50.

38.

Goode

Hoehle

Venkatesh

Brown

S. A.

(2017). User compensation as a data breach recovery action: An investigation of the Sony PlayStation Network breach. MIS Quarterly, 41, 703–727.

39.

Gordon

L. A.

Loeb

M. P.

(2002). The economics of information security investment. ACM Transactions on Information and System Security, 5, 438–457.

40.

Gordon

L. A.

Loeb

M. P.

Lucyshyn

Zhou

(2015). Increasing cybersecurity investments in private sector firms. Journal of Cybersecurity, 1, 3–17.

41.

Gordon

L. A.

Loeb

M. P.

Lucyshyn

Zhou

(2018). Empirical evidence on the determinants of cybersecurity investments in private sector firms. Journal of Information Security, 9, 133–153.

42.

Gordon

L. A.

Loeb

M. P.

Zhou

(2011). The impact of information security breaches: Has there been a downward shift in costs? Journal of Computer Security, 19, 33–56.

43.

Haislip

J. Z.

Masli

Richardson

V. J.

Sanchez

J. M.

(2015). Repairing organizational legitimacy following information technology (IT) material weaknesses: Executive turnover, IT expertise, and IT system upgrades. Journal of Information Systems, 30, 41–70.

44.

Hayes

A. F.

(2018). Introduction to mediation, moderation, and conditional process analysis: A regression-based approach. The Guilford Press.

45.

Higgs

J. L.

Pinsker

R. E.

Smith

T. J.

Young

(2016). The relationship between board-level technology committees and reported security breaches. Journal of Information Systems, 30(3), 79–98.

46.

Huang

C. D.

Behara

R. S.

Goo

(2014). Optimal information security investment in a healthcare information exchange: An economic analysis. Decision Support Systems, 61, 1–11.

47.

Huang

H. H.

Wang

(2021). Do banks price firms’ data breaches? The Accounting Review, 96(3), 261–286.

48.

Jeong

C. Y.

Lee

S. Y.

Lim

J. H.

(2019). Information security breaches and IT security investments: Impacts on competitors. Information & Management, 56, 681–695.

49.

Johnson

E. N.

Fleischman

G. M.

Valentine

S. R.

Walker

K. B.

(2012). Managers’ ethical evaluations of earnings management and its consequences. Contemporary Accounting Research, 29, 910–927.

50.

Johnson

M. E.

Goetz

(2007). Embedding information security into the organization. IEEE Security & Privacy, 3, 16–24.

51.

Jones

T. M.

(1991). Ethical decision-making by individuals in organizations: An issue-contingent model. Academy of Management Review, 16, 366–395.

52.

Kaplan

S. E.

Samuels

J. A.

Thorne

(2009). Ethical norms of CFO insider trading. Journal of Accounting and Public Policy, 28, 386–400.

53.

Kouchaki

(2015). Professionalism and moral behavior. Business & Society, 54, 376–385.

54.

Kwon

Johnson

M. E.

(2014). Proactive versus reactive security investments in the healthcare sector. MIS Quarterly, 38, 451–472.

55.

Liu

Chen

Bell

Tam

(2020). How do power and status differ in predicting unethical decisions? A cross-national comparison of China and Canada. Journal of Business Ethics, 167, 745–760.

56.

Loder

(2017, October 6). A warning shot on Equifax: Index provider flagged security issues last year. The Wall Street Journal. https://www.wsj.com/articles/a-warning-shot-on-equifax-index-provider-flagged-security-issues-last-year-1507292590

57.

Luftmann

Kempaiah

(2008). Key issues for IT executives 2007. MIS Quarterly Executive, 7(2), 99–112.

58.

MacKenzie

S. B.

Podsakoff

P. M.

(2012). Common method bias in marketing: Causes, mechanisms, and procedural remedies. Journal of Retailing, 88, 542–555.

59.

Matwyshyn

A. M.

(2009). CSR and the corporate cyborg: Ethical corporate information security practices. Journal of Business Ethics, 88, 579–594.

60.

May

D. R.

Pauli

K. P.

(2002). The role of moral intensity in ethical decision making. Business & Society, 41, 84–117.

61.

Morgan

(2018). 2018 cybersecurity market report. https://cybersecurityventures.com/cybersecurity-market-report/

62.

Mubako

Bagchi

Udo

Marinovic

(2021). Personal values and ethical behavior in accounting students. Journal of Business Ethics, 174, 161–176. https://doi.org/10.1007/s10551-020-04606-1

63.

Orlitzky

Swanson

D. L.

Quartermaine

L. K.

(2006). Normative myopia, executives’ personality, and preference for pay dispersion. Business & Society, 45, 149–177.

64.

Patrizio

(2007, December). How TJX became a lesson in proper security. Internet News. https://www.internetnews.com/security/how-tjx-became-a-lesson-in-proper-security/

65.

Pirson

M. P.

Martin

Parmar

(2019). Public trust in business and its determinants. Business & Society, 58, 132–166.

66.

Podsakoff

P. M.

MacKenzie

S. B.

Lee

Podsakoff

N. P.

(2003). Common method biases in behavioral research: A critical review of the literature and recommended remedies. Journal of Applied Psychology, 88, 879–903.

67.

Podsakoff

P. M.

MacKenzie

S. B.

Podsakoff

N. P.

(2012). Sources of method bias in social science research and recommendations on how to control it. Annual Review of Psychology, 63, 539–569.

68.

Priem

R. L.

Shaffer

(2001). Resolving moral dilemmas in business: A multicultural study. Business & Society, 40, 197–219.

69.

Privacy & Data Security Update. (2019). Federal trade commission, January 2019–December 2019. https://www.ftc.gov/system/files/documents/reports/privacy-data-security-update-2019/2019-privacy-data-security-report-508.pdf

70.

Randall

D. M.

(1989). Taking stock: Can the theory of reasoned action explain unethical conduct? Journal of Business Ethics, 8, 873–882.

71.

Randall

D. M.

Fernandes

(1991). The social desirability response bias in ethics research. Journal of Business Ethics, 10, 805–817.

72.

Randall

D. M.

Gibson

A. M.

(1991). Ethical decision making in the medical profession: An application of the Theory of Planned behavior. Journal of Business Ethics, 10, 111–122.

73.

Reidenbach

R. E.

Robin

D. P.

(1990). Toward the development of a multidimensional scale for improving evaluations of business ethics. Journal of Business Ethics, 9, 639–653.

74.

Rest

J. R.

(1986). Moral development: Advances in research and theory. Praeger Publishers.

75.

Reynolds

S. J.

Dang

C. T.

(2017). Are the “customers” of business ethics courses satisfied? An examination of one source of business ethics education legitimacy. Business & Society, 56, 947–974.

76.

Richardson

Watson

W. M.

Smith

R. E.

(2019). Much ado about nothing: The (lack of) economic impact of data privacy breaches. Journal of Information Systems, 33(3), 227–265.

77.

Robin

D. P.

Reidenbach

R. E.

Forest

P. J.

(1996). The perceived importance of an ethical issue as an influence on the ethical decision-making of ad managers. Journal of Business Research, 35, 17–28.

78.

Safi

Browne

G. J.

Naini

A. J.

(2021). Mis-spending on information security measures: Theory and experimental evidence. International Journal of Information Management, 57, Article 10229.

79.

Smith

H. J.

(1993). Privacy policies and practices: Inside the organizational maze. Communications of the ACM, 36(12), 105–122.

80.

Spanos

Angelis

(2016). The impact of information security events to the stock market: A systematic literature review. Computers & Security, 58, 216–229.

81.

Spekle

R. F.

Widener

S. K.

(2018). Challenging issues in survey research: Discussion and suggestions. Journal of Management Accounting Research, 30(2), 3–21.

82.

Tourangeau

Rips

L. J.

Rasinski

(2000). The psychology of survey response. Cambridge University Press.

83.

Trochim

W. M.

Donnelly

J. P.

Arora

(2016). Research methods: The essential knowledge base. Cengage Learning.

84.

Trudel

Klein

Sen

Dawar

(2020). Feeling good by doing good: A selfish motivation for ethical choice. Journal of Business Ethics, 166, 39–49.

85.

Vallerand

R. J.

Deshaies

Cuerrier

J.-P.

Pelletier

L. G.

Mongeau

(1992). Ajzen and Fishbein’s theory of reasoned action as applied to moral behavior: A confirmation analysis. Journal of Personality and Social Psychology, 62, 98–109.

86.

Vedadi

Warkentin

Dennis

(2021). Herd behavior in information security decision-making. Information & Management, 58, Article 103526.

87.

Voegtlin

Frisch

Walther

Schwab

(2020). Theoretical development and empirical examination of a three-roles model of responsible leadership. Journal of Business Ethics, 167, 411–431.

88.

Walton

Wheeler

Zhang

Zhao

(2021). An integrative review and analysis of cybersecurity research: Current state and future directions. Journal of Information Systems, 35, 155–186.

89.

Wang

Kannan

K. N.

Ulmer

J. R.

(2013). The association between the disclosure and the realization of information security risk factors. Information Systems Research, 24, 201–218.

90.

Wood

C. C.

Parker

D. B.

(2004). Why ROI and similar financial tools are not advisable for evaluating the merits of security projects. Computer Fraud & Security, 2004(5), 8–10.

91.

(2010). The impact of corporate supplier diversity programs on corporate purchasers’ intention to purchase from women-owned enterprises. Business & Society, 49, 359–380.

92.

Grant

Nguyen

Dai

(2008). Security breach: The case of TJX Companies, Inc. Communications of the Association for Information Systems, 23, 576–590.