Neutralisoimistekniikat organisaation tietoturvakontekstissa

Työntekijöiden tietoturvapolitiikan mukaisten ohjeiden noudattamattomuus muodostaa organisaation toiminnalle merkittävän tietoturvauhkan. Arviolta puolet tietoturvarikkomuksista tai –loukkauksista tapahtuu työntekijöiden toi-mesta joko tahallisesti tai tahattomasti. Tutkimalla, miten työntekijät sel...

Full description

Bibliographic Details
Main Author: Vestman, Tiina
Other Authors: Faculty of Information Technology, Informaatioteknologian tiedekunta, Tietojenkäsittelytieteiden laitos, University of Jyväskylä, Jyväskylän yliopisto
Format: Master's thesis
Language:fin
Published: 2017
Subjects:
Online Access: https://jyx.jyu.fi/handle/123456789/54130
_version_ 1828193098236166144
author Vestman, Tiina
author2 Faculty of Information Technology Informaatioteknologian tiedekunta Tietojenkäsittelytieteiden laitos University of Jyväskylä Jyväskylän yliopisto
author_facet Vestman, Tiina Faculty of Information Technology Informaatioteknologian tiedekunta Tietojenkäsittelytieteiden laitos University of Jyväskylä Jyväskylän yliopisto Vestman, Tiina Faculty of Information Technology Informaatioteknologian tiedekunta Tietojenkäsittelytieteiden laitos University of Jyväskylä Jyväskylän yliopisto
author_sort Vestman, Tiina
datasource_str_mv jyx
description Työntekijöiden tietoturvapolitiikan mukaisten ohjeiden noudattamattomuus muodostaa organisaation toiminnalle merkittävän tietoturvauhkan. Arviolta puolet tietoturvarikkomuksista tai –loukkauksista tapahtuu työntekijöiden toi-mesta joko tahallisesti tai tahattomasti. Tutkimalla, miten työntekijät selittävät tietoturvarikkomuksiaan, voidaan tietoturvaohjeiden noudattamattomuuteen löytää selittäviä tai ennustavia syitä. Aikaisemmissa tutkimuksissa on esitetty, että tietoturvarikkomusten aikomuksia tai tietoturvarikkomuksia voidaan selit-tää neutralisoimisteorian avulla. Neutralisoimisteorian mukaan yksilö puolus-telee tai selittelee normeista poikkeavaa käyttäytymistä erilaisten neutralisoi-mistekniikoiden avulla. Tämä tutkimus käsittelee työntekijöiden kokemuksia ja näkemyksiä tietoturvarikkomusten syistä. Näiden kokemusten ja näkemysten avulla verrattiin sitä, pitävätkö neutralisoimisteorian olettamukset paikkansa tietoturvakontekstissa sekä lisäksi verrattiin sitä, oikeuttavatko työntekijät tie-toturvarikkomuksiaan oikeasti neutralisoimistekniikoiden avulla. Tutkimus to-teutettiin laadullisena tutkimuksena ja tutkimuksen empiirinen aineisto kerät-tiin teemahaastatteluilla. Tutkimuksen merkittävin löydös on se, etteivät neut-ralisoimisteorian keskeiset olettamukset välttämättä pädekään tietoturvallisuu-den alueella. Vaikka sosiaalinen järjestys ikään kuin edellyttää jonkinlaista seli-tystä sille, miksi joku toimii sopimattomasti tai väärin, neutralisoimistekniikat eivät välttämättä selitä tietoturvarikkomuksia. Tutkimuksen tuloksia voidaan hyödyntää tietoturvatoiminnan kehittämisessä ja tietoturvatietoisuuden paran-tamisessa. Lisäksi tutkimus tarjoaa tiedeyhteisölle sekä uutta tietoa että lukuisia jatkotutkimusaiheita. Employees’ non-compliance with information security policies constitutes a significant information security threat to the organization's operations. It is es-timated that half of the information security violations or breaches are caused by employees, either intentionally or unintentionally. By researching how em-ployees explain their security violations, explanatory or predictive reasons of non-compliance with information security policies can be revealed. Previous studies have suggested that intentions of information security violations or in-formation security breaches can be explained by the Neutralization Theory. According to the Neutralization Theory, an individual defends or explains one's behavior that differs from norms or originates from rule-breaking through applying various neutralization techniques. This study discusses employees' experiences and views on the causes of information security violations. With gathered experiences and views of the employees it was made possible to compare if the assumptions of the neutralization theory were correct in the context of the information security and whether the employees justify their information security violations in real life by utilizing neutralization techniques. The study used qualitative research approach. The empirical data of the research was collected through theme interviews. The most notable finding of this study is that the central assumptions of the neutralization theory may not apply to the information security field. Although social order requires some sort of reasoning for why someone is acting improperly or incorrectly, the neutralization techniques may not explain the security violations. The results of this study can be utilized in the development of information security and in enhancing information security awareness. In addition, this study will provide new information to the scientific community and variety of further research topics.
first_indexed 2023-03-22T09:58:26Z
format Pro gradu
free_online_boolean 1
fullrecord [{"key": "dc.contributor.advisor", "value": "Siponen, Mikko", "language": "", "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Vestman, Tiina", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2017-05-28T10:17:39Z", "language": "", "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2017-05-28T10:17:39Z", "language": "", "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2017", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.other", "value": "oai:jykdok.linneanet.fi:1702270", "language": null, "element": "identifier", "qualifier": "other", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/54130", "language": "", "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Ty\u00f6ntekij\u00f6iden tietoturvapolitiikan mukaisten ohjeiden noudattamattomuus muodostaa organisaation toiminnalle merkitt\u00e4v\u00e4n tietoturvauhkan. Arviolta puolet tietoturvarikkomuksista tai \u2013loukkauksista tapahtuu ty\u00f6ntekij\u00f6iden toi-mesta joko tahallisesti tai tahattomasti. Tutkimalla, miten ty\u00f6ntekij\u00e4t selitt\u00e4v\u00e4t tietoturvarikkomuksiaan, voidaan tietoturvaohjeiden noudattamattomuuteen l\u00f6yt\u00e4\u00e4 selitt\u00e4vi\u00e4 tai ennustavia syit\u00e4. Aikaisemmissa tutkimuksissa on esitetty, ett\u00e4 tietoturvarikkomusten aikomuksia tai tietoturvarikkomuksia voidaan selit-t\u00e4\u00e4 neutralisoimisteorian avulla. Neutralisoimisteorian mukaan yksil\u00f6 puolus-telee tai selittelee normeista poikkeavaa k\u00e4ytt\u00e4ytymist\u00e4 erilaisten neutralisoi-mistekniikoiden avulla. T\u00e4m\u00e4 tutkimus k\u00e4sittelee ty\u00f6ntekij\u00f6iden kokemuksia ja n\u00e4kemyksi\u00e4 tietoturvarikkomusten syist\u00e4. N\u00e4iden kokemusten ja n\u00e4kemysten avulla verrattiin sit\u00e4, pit\u00e4v\u00e4tk\u00f6 neutralisoimisteorian olettamukset paikkansa tietoturvakontekstissa sek\u00e4 lis\u00e4ksi verrattiin sit\u00e4, oikeuttavatko ty\u00f6ntekij\u00e4t tie-toturvarikkomuksiaan oikeasti neutralisoimistekniikoiden avulla. Tutkimus to-teutettiin laadullisena tutkimuksena ja tutkimuksen empiirinen aineisto ker\u00e4t-tiin teemahaastatteluilla. Tutkimuksen merkitt\u00e4vin l\u00f6yd\u00f6s on se, etteiv\u00e4t neut-ralisoimisteorian keskeiset olettamukset v\u00e4ltt\u00e4m\u00e4tt\u00e4 p\u00e4dek\u00e4\u00e4n tietoturvallisuu-den alueella. Vaikka sosiaalinen j\u00e4rjestys ik\u00e4\u00e4n kuin edellytt\u00e4\u00e4 jonkinlaista seli-tyst\u00e4 sille, miksi joku toimii sopimattomasti tai v\u00e4\u00e4rin, neutralisoimistekniikat eiv\u00e4t v\u00e4ltt\u00e4m\u00e4tt\u00e4 selit\u00e4 tietoturvarikkomuksia. Tutkimuksen tuloksia voidaan hy\u00f6dynt\u00e4\u00e4 tietoturvatoiminnan kehitt\u00e4misess\u00e4 ja tietoturvatietoisuuden paran-tamisessa. Lis\u00e4ksi tutkimus tarjoaa tiedeyhteis\u00f6lle sek\u00e4 uutta tietoa ett\u00e4 lukuisia jatkotutkimusaiheita.", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Employees\u2019 non-compliance with information security policies constitutes a significant information security threat to the organization's operations. It is es-timated that half of the information security violations or breaches are caused by employees, either intentionally or unintentionally. By researching how em-ployees explain their security violations, explanatory or predictive reasons of non-compliance with information security policies can be revealed. Previous studies have suggested that intentions of information security violations or in-formation security breaches can be explained by the Neutralization Theory. According to the Neutralization Theory, an individual defends or explains one's behavior that differs from norms or originates from rule-breaking through applying various neutralization techniques. This study discusses employees' experiences and views on the causes of information security violations. With gathered experiences and views of the employees it was made possible to compare if the assumptions of the neutralization theory were correct in the context of the information security and whether the employees justify their information security violations in real life by utilizing neutralization techniques. The study used qualitative research approach. The empirical data of the research was collected through theme interviews. The most notable finding of this study is that the central assumptions of the neutralization theory may not apply to the information security field. Although social order requires some sort of reasoning for why someone is acting improperly or incorrectly, the neutralization techniques may not explain the security violations. The results of this study can be utilized in the development of information security and in enhancing information security awareness. In addition, this study will provide new information to the scientific community and variety of further research topics.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted using Plone Publishing form by Tiina Vestman (timairve) on 2017-05-28 10:17:39.297219. Form: Pro gradu -lomake (https://kirjasto.jyu.fi/julkaisut/julkaisulomakkeet/pro-gradu-lomake). JyX data: [jyx_publishing-allowed (fi) =True]", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija.group@korppi.jyu.fi) on 2017-05-28T10:17:39Z\r\nNo. of bitstreams: 2\r\nURN:NBN:fi:jyu-201705282525.pdf: 797499 bytes, checksum: 94af227f9cbc34829faf3350b3324959 (MD5)\r\nlicense.html: 4816 bytes, checksum: 5da7c06b0c0e8e0a85cd0373c48df3b7 (MD5)", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2017-05-28T10:17:39Z (GMT). No. of bitstreams: 2\r\nURN:NBN:fi:jyu-201705282525.pdf: 797499 bytes, checksum: 94af227f9cbc34829faf3350b3324959 (MD5)\r\nlicense.html: 4816 bytes, checksum: 5da7c06b0c0e8e0a85cd0373c48df3b7 (MD5)\r\n Previous issue date: 2017", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "1 verkkoaineisto (78 sivua)", "language": null, "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "fin", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "In Copyright", "language": "en", "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.subject.other", "value": "neutralisoimisteoria", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.title", "value": "Neutralisoimistekniikat organisaation tietoturvakontekstissa", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-201705282525", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Master\u2019s thesis", "language": "en", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Pro gradu -tutkielma", "language": "fi", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Tietojenk\u00e4sittelytieteiden laitos", "language": "fi", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Cyber Security", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Kyberturvallisuus", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.date.updated", "value": "2017-05-28T10:17:40Z", "language": "", "element": "date", "qualifier": "updated", "schema": "dc"}, {"key": "yvv.contractresearch.funding", "value": "0", "language": "", "element": "contractresearch", "qualifier": "funding", "schema": "yvv"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": "fi", "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.subject.oppiainekoodi", "value": "601", "language": null, "element": "subject", "qualifier": "oppiainekoodi", "schema": "dc"}, {"key": "dc.subject.yso", "value": "tietoturva", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "tietoturvapolitiikka", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "sosiaaliset normit", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://rightsstatements.org/page/InC/1.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}, {"key": "dc.type.okm", "value": "G2", "language": null, "element": "type", "qualifier": "okm", "schema": "dc"}]
id jyx.123456789_54130
language fin
last_indexed 2025-03-31T20:01:38Z
main_date 2017-01-01T00:00:00Z
main_date_str 2017
online_boolean 1
online_urls_str_mv {"url":"https:\/\/jyx.jyu.fi\/bitstreams\/e4f43b2c-5dd4-4aa9-9972-c80e010542c3\/download","text":"URN:NBN:fi:jyu-201705282525.pdf","source":"jyx","mediaType":"application\/pdf"}
publishDate 2017
record_format qdc
source_str_mv jyx
spellingShingle Vestman, Tiina Neutralisoimistekniikat organisaation tietoturvakontekstissa neutralisoimisteoria Cyber Security Kyberturvallisuus 601 tietoturva tietoturvapolitiikka sosiaaliset normit
title Neutralisoimistekniikat organisaation tietoturvakontekstissa
title_full Neutralisoimistekniikat organisaation tietoturvakontekstissa
title_fullStr Neutralisoimistekniikat organisaation tietoturvakontekstissa Neutralisoimistekniikat organisaation tietoturvakontekstissa
title_full_unstemmed Neutralisoimistekniikat organisaation tietoturvakontekstissa Neutralisoimistekniikat organisaation tietoturvakontekstissa
title_short Neutralisoimistekniikat organisaation tietoturvakontekstissa
title_sort neutralisoimistekniikat organisaation tietoturvakontekstissa
title_txtP Neutralisoimistekniikat organisaation tietoturvakontekstissa
topic neutralisoimisteoria Cyber Security Kyberturvallisuus 601 tietoturva tietoturvapolitiikka sosiaaliset normit
topic_facet 601 Cyber Security Kyberturvallisuus neutralisoimisteoria sosiaaliset normit tietoturva tietoturvapolitiikka
url https://jyx.jyu.fi/handle/123456789/54130 http://www.urn.fi/URN:NBN:fi:jyu-201705282525
work_keys_str_mv AT vestmantiina neutralisoimistekniikatorganisaationtietoturvakontekstissa