Virtue Ethics
Total Page:16
File Type:pdf, Size:1020Kb
Nova Southeastern University NSUWorks CEC Theses and Dissertations College of Engineering and Computing 2015 Virtue Ethics: Examining Influences on the Ethical Commitment of Information System Workers in Trusted Positions John Max Gray Nova Southeastern University, [email protected] This document is a product of extensive research conducted at the Nova Southeastern University College of Engineering and Computing. For more information on research and degree programs at the NSU College of Engineering and Computing, please click here. Follow this and additional works at: https://nsuworks.nova.edu/gscis_etd Part of the Business Law, Public Responsibility, and Ethics Commons, Databases and Information Systems Commons, Ethics and Political Philosophy Commons, and the Information Security Commons Share Feedback About This Item NSUWorks Citation John Max Gray. 2015. Virtue Ethics: Examining Influences on the Ethical Commitment of Information System Workers in Trusted Positions. Doctoral dissertation. Nova Southeastern University. Retrieved from NSUWorks, College of Engineering and Computing. (364) https://nsuworks.nova.edu/gscis_etd/364. This Dissertation is brought to you by the College of Engineering and Computing at NSUWorks. It has been accepted for inclusion in CEC Theses and Dissertations by an authorized administrator of NSUWorks. For more information, please contact [email protected]. Virtue Ethics: Examining Influences on the Ethical Commitment of Information System Workers in Trusted Positions by John Gray A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Information Systems College of Engineering and Computing Nova Southeastern University 2015 An Abstract of a Dissertation Submitted to Nova Southeastern University in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy Virtue Ethics: Examining Influences on the Ethical Commitment of Information System Workers in Trusted Positions by John Gray October 2015 Despite an abundance of research on the problem of insider threats, only limited success has been achieved in preventing trusted insiders from committing security violations. Virtue ethics may be an approach that can be utilized to address this issue. Human factors such as moral considerations impact Information System (IS) design, use, and security; consequently they affect the security posture and culture of an organization. Virtue ethics based concepts have the potential to influence and align the moral values and behavior of information systems workers with those of an organization in order to provide increased protection of IS assets. An individual’s character strengths have been linked to positive personal development, but there has been very little research into how the positive characteristics of virtue ethics, exhibited through the character development of information systems workers, can contribute to improving system security. This research aimed to address this gap by examining factors that affect and shape the ethical perspectives of individuals entrusted with privileged access to information. This study builds upon prior research and theoretical frameworks on institutionalizing ethics into organizations and Information Ethics to propose a new theoretical model which demonstrates the influences on Information Systems Security (ISS) trusted worker ethical behavior within an organization. Components of the research model include ISS virtue ethics based constructs, organizational based internal influences, societal based external influences, and trusted worker ethical behavior. This study used data collected from 395 professionals in an ISS organization to empirically assess the model. Partial Least Squares Structural Equation Modeling was employed to analyze the indicators, constructs, and path relationships. Various statistical tests determined validity and reliability, with mixed but adequate results. All of the relationships between constructs were positive, although some were stronger and more significant. The expectation of the researcher in this study was to better understand the character of individuals who pose an insider threat by validating the proposed model, thereby providing a conceptual analysis of the character traits which influence the ethical behavior of trusted workers and ultimately information system security. Acknowledgements First and foremost I would like to thank Dr. Gurvirender Tejay for guiding my interest in ethics into a specific area that has applicability to information system security and refocusing me when my ideas took me out into left field. His mentorship, advice, uncompromising standards, and commitment to quality and relevance contributed immeasurability to this work. Thanks to my committee members, Dr. Cohen and Dr. Terrell. The quality of this dissertation is a direct reflection of their timely and valuable feedback. To all of the DISS students termed as “Tejay’s disciples” who participated in countless meetings at the Flight Deck and local area restaurants discussing information system security issues and research ideas late into many an evening. Dr. Tejay’s facilitation and guidance of those discussions eventually provided that “a-ha” moment which crystalized not only my own research idea, but that of many other of his students, ultimately leading to their dissertation topic. In some ways these after-hours brain storming sessions contributed more to completing this work than any of the in-class activities. Thanks to the Masonic fraternity and specifically my brothers in William H. Upton Naval and Military Lodge #206 for teaching me, albeit unknowingly, the concepts and power of virtue ethics. The lessons taught me through the various allegories of the fraternity improved me immeasurably. Halfway into this research I realized that the gentle lessons of the craft had a significant impact on this work and, as it should be - my life. I want to express my gratitude to my colleagues in the NUWC Keyport IA and Cyber-Security Branch who patiently endured my discussions of ethics and provided invaluable input and critique of my ideas. I would like to specifically thank the management team of the Advanced Skills Management (ASM) software project, whose work practices inspired me to consider how ethics affected information system security. Thanks to all the individuals who participated in my survey. I have a newfound respect for the effort involved in obtaining the required number of participants. To the makers of craft beer and cigars, my indulgence of which provided me the quiet time to contemplate many ideas which manifested themselves in this research. Thanks to my wife Bethany for patiently accepting that a portion of her life would be sacrificed in support of a goal of mine. I am forever grateful for your support. I promise – no more school! Also to my mother, Judith Sullivan of Spencer, IN, who inspired me to excel. Rest in peace Mom. Finally, thanks to God for giving me the inner strength to complete what at times seemed an insurmountable task. “Remember now thy creator in the days of thy youth…” "To educate a man in mind and not in morals is to educate a menace to society." - Theodore Roosevelt "Waste no more time arguing about what a good man should be. Be one." - Marcus Aurelius Table of Contents Abstract iii Acknowledgements iv Table of Contents v List of Tables vii List of Figures viii Chapters 1. Introduction 1 1.1 Background 1 1.2 Research Problem and Argument 5 1.3 Importance of Research Problem 7 1.4 Definition of Key Terms 9 1.5 Summary 14 2. Literature Review 15 2.1 Introduction 15 2.2 Organizational Ethics 16 2.3 Virtue Ethics 18 2.4 Ethics is Applicable to Information System Security 27 2.5 Virtue Ethics is Important to Information System Security 30 2.6 Technical Controls, Formal Procedures, and Policies are Ineffective 34 2.7 Information System Violations by Trusted Workers 40 2.8 Summary 43 3. Methodology 46 3.1 Introduction 46 3.2 Theoretical Basis 47 3.3 Research Model 51 3.4 Research Hypotheses 76 3.5 Research Method 79 3.5.1 Instrument Development 81 3.5.2 Phases of Research Study 87 3.5.3 Data Collection 95 3.5.4 Data Analysis 102 3.6 Miscellaneous 125 3.7 Summary 126 4. Results 128 4.1 Introduction 128 v 4.2 Data Analysis 128 4.2.1 Demographic Data 128 4.2.2 Measurement Model Data Analysis Results 130 4.2.3 Structural Model Data Analysis Results 149 4.3 Findings 157 4.4 Summary of Results 160 5. Conclusions, Implications, Recommendations, and Summary 162 5.1 Introduction 162 5.2 Conclusions 163 5.3 Implications 166 5.4 Limitations 168 5.5 Recommendations for Future Research 170 5.6 Summary 171 Appendices A. Acronyms 174 B. Research Model Variables and Indicators 175 C. Survey Instrument 178 D. IRB Approval from Nova Southeastern University 189 E. Survey Response Frequency and Percentage Information 190 F. Copyright Permissions 210 References 213 vi List of Tables Tables 1. ISS Trusted Worker Ethical Behavior Constructs 62 2. ISS Theoretical Construct and Definition Summary 66 3 TWEB Model Categories 68 4 ISS Construct Conceptual Domains 84 5. ISS Construct Conceptual Theme Attributes 85 6. Study Sample Size Determination 98 7. Measurement Model Analysis Procedures 119 8. Summary of Fit Index Significance Levels for Measurement Model 120 9. Summary of Fit Index Significance Levels for Structural Model 124 10. Research Study Assumptions 126 11. Survey Participant Demographic Data 129 12. TWEB Outer Model Goodness of Fit Results 131 13. Reflective Construct Goodness