Organisational vulnerability to intentional insider threat

Bedford, Justine (2018) Organisational vulnerability to intentional insider threat. [Thesis (PhD/Research)]

[img]
Preview
Text (Whole Thesis)
Justine Bedford Thesis U1058382.pdf

Download (20MB) | Preview

Abstract

In recent times there has been a spate of reporting on the counterproductive behaviour of individuals in both private and public organisations. As such, research into insider threat as a form of such behaviour is considered a timely contribution. The Australian Government now mandates that public sector organisations protect against insider threat through best practice recommendations and adopting a risk management approach. Whilst non-government organisations and private businesses are less accountable, these organisations can also benefit from the efficiencies, performance, resilience, and corporate value associated with an insider threat risk management approach.

Mitigating against Intentional Insider Threat (IIT) is an organisational priority which requires new ways of thinking about the problem, especially in terms of a multidisciplinary approach that holistically addresses the technical, individual, and organisational aspects of the problem. To date, there has been limited academic and practical contribution and a dearth of literature providing recommendations or practical tools as a means to mitigate IIT.

The purpose of this study is to develop a set of diagnostic inventories to assess for Organisational Vulnerability to Intentional Insider Threat (the OVIT). In order to achieve this overall purpose, the study sought to answer three research questions:

Research Question 1: What are the main organisational influences on Intentional Insider Threat (IIT) based on available literature?
Research Question 2: What are the main organisational influences on IIT based on expert opinion?
Research Question 3: How is organisational vulnerability to IIT operationalised by the study?

The methodology adopted by the study assumes a pragmatist paradigm and mixed methods design. There were three phases to this research:

- Phase One - a thorough review of the extant literature to determine the status of research and applied knowledge and identify factors and variables of IIT.
- Phase Two - conduct of a Delphi study to gather expert opinion on IIT and combine this professional knowledge with the literature review outcomes to enhance the factors and variables associated with IIT.
- Phase Three - operationalise IIT diagnostic instruments utilising multivariate statistical techniques to determine the validity of the inventories and develop a framework of organisational vulnerability to IIT.

Qualitative and quantitative analysis procedures were used throughout the research. The final survey data of phase three was analysed using multivariate statistics. The results from Exploratory Factor Analysis (EFA) demonstrate the underlying factors of each of the three dimensions (individual, technical, and organisational) which operationalise the construct of organisational vulnerability to IIT. The exploratory results indicate that diagnostic inventories of organisational vulnerability to IIT can validly and reliably measure each of the three dimensions. These were triangulated with the Delphi panel results and indicated alignment while further developing the IIT construct.

A reflection on additional contributions is an important aspect of pragmatic research. The literature available on insider threat highlights the emerging focus on the topic. Gaps in the literature indicate a number of limitations which were addressed in the current research beginning with the development of a conceptual framework illustrating the relationships of the construct, dimensions, and factors of organisational vulnerability to IIT. Whilst this work-based study had three very specific research questions to operationalise IIT, additional contributions from the research emerged as follows:

The research enhanced knowledge through: (1) study of IIT from an Australian perspective, utilising Australian expert opinion and Australian samples; (2) demonstration of the utility of the Delphi method in the study and further development of the insider threat construct; (3) an Australian definition of IIT; (4) integration of risk management standards with the available literature on insider threat; and, (5) contribution to the foresight and futures study of IIT.

While this research study has proved beneficial in addressing gaps in current literature, it is not without limitations. The generalisability of findings is hampered by the size and nature of an Australian sample and the study’s exploratory approach. The ability to generalise findings and assert causality is restricted in this research, and this can be overcome by undertaking future longitudinal research or other future studies based on the findings of this study.


Statistics for USQ ePrint 36500
Statistics for this ePrint Item
Item Type: Thesis (PhD/Research)
Item Status: Live Archive
Additional Information: Doctor of Professional Studies (DPRS).
Faculty/School / Institute/Centre: Historic - Faculty of Business, Education, Law and Arts - School of Linguistics, Adult and Specialist Education (1 Jul 2013 - 30 Jun 2019)
Faculty/School / Institute/Centre: Historic - Faculty of Business, Education, Law and Arts - School of Linguistics, Adult and Specialist Education (1 Jul 2013 - 30 Jun 2019)
Supervisors: van der Laan, Luke; Yap, Janson
Date Deposited: 24 May 2019 02:02
Last Modified: 03 Mar 2020 04:36
Uncontrolled Keywords: insider threat, insider risk, risk management, organisational vulnerability
Fields of Research (2008): 15 Commerce, Management, Tourism and Services > 1503 Business and Management > 150311 Organisational Behaviour
17 Psychology and Cognitive Sciences > 1701 Psychology > 170107 Industrial and Organisational Psychology
URI: http://eprints.usq.edu.au/id/eprint/36500

Actions (login required)

View Item Archive Repository Staff Only