How Secure Are Your Emotions? Employee Emotions Can Have a Significant Impact on Organizational SecurityMarch 30, 2020
By Justin Walker
Information can be classified in a variety of ways. It can be personal, private and confidential or public, well-known and widely accessible. But one thing is for sure, information is power. So much so, former President Ronald Reagan once described it as “the oxygen of the modern age.”
In today’s information economy, keeping information secure is a primary goal of any organization, Assistant Professor of Information Systems A.J. Burns said. Whether private or public, companies need to make sure the employees using proprietary or sensitive organizational information are prepared for the job, in terms of both skill and emotion.
“A lot of strategic business interests are reliant upon people keeping information secure across a lot of different job roles,” Burns said. “We explore how your emotions—or the way you are experiencing emotions—influence the way you behave with organizational information.”
Burns, joined by Tom L. Roberts of the University of Texas at Tyler, Clay Posey of the University of Central Florida and Paul Benjamin Lowry of Virginia Tech University, looked at how employees deal with information security threats while experiencing a broad array of emotions. Their article, “The Adaptive Roles of Positive and Negative Emotions in Organizational Insiders’ Security-Based Precaution Taking,” was recently published in Information Systems Research.
While Burns and his colleagues are not the first to examine the link between emotion and security-related behaviors, most prior research explored only the influence of negative emotions—such as fear or anxiety—on organizational security. Very few have taken a broad view of emotions and looked at how both positive and negative emotions can influence organizational information security. This is important because, as they explain in their paper, different emotions elicit unique behavioral tendencies, also called specific action tendencies, that impact the ways we process information and ultimately our behavior.
Of course, human behavior is complex and emotions do not provide a simple answer to understanding behavior, Burns said. Specifically related to emotions, there are other contributing factors at hand, what he calls mediators. While emotions impact behavior, it is often in an indirect way. Thus, the team also looked at how emotions work through two intervening mechanisms—psychological capital and psychological distancing. Simply defined, psychological capital is a construct of work-related positive resource capabilities composed of hope, self-efficacy, resilience and optimism. It’s a construct that’s been developed from the positive psychology literature, Burns said.
Psychological distancing is a coping mechanism characterized by an employee’s attempts to detach themselves from a situation. Burns said there is a strong correlation between experiences of anxiety and detachment from the anxiety-inducing situation. When security threats create anxiety, this can be counterproductive to security, he said.
The results were a little surprising to Burns. Positive emotions related more significantly with precaution taking than negative emotions. The team had initially suspected that positive emotions would be important but given the extensive body of literature on negative emotions and security, they did not expect positive emotions would be more impactful than negative emotions on precaution taking.
“Negative emotions limit the way you think,” Burns said. “It limits your brain’s ability to process behavioral responses. Whereas positive emotions increase your ability to process external stimuli.”
But that doesn’t mean there is not a place for negative emotions in information security. If employees are afraid of threats, they may be more cautious. This line of thinking does have merit in some instances, he said.
This information can be very effective for organizations as they begin developing training for security, Burns said. Basing a security program solely around fear and anxiety may not be the most effective option.
“While that can have an impact, if I can spur that positive emotion instead, then ultimately, my firm can be more protected,” he said.