The scale of the compliance problem that the World Anti-Doping Agency (WADA) faces was recently highlighted by the exposure of state-sponsored doping in Russia and the series of doping scandals within athletics. This study aims to analyse the problems of achieving compliance with the World Anti-Doping Code. Specifically, the study explores the techniques for, and problems of, achieving compliance in three similar international agreements: the UN Convention on the Rights of the Child, the UN Convention on the Rights of Persons with Disabilities and the UN Convention Against Transnational Organised Crime. The Conventions were analysed to identify the range of strategies used to achieve (or at least enhance) the level of compliance with the international conventions, to evaluate their effectiveness as a way of generating ideas for improving compliance with the WADA Code and to assess the comparative success of the WADA. To evaluate compliance, three inter-related bodies of theory were used: regime theory, implementation theory and Mitchell and Chayes (1995) compliance system. Qualitative document analysis was used to analyse documents published by relevant organisations. Semi-structured interviews were also conducted with senior staff members responsible for monitoring compliance at the international and UK domestic level. The results identified a range of strategies used to achieve compliance, including a global annual index of compliance, independent monitoring institutions, whistleblowing and domestic lobbying. It is concluded that the identified strategies have had modest and variable success in improving compliance, yet have the potential to address the problems of achieving compliance with the WADA Code.

Internet usage has become a norm in most organizations where organizations have started monitoring employee, Internet usage, e-mail communications, social network usage and etc. With the increased Internet usage, Internet misuse by employees has increased the potential for security vulnerabilities for these organizations. Organizations have established various security countermeasures such as sanctions, incentives, and Internet usage policies in order to prevent Internet misuse and protect the organizational information assets. However, it is important for organizations to understand whether these Internet usage polices are effective in mitigating the threats towards Internet misuse. Therefore, this dissertation investigates the impact of different countermeasures such as sanctions, incentives and awareness of being monitored on Internet usage policy compliance. Furthermore, it investigates the impact of organizational stewardship culture consisting of collectivism and low power distance, on Internet usage policy compliance behavior. A research model was developed to test the influence of penalties (sanction severity, sanction certainty, sanction celerity), incentives, collectivism and power distance on Internet usage policy compliance intention. Furthermore, it investigates the impact of awareness of being monitored which has not received much attention from information security researchers. In order to test the hypothesized relationships in the research model, data was collected utilizing an online survey through an online survey panel provider, Amazon Mechanical Turk. The findings indicate that, sanction certainty, awareness of being monitored, collectivism and power distance have a significant influence on Internet usage policy compliance intention of the sample population. Additionally, when employees are aware that they are being monitored, it increases the effectiveness of sanction severity and celerity. This dissertation makes several contributions to research and practitioners. It contributes to research by investigating the impact of two contrasting theories where agency theory assumes that employees are motivated through extrinsic factors whereas stewardship theory assumes that they are motivated through intrinsic means (organizational stewardship culture). It contributes to practitioners as well by highlighting the importance of controls such as computer monitoring, swift punishments in protecting organizational assets. As the results suggest, apart from the controls, organizational stewardship culture can play an important role in mitigating some of these threats as well.

Incidents of computer abuse, proprietary information leaks and other security lapses have been on the increase. Most often, such security lapses are attributed to internal employees in organizations subverting established organizational IS security policy. As employee compliance with IS security policy is the key to escalating IS security breaches, understanding employee motivation for following IS security policy is critical. In addition to several types of extrinsic motives noted in prior studies, including sanctions, rewards, and social pressures, this study adds that an important contributing intrinsic factor is empowerment. Per Thomas and Velthouse’s (1990) intrinsic motivation model, empowerment is the positive feelings derived from IS security task assessments. Through survey data collected from 289 participants, the study assesses how dimensions of psychological empowerment (i.e., competence, meaning, impact, and choice) as derived from IS security task may impact the IS security performance of the participants, measured by their compliance with IS security policy. The study demonstrates that the competence and meaning dimensions of psychological empowerment have a positive impact on participants’ IS security policy compliance intention, while impact has a marginal negative influence on compliance. Furthermore, dimensions of psychological empowerment can be predicted by structural empowerment facets, particularly IS security education, training, and awareness (SETA), access to IS security strategy and goals, and participation in IS security decision-making. In addition, the competence and meaning dimensions of psychological empowerment may act as mediators for the relations between structural empowerment and participants’ IS security policy compliance. Theoretical contributions, managerial implications, and directions for future research of this study will be discussed.

Security breaches have attracted attention from corporations and scholars alike. The major organisations are determined to stop security breaches as they are detrimental to their success. Arguably the most common factor contributing to these breaches is employee behaviour, which suggests that changes in employee behaviour can have an impact on improving security. This research aims to study the critical factors (CFs) that impact on employee behaviours toward compliance with their organisation's information security policy. This investigation will focus on the various critical success factors based on their grouping into one of the following three major categories, namely: organisational factors, behavioural factors and training factors. Each of these categories affects a different aspect of information security and the objective is to not only understand the interaction of different factors but also to study further the aims in order to provide practical recommendations for improving organisational information security management. This study has utilised empirical research through the use of both qualitative and quantitative methodologies to inform each stage of the research. This study focused on the health, business and education sectors by empirically evaluating the obstacles and success factors that affect employee compliance to organisational security policies. In addition, this study also evaluated the affect of the socio-technical impact on organisational information security management. The final stage of the research focused on developing an effective training and awareness programme. This training programme was constructed by incorporating the techniques that were identified as enhancing employee perceptions, attitudes and motivations, in order to facilitate a better transference of skills and more sustainable and appropriate behaviours to improve organisational information security management in the workplace. The techniques utilised included: effective communication, knowledge reinforcement, pre- and post-assessment and motivational techniques.

Security breaches have attracted attention from corporations and scholars alike. The major organisations are determined to stop security breaches as they are detrimental to their success. Arguably the most common factor contributing to these breaches is employee behaviour, which suggests that changes in employee behaviour can have an impact on improving security. This research aims to study the critical factors (CFs) that impact on employee behaviours toward compliance with their organisation¿s information security policy. This investigation will focus on the various critical success factors based on their grouping into one of the following three major categories, namely: organisational factors, behavioural factors and training factors. Each of these categories affects a different aspect of information security and the objective is to not only understand the interaction of different factors but also to study further the aims in order to provide practical recommendations for improving organisational information security management. This study has utilised empirical research through the use of both qualitative and quantitative methodologies to inform each stage of the research. This study focused on the health, business and education sectors by empirically evaluating the obstacles and success factors that affect employee compliance to organisational security policies. In addition, this study also evaluated the affect of the socio-technical impact on organisational information security management. The final stage of the research focused on developing an effective training and awareness programme. This training programme was constructed by incorporating the techniques that were identified as enhancing employee perceptions, attitudes and motivations, in order to facilitate a better transference of skills and more sustainable and appropriate behaviours to improve organisational information security management in the workplace. The techniques utilised included: effective communication, knowledge reinforcement, pre- and post-assessment and motivational techniques.

nformation security (InfoSec) policies are widely used by institutions as a form of InfoSec control measure to protect their information assets. InfoSec policies are commonly documented in natural language, which is prone to ambiguity and misinterpretation, thereby making it hard, if not impossible, for users to comply with. These misinterpretations may lead the students or staff members to wrongfully execute the required actions, thereby making institutions vulnerable to InfoSec attacks. According to the literature review conducted in this work, InfoSec policy documents are often not followed or complied with; and the key issues facing InfoSec policy compliance include the lack of management support for InfoSec, organisational cultures of non-compliance, intentional and unintentional policy violation by employees (the insider threat), lack of policy awareness and training as well as the policy being unclear or ambiguous. This study is set in the higher education context and explores the extent to which the non-compliance problem is embedded within the policy documents themselves being affected by ambiguity. A qualitative method with a case study research strategy was followed in the research, in the form of an inductive approach with a cross-sectional time horizon, whereby a selection case of relevant institutional InfoSec policies were analysed. The data was collected in the form of academic literature and InfoSec policies of higher education institutions to derive themes for data analysis. A qualitative content analysis was performed on the policies, which identified ambiguity problems in the data. The findings indicated the presence of ambiguity within the policy documents, making it possible to misinterpret some of the policy statements. Formal methods were explored as a possible solution to the policy ambiguity. A framework was then proposed to address ambiguity and improve on the clarity of the semantics of policy statements. The framework can be used by policy writers in paying attention to the presence of ambiguity in their policies and address these when drafting or revising their policy documents. / School of Computing / M. Sc.(Computing)

The UK’s housing stock is among the oldest and least efficient in Europe. 85% of the UK’s existing homes will still be standing and in use in 2050. Improving the energy efficiency of UK housing stock is an essential requirement in order for the UK to meet its 2008 Climate Change Act obligations. Energy efficiency in buildings is the focus of European (EU) policies with the intention of creating a low-carbon economy by 2020. Reducing energy consumption in existing buildings is essential to achieving this. Government policies are the primary mechanism for lowering energy consumption through changing consumer behaviour, promoting low carbon technology and energy efficient renovations of old building stock.The objective of this thesis is to investigate the effectiveness of UK policies at addressing factors affecting consumer decisions to carry out energy efficient renovations. This is with the intention of determining if UK policies are effectively contributing to the government’s long term climate change commitments.Using a theory developed by Parker (2000) as a conceptual framing of policy compliance, this study conducts interviews with consumers in order to analyse their awareness, understanding and perception of UK energy efficiency policies. Therefore, it can be determined how effective policies are at affecting consumer decisions to carry out energy efficient renovations.The thesis informs that consumers are motivated and willing to comply with policies but there are several key barriers preventing them from complying with these policies and therefore adopting energy efficient renovations. Policies are deemed to be somewhat ineffective at affecting consumer decisions to carry out energy efficient renovations.

This research seeks to derive and examine a multidimensional definition of information security awareness, investigate its antecedents, and analyze its effects on compliance with organizational information security policies. The above research goals are tested through the theoretical lens of technology threat avoidance theory and protection motivation theory. Information security awareness is defined as a second-order construct composed of the elements of threat and coping appraisals supplemented by the responsibilities construct to account for organizational environment. The study is executed in two stages. First, the participants (employees of a municipality) are exposed to a series of phishing and spear-phishing messages to assess if there are any common characteristics shared by the phishing victims. The differences between the phished and the not phished group are assessed through multiple discriminant analysis. Second, the same individuals are asked to participate in a survey designed to examine their security awareness. The research model is tested using PLS-SEM approach. The results indicate that security awareness is in fact a second-order formative construct composed of six components. There are significant differences in security awareness levels between the victims of the phishing experiment and the employees who maintain compliance with security policies. The study extends the theory by proposing and validating a universal definition of security awareness. It provides practitioners with an instrument to examine awareness in a plethora of settings and design customized security training activities.

Information Security (InfoSec) is a broad term used to describe the study of how to protect sensitive data from unauthorized access, modification, or deletion. InfoSec is commonly used within companies and organisations to facilitate the secure use of digital systems, taking its shape in the form of technical solutions as well as rules and guidelines defined in a so-called Information Security Policy (ISP). Subsequently, ISPs, which aim to mitigate the risks posed by the generally agreed upon weakest link, the human factor, is considered a crucial asset to maintaining security. The outbreak of the COVID-19 pandemic further solidifying its worth as an increase in attacks targeting humans, especially within the healthcare sector, can be seen. Research directed at ISPs is a much debated area which scientists from many different fields of study continuously lend their efforts. However, to the best of the authors' knowledge no recent studies can been seen that examines ISP Compliance (ISPC), with a focus on InfoSec awareness, from a Swedish regional healthcare employees’ perspective. Hence, this study seeks to provide an insight into this area, with the outbreak of the COVID-19 pandemic in mind. The research is based on a web-questionnaire survey created using information gained throughout several interviews with people working in the field of InfoSec. It seeks to examine healthcare employees' InfoSec awareness following the COVID-19 pandemic outbreak with regard  teleworking. It can be seen from the results that healthcare sector employees' were well aware of the InfoSec risks related to the changing work conditions following the outbreak of the COVID-19 pandemic.

The purpose of this thesis was to examine the reactions to Canadian public health organizations' messaging through a social media analysis by answering the following two research questions: 1) How did different levels of government use social media communication to inform the public of COVID-19 information during the reopening phase? 2) What was the public response to the lifting of COVID-19 measures? COVID-19-related Tweets posted by Ottawa Public Health (OPH), Public Health Ontario (PHO), and Health Canada and the Public Health Agency of Canada (HC & PHAC) and their replies were collected using the Twitter API through Python. Sentiment analysis of the data was conducted using the VADER tool. This was followed by a thematic analysis of Twitter threads to identify patterns in the Tweets posted by each organization and their respective replies. Results of the VADER sentiment analysis indicate OPH Tweets were mostly positive, whereas HC & PHAC Tweets were slightly more positive than neutral. PHO Tweets were mostly neutral. Public social media replies to the selected public health organizations were also measured; replies to both OPH and HC & PHAC were more negative than positive, although replies to OPH were slightly more positive compared to replies to HC & PHAC. Thematic analysis revealed five themes regarding public health organizations' use of social media communications and eight themes relating to the public response to information posted by the selected public health organizations. The results from both sentiment and thematic analysis can help inform recommendations to enhance communication by Canadian governmental organizations, especially in public health systems, and offer recommendations for public health social media communication to inform future disaster response policies.