  Previous studies show that information security breaches and privacy
violations are important issues for organisations and people. It is
acknowledged that decreasing the risk in this domain requires consideration of
the technological aspects of information security alongside human aspects.
Employees intentionally or unintentionally account for a significant portion of
the threats to information assets in organisations. This research presents a
novel conceptual framework to mitigate the risk of insiders using deterrence
and prevention approaches. Deterrence factors discourage employees from
engaging in information security misbehaviour in organisations, and situational
crime prevention factors encourage them to prevent information security
misconduct. Our findings show that perceived sanctions certainty and severity
significantly influence individuals' attitudes and deter them from information
security misconduct. In addition, the output revealed that increasing the
effort, risk and reducing the reward (benefits of crime) influence the
employees' attitudes towards prevent information security misbehaviour.
However, removing excuses and reducing provocations do not significantly
influence individuals' attitudes towards prevent information security
misconduct. Finally, the output of the data analysis also showed that
subjective norms, perceived behavioural control and attitude influence
individuals' intentions, and, ultimately, their behaviour towards avoiding
information security misbehaviour.
