| That organizations face threats to the security of their computer systems from external hackers is well documented. Intentional or unintentional behaviors by organizational insiders can severely compromise computer security as well. Less is known, however, about the nature of this threat from insiders. The purpose of this study was to bridge this gap in the literature by investigating the phenomenon of unintended insider threat to information technology security. The conceptual framework for this study was Loch, Carr, and Warkentin's four dimensions of information system security---sources, perpetrators, intent, and consequences. Research questions focused on the identification of insider threats, factors contributing to unintended threat, the relationship of these factors to organizational vulnerability and potential consequences, and ways in which managers and information technology specialists might mitigate the risks from insider threat. Using grounded theory methodology, a purposeful sample of 10 U.S. Coast Guard information technology security experts was interviewed and the data analyzed using the constant comparative method. Findings from the study informed an expansion of the Loch, Carr, and Warkentin model of information system security to include the origin of the threat, sanctions for security violations, and resource loss. The implications for social change include sharing this knowledge within government, industry, and academia to improve organizational resilience to insider threats, thereby enhancing the protection of critical computer infrastructure within the U. S. and the world at large. |
