Why Individuals Commit Information Security Violations: Neural Correlates of Decision Processes and Self-Control

Self-control has been identified as a major factor influencing individual behavior in social studies, economics, criminology, and information security literatures. Recent neuroscience studies show that lack of self-control can be attributed to lesions in the right prefrontal region of the brain, suggesting a strong linkage between self-control and neural processes. In this study, we tested neural correlates between self-control and decision making in the context of information security using electroencephalography (EEG) and event related potentials (ERPs). Our results show that while both left and right hemispheres of the brain are involved in decision making, the subjects with low self-control evoked lower level of neural activities in the right hemisphere and made riskier decisions than the subjects with high self-control. This study validates a new paradigm for using EEG/ERP to study information security related phenomena, and opens a new path for studying decision making neural correlates using scenario based approach.