No abstract

No abstract

No abstract

Abstract:Organizations apply information security risk assessment (ISRA) methodologies to systematically and comprehensively identify information assets and related security risks. We review the ISRA literature and identify three key deficiencies in current methodologies that stem from their traditional accountancy-based perspective and a limited view of organizational "assets". In response, we propose a novel rich description method (RDM) that adopts a less formal and more holistic view of information and knowledge assets that exist in modern work environments. We report on an in-depth case study to explore the potential for improved asset identification enabled by the RDM compared to traditional ISRAs. The comparison shows how the RDM addresses the three key deficiencies of current ISRAs by providing: 1) a finer level of granularity for identifying assets, 2) a broader coverage of assets that reflects the informal aspects of business practices, and 3) the identification of critical knowledge assets.

In the seventies, Nolan was the first to address the need for a descriptive stage theory concerning the planning, organizing and controlling activities associated with managing the organizational computer resource. The arrival of newer technologies, such as those based on the Internet, calls for fresh approaches in terms of their implementation and management. Intranet technology, which is based on Internet technology, differs from other types of IT in terms of its characteristics, use and implementation. We propose a four‐stage model for intranet implementation and management. Each stage is portrayed by seven general characteristics. We propose that, in order to ensure intranet institutionalization, three existential crises must be overcome. First, if a sponsor does not nurture the intranet, it cannot evolve beyond its experimental beginnings. Second, if a critical mass of both users and content cannot be reached simultaneously, the intranet will not progress. Finally, if the intranet remains uncontrolled, it will be perceived to be useless, and therefore users will abandon it.