Abductive innovations in information security policy development: an ethnographic study

Abstract

Developing organisational information security (InfoSec) policies that account for international best practices but are contextual is as much an opportunity for improving InfoSec as it is a challenge. Previous research indicates that organisations should create InfoSec policies based on best practices (top-down) and simultaneously encourages participatory development (bottom-up). These contradictory suggestions place managers in a dilemma: Should they follow a top-down or bottom-up approach? In this research, we build on an ethnographic approach to study how an innovative engineering company (MachineryCorp) managed the contradiction when the firm developed an InfoSec policy. Drawing on the dialectical theory of organisations as a lens, the findings suggest the InfoSec policy development is a recurrent process consisting of three phases: (1) drawing interpretations of InfoSec requirements from best practices (deductive adoption) and (2) constructing possibilities for local implementation (inductive adjustment) (3) that engender tensions between best practices and local contingencies facilitating innovative local resolutions (synthetic innovation).We call this process abductive innovation. At MachineryCorp, a triangle of tensions surfaced due to economic realities, infrastructure affordances, and social arrangements, and were necessary in explaining how the InfoSec policy gradually and iteratively materialised and resulted in an organisationally contingent policy.

The influence of inputs in the information security policy development: an institutional perspective

“…Institutional theory has been widely used and accepted across disciplines to explain whether specific organisational processes and behaviour are consistent with institutional forces (Bjorck, 2004; Cavusoglu et al , 2015; Hsu, 2007). Previous studies on InfoSec through the lens of institutional theory have mainly focused on compliance and regulatory pressures (Hou et al , 2018; Niemimaa and Niemimaa, 2019), where the theoretical lens mainly has been used trying to analyse the output part and results of InfoSec and connected measures.…”

State of the art in information security policy development

“…In addition to preventing risks, the ISP may also serve as a plan to recover from materialized risks if continuity is coupled with information security (Baskerville, Spagnoletti, & Kim, 2014;Niemimaa & Niemimaa, 2019). ISP can guide the investigation of security incidents and provide procedures, for example, documenting the incident and containing it to limit further damage (Rees et al, 2003).…”

“…Cram et al (2017) identified three factors from previous research that influence ISP design: standards and regulations; the desired format; and internal and external risks. The approach for assessing the current situation and designing the ISP can have a top-down approach (standards, best practices) and/or a bottom-up approach (contextual, work-system originated) (Niemimaa & Niemimaa, 2019). Trček (2003) offered a framework for IS security management and policy formulation.…”

“…These top-down approaches also need to be adapted to an organization, which in turn requires bottom-up approaches to understand local work practices. These two approaches may cause tensions that need solving mechanisms in the ISP development process (Niemimaa & Niemimaa, 2019).…”

“…For example, the IT department alone rarely has this knowledge, which may lead to an overly-technical ISP (Maynard et al, 2011). The positive side of including staff in ISP development is, that the implementation of the policy starts with the developers during the development process (Niemimaa & Niemimaa, 2019) Trompeter and Eloff (2001) provided a framework for the implementation of socio-ethical controls in IS security. One of the main points of Trompeter and Eloff is that people should be placed at the center of the equation, rather than at its periphery by creating an ISP that includes socio-ethical issues (Trompeter & Eloff, 2001).…”