Applying double loop learning to interpret implications for information systems security design

Abstract

The security of infornzation systems (IS) continues to be one of the most serious issues of the twenty-first century. Past research indicates human factors to be the prime reason for IS security breaches.Human factors are repertoires of behavior that evolve f.om the reasoning and actions that individuals follow. These actions become the 'theories of action ' individuals espouse and their 'theories-in-use', which are the actions they actually use. We argue that IS security problems occur when an organization's 'espoused theory ' and their 'theory-in-use ' (what they actually do) are contradictory. It is important, therefore, that human factors be addressed in (IS) security. The current focus on technological methods alone is an incomplete solution. The purpose of this paper is lo present double loop learning as a strategy for designing and intplenienting security actions that bring an organization's 'espoused theory' and their 'theory-inuse' (what they actually do) into congruence . Indeed, by doing so double loop learning is a proactive securiry method that never becomes outdated.

Value‐focused assessment of information system security in organizations

“…Clearly, there appears to be a mismatch between the values propounded by the managers in our study and the organizational and legislative actions. In the literature this has been characterized as the mismatch between the espoused theory and theory in use (Mattia & Dhillon, 2003).…”

Organizational power and information security rule compliance

“…Lack of compliance with security policies occurs because of a number of reasons. Foremost amongst them are the inability of the policy to reflect current practices [1] and stakeholder resistance to security rules [2]. The organizational studies literature has intricately linked the concept of resistance to organizational power [3,4].…”

Information security investments: An exploratory multiple case study on decision-making, evaluation and learning

“…In academia, the concept of single loop and double loop learning gains relevance (Hwang & Wang 2016;Reychav et al 2016;Vallerand et al 2017). With the increasing sophistication in attacks (Baskerville et al 2014), the two types of learning have become essential in firms (Ahmad et al 2012): Organizations need both single loop and double loop learning to secure their systems (Mattia & Dhillon 2003). In the literature, organizational learning in the information security context is present as described (Ahmad et al 2015;Schlienger & Teufel 2005).…”