Assessing the current state of information security policies in academic organizations

Abstract

Purpose Colleges and universities across the USA have seen data breaches and intellectual property theft rise at a heightened rate over the past several years. An integral step in the first line of defense against various forms of attacks are (written) security policies designed to prescribe the construction and function of a technical system, while simultaneously guiding the actions of individuals operating within said system. Unfortunately, policy analysis is an insufficiently discussed topic in many academic communities with very little research being conducted in this space. Design/methodology/approach This work aims to assess the current state of information security policies by analyzing in-use policies from 200 universities and colleges in the USA with the goal of identifying important features and general attributes of these documents. The authors accomplish this through a series of analyzes designed to examine the language and construction of these policies. Findings To summarize high-level results, the authors found that only 54 per cent of the top 200 universities had publicly accessible information security policies, and the policies that were examined lacked consistency with little shared source material. The authors also found that the tonal makeup of these policies lacked a great deal of emotion, but contained a high amount of tentative or ambiguous language leading toward policies that could be viewed as “unclear.” Originality/value This work is an extension of a paper that was presented at ECIS 2018. The authors have added additional analyzes including a cross-policy content and tonal analysis to strengthen the findings and implications of this work for the wider research audience.

AI, biometric analysis, and emerging cheating detection systems: The engineering of academic integrity?

“…With sufficient effort, institutions can indeed implement humane and transparent ways of dealing with cheating and deception issues. Coherent policies on the part of higher education institutions about the kinds and extents of cheatingdetection efforts are often lacking, a situation that is comparable to other high tech and software concerns such as information security (Slade et al, 2019;Weidman & Grossklags, 2018).…”

Information Security Mechanisms and ICT Policy in Practice: A Case of the University of Namibia

“…The University of Namibia has put in place an ICT policy to guide its resources users. Security policy is considered important for managing the security of information systems [15]. Exploration and analysis of the current state of information security policies in academic institutions illuminate the need to upscale and adopt the latest security solutions [16].…”

An Analysis of the Current State of the Consumer Credit Reporting System in China

“…The Internet giants pay higher attention to data security than other companies as all of them not only explain the techniques and management skills taken to protect data but also establish a disaster response mechanism. Please note that all companies likely have internal security policies with further details (see, e.g., [59]).…”