Development of security policies

Threats and countermeasures for information system security: A cross-industry study

“…Researchers investigating IS security have proposed various theories and approaches to manage the threats by analyzing IS risks (e.g., [30]), modeling IS security (e.g., [29]), developing security strategies and policies (e.g., [23]), and establishing international security standards (e.g., [6]). However, studies seldom consider how organizational characteristics influence security adoptions, nor do they pay attention to industrial applications [3].…”

Strategic Approach to Information Security in Organizations

“…Early studies classified information security strategies into deterrence and prevention [4,17,18] or Prevention, Limitation and Correction [19]. Straub and Welke [20] extended Straub's previous work by adding detection and remedy.…”

“…The most exact strategy appropriate for the purpose needs to be chosen as well. Gravity of strategies also has to be balanced in order not to be skewed to one or two components of the environment while distributed and located evenly across the environment [19]. However, the fact that the most important assets needs to be wrapped up by several strategies and/or measures is obvious and not to be neglected.…”

“…Since not only IT itself is imperfect, which implies it is always vulnerable, but also complexity adds security risks on it as well [19], this is one of the important factors to be considered.…”

Organizational factors to the effectiveness of implementing information security management

“…While many researchers dedicated their efforts to various areas of security researches, most of them tended to focus on the technical side. Management attention to information security has been low compared to other information security issues (Olnes, 1994;Brancheau et al, 1996;Hong et al, 2003), and a lack of empirical research in the area of security risk management has been concluded due to the highly intrusive nature of ISM research approaches (Kotulic and Clark, 2004). Some researches attempted to study ISM issues from managerial perspective by interview method and tried to figure out their "professed" key success factors (Farmer and Warburg, 1997;Whitman, 2004), and some other articles emphasized the benefits of carrying out ISM but they ignored the prerequisite for ISM (Holzinger, 2000;Vermeulen and von Solms, 2002;Peltier, 2003;Foltz et al, 2005).…”