Governing Uncertainty or Uncertain Governance? Information Security and the Challenge of Cutting Ties

Abstract

Information security governance has become an elusive goal and a murky concept. This paper problematizes both information security governance and the broader concept of governance. What does it mean to govern information security, or for that matter, anything? Why have information technologies proven difficult to govern? And what assurances can governance provide for the billions of people who rely on information technologies every day? Drawing together several distinct bodies of literature—including multiple strands of governance theory, actor–network theory, and scholarship on sociotechnical regimes—this paper conceptualizes networked action on a spectrum from uncertain governance to governing uncertainty. I advance a twofold argument. First, I argue that networks can better govern uncertainty as they become more able not only to enroll actors in a collective agenda, but also to cut ties with those who seek to undermine that agenda. And second, I argue that the dominant conception of information security governance, which emphasizes governing uncertainty through risk management, in practice devolves to uncertain governance. This is largely because information technologies have evolved toward greater connectedness—and with it, greater vulnerability—creating a regime of insecurity. This evolution is illustrated using the history of the US government’s efforts to govern information security.

Towards the Design of a Collaborative Cybersecurity Networked Organisation: Identification and Prioritisation of Governance Needs and Objectives

“…The study of governance of cybersecurity requires interdisciplinary research [30] drawing, among others, from governance theory, actor-network theory, and the study of sociotechnical regimes [35]. Research on Internet governance has already utilised actor-network theory and interpretative policy analysis to conceptualise multi-stakeholder arrangements engaging heterogeneous actors [36,37].…”

Reconfiguring governance: How cyber security regulations are reconfiguring water governance

“…More specifically, if provision of water is a matter of public interest, what about the protection of industrial facilities, algorithms and data surrounding it? In analyzing the notion of governance, we take on board its conceptual fluidity and multiple meanings across disciplines (Rothstein et al 2013;Slayton 2020). For our analysis, we understand governance and its outcomes (i.e., regulations) as actions and actors aiming to achieve specific goals pertaining to the protection of public interest.…”

Tensions that Hinder the Implementation of Digital Security Governance

“…In particular, most studies have not comprehensively or clearly explained the processes of establishing security governance in organizations or provided guidelines for its implementation [6,21]. Implementing security governance remains difficult in complex connected digital environments because of "cutting ties", i.e., tensions [14]. Conflicts between information security values and work efficiency are the most common [5].…”

“…However, security governance literature is relatively immature, i.e. largely descriptive and provides both limited practical and theoretical guidance [6,13,14]. In particular, studies lack empirical understanding about the processes of establishing security governance in organizations or provided guidelines for its implementation [6,21].…”

“…In this study we bridge this research gap and provide empirical insight on implementation tensions. As explained earlier, implementing digital security governance in complex connected digital environments remains difficult because conflicting forces often exist that reveal tensions [14,15]. Focusing on tensions can provide important insights for both researchers and practitioners, helping them to become aware of possible tensions in security governance designs as well of coping strategies and practices to tackle these tension.…”