Identifying factors of “organizational information security management”

Abstract

Purpose – Despite many technically sophisticated solutions, managing information security has remained a persistent challenge for organizations. Emerging IT/ICT media have posed new security challenges to business information and information assets. It is felt that technical solutions alone are not sufficient to address the information security challenge. It has been argued that organizations also need to consider the management aspects of information security. Consequently, literature, especially in the last decade, has witnessed various scholarly works in this direction. Therefore, a synthesis exercise is required to bring clarity on categorizing the issues of organizational information security management (ISM) to take the research forward. The purpose of this paper is to identify management factors that address organizational information security challenges. Design/methodology/approach – Using a mix method approach, the paper adopts the qualitative (keyword analysis and experts’ opinion) and quantitative (questionnaire survey) research routes. Exploratory factor analysis is conducted to find out the key factors of organizational ISM. Findings – The paper categorizes various organizational ISM functions into ten factors. Spanning across three levels (strategic, tactical and operational), these factors cover various management issues of organizational ISM. Originality/value – The paper takes the ISM literature forward by statistically validating the key management factors of organizational ISM. The study outcome should help to draw the attention of organizations toward the managerial challenges of organizational ISM.

Smart City Development in Taiwan: From the Perspective of the Information Security Policy

“…ISP models comprise the following: The ISP goal, establishment and control of information security standard operating procedures, combination of information security and business operations, establishment of security awareness and enhancement of the range of application of coordination and integration, and implementation methods. These are crucial contents of an ISP model and are influential to information security [42,43]. The present study, thus, argued that the ISP model campaign affects increases in information security effectiveness and proposed the following hypothesis for verification.…”

“…Detailed specifications for this are presented in ISO/IEC 17799 [43], and encompass the following: ISP formulation, safe smart cities and its responsibilities, personnel safety, information asset classification, physical and environmental security, system planning and operational safety, data and media security, encryption control, communication and network security, access control, system development and maintenance, continuous business operations management, ISP execution, and information audit policy. These have immense and far-reaching impacts on information security [42,44]. Therefore, this study argued that implemented projects of ISP models affected the increase in information security effectiveness and proposed the following hypothesis for verification.…”

“…This consensus marks the baseline level of information security set by smart cities and serves as their common goal for information security. The following are sufficient for affecting an organization's information security performance: The definition of the scope of information security, setting of information security goals and strategies, each level's information security responsibilities and regulations, supervision of compliance with information security mechanisms, and the announcement of consequences for noncompliance with information security guidelines [41,42]. Therefore, the present study argued that ISP announcement timing, as well as the ISP review, affects the increases in information security effectiveness, and proposed the following hypotheses (H7-H11) for verification.…”

Monitoring IT and Internet Usage of Employees for Sustainable Economic Development in Nigeria: Legal and Ethical Issues.

“…Network Security Monitoring defines the strategic monitoring of network traffic to assist in the detection and validation of intrusions (Bejtlich, 2004). Organization productivity has been defined from a multiple perspectives (Narain, Gupta, & Ojha, 2014) and with a holistic approach that expands beyond the technology and technical security (Perez, Branch, & Kuofie, 2014), to comprise the environment, the technology, and the employee (Stallings & Brown, 2012;Taylor & Robinson, 2015). Significant amount of empirical researches point to the fact that employees appear to be the most important links to both the economic productivity and information security of any organization, and invariably constitute the highest risk to low productivity, information security measures and information integrity of any organization (Stallings & Brown, 2012).…”

Intellectual Property Rights: The Effects on Information Security and Research Innovations in Nigeria

“…In relation to IPR, information security has been defined from a multiple perspectives (Narain, Gupta, & Ojha, 2014), and with a holistic approach that expands beyond the technical security (Perez, Branch, & Kuofie, 2014), to comprise the environment, the technology, and the people (Stallings & Brown, 2012;Taylor & Robinson, 2015). Significant amount of empirical researches point to the fact that humans appear to be the most important links to the information security of any organization, and invariably constitute the highest risk to the information security measures and information integrity of any organization (Stallings & Brown, 2012).…”