Information Security Inside Organizations - A Positive Model and Some Normative Arguments Based on New Institutional Economics

Information security as organizational power: A framework for re-thinking security policies

“…Our findings resonate with consistent themes in the literature around the relations between organizations and technology: centralization, de-centralization, hierarchy, and co-operation. From the perspective of information asymmetries, transaction costs and principal-agent relationscentral themes of new institutional economics -Pallas [32] investigates the security implications of co-ordination and motivation in organizations,. Enforced Figure 4: Re-thinking circuits of power in acceptable use enforcement control introduces hierarchical organization costs while at the same time relies on (human) actors who may not always complya clear instance of a principal-agent problem [25] which we could re-specify, in Callon's [9] terms, as a failure of interessement.…”

“…it's a pretty tedious process, but you just put in the request for what you want, fill in a form, send the request away, and then it gets approved by your manager. -European staff memberIn effect, maintenance is more centralized and controlled, constraining the availability of software; and this, too, carries organizing costs[32]. Company power is maintained by disempowering staff members, in Clegg's[12] terms: Even though the policy is enforced by technological means, this does not mean that compliance is total; a participant describes a simple form of avoidance, using a home computer when software required for business uses was not readily available:…”

You’ve Left Me No Choices: Security Economics to Inform Behaviour Intervention Support in Organizations

“…Pallas [43] applies institutional economics to revisit information security in organizations, developing a structured explanation of how the centralised security function and decentralized groups of employees interact in an environment of increasingly localised personal computing. Pallas delineates three forms of security apparatus for achieving policy compliance in organizations (as in Table 1): architectural means (which prevent bad outcomes by strictly controlling what is possible); formal rules (such as policies, defining what is allowed or prohibited for those in the organization); and informal rules (primarily security awareness and culture, as well as security behaviours).…”

Fixing Security Together: Leveraging trust relationships to improve security in organizations

“…Information security breaches originating from human behavior lead people being described as the "weakest link" in the security chain [16]. The main human-related threats to security can be attributed to three areas: (1) human error leading to data leakages or creating vulnerabilities that can be exploited by attackers [17], (2) social engineering, where attackers psychologically manipulate people into performing securitycompromising actions or divulging information [18] and (3) insider attacks, when employees intentionally exceed or misuse authorized levels of access to networks, systems, or data to steal confidential or proprietary information from the organization [19]. To counter these threats, organizations implement various assurance mechanisms (e.g.…”

“…Traditionally, information security seeks to mitigate security risks by implementing policies and technical mechanisms that specify employee behavior; policies also may threaten sanctions in case of non-compliance. The impact of this "comply-or-die" approach on day-to-day functioning of an organization is significant: organizations not only pay a cost for security mechanism operations, but also create constraints for honest employees seeking to perform well [1]. It slows down their production tasks, sometimes even completely blocking them, mostly due to security mechanisms and processes not being designed around employee needs and priorities [2][3][4][5].…”