Information security strategies: towards an organizational multi-strategy perspective

Abstract

There considerable advice in both research and practice oriented literature on the topic of information security.Most of the discussion in literature focuses on how to prevent security attacks using technical countermeasures even though there are a number of other viable strategies such as deterrence, deception, detection and response.This paper reports on a qualitative study, conducted in Korea, to determine how organizations implement security strategies to protect their information systems. The findings reveal a deeply entrenched preventive mindset, driven by the desire to ensure availability of technology and services, and a comparative ignorance of exposure to business security risks. Whilst there was some evidence of usage of other strategies, they were also deployed in a preventive capacity. The paper presents a research agenda that calls for research on enterprisewide multiple strategy deployment with a focus on how to combine, balance and optimize strategies.

Discovering New Cyber Protection Approaches from a Security Professional Prospective

“…The impact of internal misuse of information within the organization has increased the vulnerability and risks associated with such abuse [44]. A useful strategy is to implement different security concepts to deter any possible internal threats such as employing disciplinary actions to control human behavior and attitude, the use of more monitoring surveillance, perimeter defense, and notably incorporating decoys as a mean of deception to attackers [8].…”

“…Increased cyber attacks are due to attackers being more sophisticated in this ever evolving and complexed digital economy that has grown exponentially [7]. Exploits have increased tremendously in the past decade which resulted in the increase or property loss, privacy, data theft, which impacted consumer confidence [8]. Exploits increased more than 42% by 2012 with an average of 116 targeted incidents daily [11].…”

A new paradigm of cloud-based predictive maintenance for intelligent manufacturing

“…Communication security. It has long been a challenging issue in cloud computing on guaranteeing user privacy and service security (Ahmad et al 2014;Khan et al 2013). To provide a secure cloud maintenance service, data security, network security, data locality, data integrity, authentication, and authorization need to be considered and addressed.…”

Asset Identification in Information Security Risk Assessment: A Business Practice Approach

“…A comprehensive and effective information security management (ISM) strategy begins with an accurate information security risk assessment (ISRA). An effective ISRA attempts to provide a prioritized estimation of the likelihood and impact of a range of security scenarios, with each scenario considering potential threats to organizational assets and existing protective controls (Shedden, Ruighaver, & Ahmad, 2010a;Ahmad, Maynard, & Park 2014b). ISRAs then guide the strategic selection of security controls to protect information resources (Dhillon & Backhouse, 2001).…”