Information systems resources and information security

Abstract

Recent studies suggest that the number of information security incidents has increased dramatically and has caused significant economic loss worldwide. Awareness of the significance of information security is evidenced by a rapid increase in information security investments. Despite the fact that information security has taken on a new level of importance, academic research on this subject is still in its infancy. A review of literature indicated that past studies largely took a resource based view, suggesting that organizations invest and develop a variety of IS resources so as to ease potential threats caused by information security breaches. However, the resourcebased perspective as used in previous studies was somewhat limited. Based on and extending from previous work, this study employed the resource-based view as a theoretical lens to examine the role that IS resources play in determining the level of information security. A field study was conducted to test the hypotheses. The results of the model testing show that IT human, relational, and infrastructure resources have significant impacts on information security.

Information security knowledge sharing in organizations: Investigating the effect of behavioral information security governance and national culture

“…That is, they outline strategies, plans, and investments based on an understanding of business objectives, values, and needs. Previous research have shown that organizations with business competent information security executives conduct proper management of information assets and effective allocation of resources (Chang and Wang, 2010). In line with the findings from the exploratory study, we believe that a deep understanding of the business environments, processes and the organizational goals should enable the development of effective information security strategies, provide information security services that fit organizational needs, and enable a more effective coordination of information security activities.…”

“…While all the aforementioned approaches have increased the understating of problems related to behavioral information security governance, and potential solutions to those problems, none of them have developed and empirically tested a theoretical model that include behavioral information security governance constructs. In fact, by reviewing related work the authors of the present paper only found four studies that fulfil this criteria (Straub, 1990;Kankanhalli, 2003;Knapp et al, 2007;Chang and Wang, 2010). Considering the lack of empirical studies related to behavioral information security governance, the present study aims at complementing the body of literature on behavioral information security governance by exploring, developing, and empirically testing a theoretical model explaining the establishment of security knowledge sharing throughout an organization.…”

“…When possible, the items were based on existing scales that have been proven reliable. Items representing business-based information security management, were identified from previous work (Chang and Wang, 2010;Spears and Barki, 2010). Thus, a major part of the items were developed specifically for this study.…”

“…In the present study, we quantitatively assessed the content validity using the item-sorting method proposed by Anderson and Gerbing (1991). This was done for all constructs except business-based information security management as these items were already proven reliable by previous empirical research (Chang and Wang, 2010;Spears and Barki, 2010). Besides providing a statistical result to assess the adequacy of content validity of each item, the method does not make any implicit assumptions about the direction of the relationship between the items and their corresponding factors or about the correlations between the items themselves.…”

Organizational Characteristics and Their Influence on Information Security in Trinidad and Tobago

“…Apart from studies done by Xu and Bowrin (2005), Thorpe (2005) and Duncan and Duggan (2008) information security remains a relatively under-researched field in the Caribbean context. This study aims to add to the reservoir of local knowledge and in this endeavour we will use the information security model developed by Chang and Wang (2010). Peltier (2005) states that information security "encompasses the use of physical and logical data access controls to ensure the proper use of data and to prohibit unauthorized or accidental modification, destruction, disclosure, or loss of access".…”