Inter-organisational information security: a systematic literature review

Abstract

Purpose The purpose of this paper is to survey existing inter-organisational information security research to scrutinise the kind of knowledge that is currently available and the way in which this knowledge has been brought about. Design/methodology/approach The results are based on a literature review of inter-organisational information security research published between 1990 and 2014. Findings The authors conclude that existing research has focused on a limited set of research topics. A majority of the research has focused management issues, while employees’/non-staffs’ actual information security work in inter-organisational settings is an understudied area. In addition, the majority of the studies have used a subjective/argumentative method, and few studies combine theoretical work and empirical data. Research limitations/implications The findings suggest that future research should address a broader set of research topics, focusing especially on employees/non-staff and their use of processes and technology in inter-organisational settings, as well as on cultural aspects, which are lacking currently; focus more on theory generation or theory testing to increase the maturity of this sub-field; and use a broader set of research methods. Practical implications The authors conclude that existing research is to a large extent descriptive, philosophical or theoretical. Thus, it is difficult for practitioners to adopt existing research results, such as governance frameworks, which have not been empirically validated. Originality/value Few systematic reviews have assessed the maturity of existing inter-organisational information security research. Findings of authors on research topics, maturity and research methods extend beyond the existing knowledge base, which allow for a critical discussion about existing research in this sub-field of information security.

Keeping customers' data secure: A cross-cultural study of cybersecurity compliance among the Gen-Mobile workforce

“…However, only a few studies have investigated employees' actual behavior in this context (Cram et al, 2017;Karlsson et al, 2016;McCole et al, 2010;Gozman and Willcocks, 2019;Amankwah-Amoah and Wang, 2019). Theories in the literature include protection motivation theory (Rogers, 1983), general deterrence theory (Beccaria, 1963;Gibbs, 1975), rational choice theory (Paternoster and Simpson, 1996), neutralization theory (Siponen and Vance, 2010;Sykes and Matza, 1957), theory of reasoned action (Fishbein and Ajzen, 1975), theory of planned behavior (Ajzen, 1985) and social cognitive theory (Bandura, 1986).…”

What do we know about information security governance?

“…Third, ISG papers have low "research maturity". Following Karlsson et al (2016), the research papers are classified by maturity; from emergent to mature (Figure 1). Figure 2 shows that over time, the ISG literature has become more mature.…”

Managing cyber and information risks in supply chains: insights from an exploratory analysis

“…However, from an overall analysis of the extant literature, it appears that research on information risk and security has been dominated by technical aspects (Karlsson et al , 2016), and information security management was treated as a technical issue (Singh et al , 2013). Hence, the majority of the attention was given to technological solutions (Soomro et al , 2016).…”

“…Nevertheless, from the reviewed literature, it appears that information risk management efforts are generally focussed within the boundaries of the organization or, on a much lesser scale, on inter-organizational dyadic connections between companies (Karlsson et al , 2016). Hence, the literature advocates for a more holistic approach to information risk management (Soomro et al , 2016).…”

“…It also shows the need for providing the scientific and industrial communities with empirical evidence aimed at advancing the knowledge and managerial practice on the topic of CSCRM for building a resilient supply chain. In fact, a substantial dearth of empirical studies on cyber and information risk management conducted according to the abovementioned perspectives has been highlighted by previous research (Boyson, 2014; Karlsson et al , 2016) and thus further empirical studies are called for by the managerial implications of cyber-attacks shown in recent examples (Williams, 2017). These gaps provide the motivations for our study and offer to the authors the possibility to complement the existing body of knowledge by providing the academic community with the results of our study, especially shedding light on the managerial implications of the choices made by companies in terms of approaches to managing cyber and information risks, the adopted initiatives, and to what extent in the supply chain.…”