On security preparations against possible IS threats across industries

Abstract

PurposeModernized information systems (IS) have brought enterprises not only enormous benefits, but also linked information threats. Most enterprises solve their IS security‐related problems using technical means alone, and focus on technical rather than managerial controls, which may imply potential crises. This study examines whether the security preparation of firms matches the severity of IS threats they perceive in developing countries, especially in issues concerning “people” and “administration”. Additionally, this study discusses appropriate threat mitigation strategies for the four sectors as well.Design/methodology/approachUsing an empirical study, this study explores the past and current concerns of IS threats of firms in different industries, and the countermeasures prepared by them to protect themselves from such threats. The empirical data was provided by 109 Taiwanese enterprises from four sectors.FindingsThe analytical results revealed the differences in both the IS threats concerned and the security scopes prepared among the four sectors. Moreover, the preparation scopes were not commensurate with the perceived severity of threats. All four industries rated the network as posing the strongest threat, following regulation and personnel issues, while among the countermeasures in use, these three issues have larger application deficiencies.Originality/valueThis study concludes that the firms do not well prepare themselves against IS threats entailed to non‐technical administration issues and discusses appropriate threat mitigation strategies for the four sectors. Specifically, firms should be aware of IS threats to their business and prepare suitable security protections.

Antecedents for enhanced level of cyber-security in organisations

“…Finally, results suggest that the strategies adopted by the managers did not have any significant impact on the enhanced level of cyber-security. While our findings were contradictory to extant studies that successfully examined organisational strategies to influence the maturity levels of cyber-security (Chang and Yeh, 2006; Pérez-González et al , 2019; Nassimbeni et al , 2012; Tang and Liu, 2015), we posited that the conflicting results could be due to the lack of visibility of these strategies among the respondents in our study. Additionally, the lack of any significant positive effect of IT security strategies on the enhanced level of cyber-security in organisations could be due to the choice of the industry sectors for our study, i.e.…”

“…The strategies adopted by the senior management, in general, align with the business strategies of the organisation (Chang and Yeh, 2006; Nassimbeni et al , 2012). For our study, we have categorised the strategies adopted by senior management towards an enhanced level of cyber-security in the organisation, into the following five streams: clear vision , institutionalised IT security governance , risk management controls , reward policy and information sharing .…”

Towards a Holistic Understanding of Security Process: Formal Controls and Informal Relationships

“…With our theoretical model in mind, we selected a case based on previous research in information security. Prior research has found that organizations in the financial services, telecommunication and utilities sectors present rich cases for information security research due to their greater focus on information security threats and protection [35]. We chose an organization from the financial services sector.…”

Information system security commitment: A study of external influences on senior management

“…Effective ISS management is not a standalone activity, but should be founded on a well-developed security strategy (Seeholzer, 2012). ISS security strategies should be balanced with and support business strategies (Chang & Yeh, 2006;McFadzean, Ezingeard, & Birchall, 2011). Organizations must be able to assess the effectiveness of ISS and communicate its value to the organization (McFadzean et al, 2011).…”