Organizational objectives for information security governance: a value focused assessment

Abstract

Purpose – The purpose of this study is to develop theoretically grounded and empirically derived organizational security governance (OSG) objectives. Developing organizational security governance (OSG) objectives pose significant challenges for organizations considering the ever-increasing vulnerability from lack of or misuse of appropriate controls. In recent years, there have been several cases of colossal losses to businesses due to inadequate security governance measure. In many cases, organizations do not even know as to what their ISG objectives might be. Following an extensive empirical study, this paper proposes 6 fundamental and 17 means objectives for designing security governance. The objectives were developed from individual values of information technology and security executives across a wide range of firms. The study comprised 52 interview respondents across 9 firms, which resulted in 23 OSG objectives. Theoretically, the study was grounded in Catton’s (1959) value theory and Keeney’s (1992) value-focused thinking. The objectives provide a useful basis for strategic planning for information security governance. Design/methodology/approach – This research is grounded in value-focused thinking methodology. Step 1: develop a comprehensive list of personal values underlying the problem being explored. The researcher undertakes extensive interviews, using relevant probes, to elicit underlying values of respondents. Step 2: change the values enlisted to a common form and convert them into objectives. The data collected in Step 1 is collated and presented in a common form, which enables cross-comparison and easy interpretation. Step 3: classify the objectives as means and fundamental for the decision context. Objectives are clustered into groups and then classified into fundamental and means. Findings – This study uses a value-focused approach to develop OSG objectives. Incorporating individual values in developing governance objectives would facilitate alignment of individual and organizational values about OSG. This study proposes 6 fundamental and 17 means objectives for OSG. The study provides a comprehensive list of OSG that is rooted in values of stakeholders in an organization. Originality/value – The main contributions study can be classified in two categories. First, it represents a collective set of OSG objectives which touch upon technical, formal, informal, moral and ethical dimensions of governance. This is a unique, synthesized and cohesive framework for OSG, which incorporates several aspects of OSG into one platform, thus allowing the development of a comprehensive security management program. Second, some of the objectives developed in this research (“establish corporate control strategy”, “establish punitive structure”, “establish clear control development process”, “ensure formal control assessment functionality” and “maximize group cohesiveness”) have not been emphasized enough in security governance literature.

Security ambiguity and vulnerability in G2C eGovernance system: Empirical evidences from Indian higher education

“…In March 2018, over 300 Universities worldwide were affected because of cyber-attack and more than 100,000 professors' email accounts were targeted and about 8,000 of them were finally compromised and 31 terabytes of "valuable intellectual property and data" was exposed (11) (12) . The chances for external as well as internal cyber threats have been augmented because of enhanced level and the spectrum of vulnerability in the institutions due to lack or misuse of appropriate controls (13) .…”

Evaluación de la calidad de gobierno de tecnologías y sistemas de información basada en valor

“…En sí, 14 (6,36%) de los 220 trabajos encontrados, cumplieron los criterios de inclusión y exclusión, por lo cual, fueron tomados en cuenta. No obstante, a excepción de los trabajos de Lima et al (2011), Gummerus (2011) y Li et al (2010), se observa la falta de criterios de evaluación de la calidad de GoTSI de manera holística y con perspectiva directiva, prueba de aquello son las propuestas de estructura holística de la calidad de servicios electrónicos (Viscusi, 2009) ) (Jin-fu, et al, 2009, evaluación de la calidad de portales eGov , impulsores de valor para la implementación de sistemas interoperables de gobierno electrónico , gestión de la calidad de procesos de negocio (Lohrmann, et al, 2013), gestión de seguridad de la información en apoyo a la planificación estratégica (Mishra, et al, 2008) ; todos ellos enfocados en la gestión. En este sentido, el sector de las TSI tiene muchas propuestas para elegir pero muy pocas evidencias que hayan contribuido a la toma de decisiones por parte de la organización.…”

“…De los resultados obtenidos se puede observar que el área de seguridad de la información cuenta con el aporte de un marco teórico de gestión en donde se definen objetivos de control motivados por los valores que expresan los administradores de TSI en la definición de controles internos (Mishra, et al, 2008). Es que los valores enfocados en el pensamiento juegan un rol importante en las decisiones de objetivos que los administradores deben tomar.…”

“…En el contexto de gestión de la seguridad, Mishra & Dhillon proponen un modelo de trabajo para determinar controles internos de seguridad en sistemas de información basados en el valor de las decisiones tomadas por los directores de TSI. Los resultados demuestran que es posible definir exposiciones teóricas acerca de valores para evaluar la gobernanza de seguridad como un área importante de GoTSI (Mishra, et al, 2008).…”

“…Tipo de Estudio Año Modelo de gestión de servicios de TI Estudio de caso 2011 (Viscusi, 2009) Modelo -fu, et al, 2009) Modelo de evaluación de la calidad Estudio de caso 2009 (Mishra, et al, 2008) Modelo de control basado en valor Entrevista 2008 (Misuraca, et al,…”