Coping with Systems Risk: Security Planning Models for Management Decision Making

Abstract

The likelihood that the firm's information systems are insufficiently protected against certain kinds of damage or loss is known as "systems risk." Risk can be managed or reduced when managers are aware of the full range of controls available and implement the most effective controls. Unfortunately, they often lack this knowledge and their subsequent actions to cope with systems risk are less effective than they might otherwise be. This is one viable explanation for why losses from computer abuse and computer disasters today are uncomfortably large and still so potentially devastating after many years of attempting to deal with the problem. Results of comparative qualitative studies in two information services Fortune 500 firms identify an approach that can effectively deal with the problem. This theory-based security program includes: (1) use of a security risk planning model, (2) education/training in security awareness, and (3) Countermeasure Matrix analysis. abroad, the Local Government Audit Inspectorate (1981). Estimates of annual losses vary, but some set losses at between $500 million and $5 billion per year in the U.S. alone (Flanagan and McMenamin, 1992). If anything, losses have become even more serious as time goes on (Schwartz, 1990). Back-Burner Issue Yet, in spite of voluminous public evidence that systems risk is high and that many organizations are under-secured, many managers continue to ignore the issue and to be "naive" in their responses to the challenge posed by this growing threat (Loch et al., 1992, p. 183). Why is this so? One viable explanation is that systems risk has been a back-burner issue for decades, even among managers who specialize in information technology (IT), and it is difficult to change a perception with such momentum. Tellingly, although IT executives have included systems security in their list of critical issues (Ball and

Behavioral and policy issues in information systems security: the insider threat

“…Yet a focus on the offender has the potential to open up original areas for future research. Traditionally, IS security countermeasures have been categorized into four types, which include deterrence, prevention, detection, and recovery (Forcht, 1994;Parker, 1998;Straub & Welke, 1998). Compliance research, therefore, involves attempts to improve 'prevention' methods.…”

“…Existing bodies of divergent theory enable an understanding of offender behavior, not only during perpetration, but also importantly, prior to the commission process. If these 'appropriate' theories can be drawn from, there exists the potential to fully develop an understanding of this second form of behavior and expand the range of safeguards beyond the traditional deterrence, prevention, detection and, recovery classification (Straub & Welke, 1998).…”

A conceptual framework of info structure for information security risk assessment (ISRA)

“…Saleh & Alfantookh (Saleh and Alfantookh, 2011) concur in opinion. However, the main goal of all the ISRA is to reduce, mitigate, transfer or accept risks to an acceptable level by prioritizing and estimating the risk value (Saleh and Alfantookh, 2011;Straub and Welke, 1998). Hence, it can be concluded that any organization, regardless of their size, they have to ensure that the details for the activity listed below are gathered accurately: a.…”

Understanding the perpetration of employee computer crime in the organisational context

“…A number of researchers have focused specifically on the deterrent effect of safeguards (Campbell, 1988;Hoffer and Straub, 1989;Straub, 1990;Straub and Nance, 1990;Cardinali, 1995;Sherizen, 1995;Harrington, 1996;Straub and Welke, 1998). Of this group, several have applied General Deterrence Theory to the IS security domain (Hoffer and Straub, 1989;Straub, 1990;Straub et al, 1992;Harrington, 1996;Straub and Welke, 1998).…”

“…Of this group, several have applied General Deterrence Theory to the IS security domain (Hoffer and Straub, 1989;Straub, 1990;Straub et al, 1992;Harrington, 1996;Straub and Welke, 1998). This criminological theory posits that:…”