Examining the suitability of industrial safety management approaches for information security incident management

Abstract

Purpose This paper discusses whether recent theoretical and practical approaches within industrial safety management might be applicable to, and solve challenges experienced in, the field of information security, specifically related to incident management.Design/methodology/approach Literature review. FindingsPrinciples, research, and experiences on the issues of plans, training, and learning in the context of industrial safety management would be suitable for adoption into the field of information security incident management and aid in addressing current challenges. Research limitations/implications (if applicable)There are a number of reasons why approaches from industrial safety management have something to offer to information security incident management: the former field is more mature and has longer traditions, there is more organizational research on industrial safety issues than on information security issues so far, individual awareness is higher for industrial safety risks, and worker participation in systematic industrial safety work is ensured by law. More organizational research on information security issues and continuous strengthening of individual security awareness would push information security to further maturity levels where current challenges are solved. Practical implications (if applicable)This paper shows that the field of information security incident management would gain from closer collaborations with industrial safety management, both in research and in practical loss prevention in organizations. The ideas discussed in this paper form a basis for further research on practical implementations and case studies. Originality/valueThe main audience of this paper includes information security researchers and practitioners, as they will find inspirational theories and experiences to bring into their daily work and future projects.

The future of information security incident management training: A case study of electrical power companies

“…Learning from previous incidents as well as preparedness exercises is important for improving practices for responding to incidents. Learning improves the ability to anticipate future trends and events by producing relevant understandings of what can happen in the future (Line and Albrechtsen, 2016). Motivations for learning activities include keeping security practitioners updated on current threats, getting new ideas on how to resolve challenging incidents, discussing possible improvements of incident response activities, performing trend analysis, identifying direct causes, identifying new security measures needed, and updating risk assessments (Tøndel et al, 2014).…”

“…Motivations for learning activities include keeping security practitioners updated on current threats, getting new ideas on how to resolve challenging incidents, discussing possible improvements of incident response activities, performing trend analysis, identifying direct causes, identifying new security measures needed, and updating risk assessments (Tøndel et al, 2014). Learning from incidents should include systematic analysis, use of lessons learnt to make changes, and storing and sharing information (Line and Albrechtsen, 2016). Scholl and Mangold (2011) claimed that attending to small security events and early warnings can prevent major security disasters.…”

Protecting intellectual property from insider threats

“…Similarly, managers’ crisis response capabilities influence employees’ post-crisis behaviors (Mumford et al , 2000; Carmeli et al , 2013). While the above studies, examined the relationships between managers’ capabilities and employees’ behavior in a tangible, physical context, this paper extents these relationships to information security, as suggested by Line and Albrechtsen (2016). Specifically, the paper proposes that perceived management capabilities influence users’ PCM awareness and compliance intention.…”

“…This study adapts the general concept of safety management to information security and proposes a new framework named MISI. While industrial safety and information security differ, they have a similar goal of loss prevention (Line and Albrechtsen, 2016). Yet, to date, the two streams of research have been developed in parallel using differing terminology, and theoretical underpinning.…”

Critical success factors of environmental management accounting practices: findings from Malaysian manufacturing industry

“…Environmental safety refers to the safety awareness to enable industries to conduct in a secure environment to improve the company’s performance (Line and Albrechtsen, 2016). The tendencies of improving environmental safety are mostly applied by complying with the environmental standards and safety requirements on the company’s operation.…”