From theory to practice: guidelines for enhancing information security management

Abstract

Purpose This study aims to identify the implications of security behaviour determinants for security management to propose respective guidelines which can be integrated with current security management practices, including those following the widely adopted information security standards ISO 27001, 27002, 27003 and 27005. Design/methodology/approach Based on an exhaustive analysis of related literature, the authors identify critical factors influencing employee security behaviour and ISP compliance. The authors use these factors to perform a gap analysis of widely adopted information security standards ISO 27001, 27002, 27003 and 27005 and identify issues not covered or only partially addressed. Drawing on the implications of security behaviour determinants and the identified gaps, the authors provide guidelines which can enhance security management practices. Findings The authors uncover the factors shaping security behaviour barely or partly considered in the ISO information security standards ISO 27001, 27002, 27003 and 27005, including top management participation, accommodating individual characteristics, embracing the cultural context, encouraging employees to comply out of habit and considering the cost of compliance. Furthermore, the authors provide guidelines to security managers on enhancing their security management practices when implementing the above ISO Standards. Practical implications This study offers guidelines on how to create and design security management practices whilst implementing ISO standards (ISO 27001, ISO 27002, ISO 27003, ISO 27005) so as to enhance ISP compliance. Originality/value This study analyses the role and implications of security behaviour determinants, discusses discrepancies and conflicting findings in related literature, provides a gap analysis of commonly used information security standards (ISO 27001, 27002, 27003 and 27005) and proposes guidelines on enhancing security management practices towards improving ISP compliance.

The ISO/IEC 27001 information security management standard: literature review and theory-based research agenda

“…The most relevant one is related to the security controls, in particular considering the set of 133 controls described in the (Liao and Chueh, 2012b), entailed too rigid procedures (Crowder, 2013) and were costly to implement due to the possibility of an only partial automation through hardware and software tools (Montesino et al, 2012). As for the new version of the ISO/IEC 27001, Ho et al (2015) note that the standard still does not provide guidance on the mutual interdependence among the different control items; similarly, Stewart (2018) and Topa and Karyda (2019) refer to the lack of indications regarding a cost/benefit assessment in the selection of controls. On this, Bettaieb et al (2019) propose an approach based on machine learning for the identification of the most relevant controls, given the characteristics and the context of the implementing organization.…”

“…Another issue underscored in the studies concerns the fact that ISO/IEC 27001 does not provide adequate guidance on cultural and psychological dimensions relevant for ensuring employees' compliance (Van Wessel et al , 2011). As highlighted by Topa and Karyda (2019), there are only limited indications regarding the appraisal of individual habits and values, e.g. privacy concerns and compliance attitude.…”

“…employees are skeptical about the required reconfiguration of processes and reluctant to change (e.g. Heston and Phifer, 2011; Topa and Karyda, 2019) – and opposition whenever the implementation of the standard is externally mandated (Smith et al , 2010).…”

“…Country-specific elements are underscored also in relation to cultural differences in terms of employees' attitudes toward ISMS compliance (Asai and Hakizabera, 2010; Topa and Karyda, 2019). Moreover, the approach to ISO/IEC 27001 implementation seems different between European and Chinese companies (Van Wessel et al , 2011).…”

Analysing information security behaviour

“…To address the second research question, a clear picture of the security management practices that are currently implemented in organisations was needed. As most organisations adhere to the widely accepted international standards, including the ISO family of standardsparticularly ISO 27001, 27002, 27003 and 27005-this Thesis conducts a gap analysis of these standards to enable a comparison between literature findings and current practices, and provide directions and guidelines to address the identified gaps (Topa & Karyda, 2019). Moreover, a case study was conducted to investigate the security management practices followed in a large organization and show how the knowledge on factors influencing security behavior can be incorporated into security management practices to improve ISP compliance and the overall security posture of organisations.…”