Organisational Information Security Strategy: Review, Discussion and Future Research

Abstract

Dependence on information, including for some of the world's largest organisations such as governments and multi-national corporations, has grown rapidly in recent years. However, reports of information security breaches and their associated consequences indicate that attacks are escalating on organisations conducting these information-based activities. Organisations need to formulate strategy to secure their information, however gaps exist in knowledge. Through a thematic review of academic security literature, (1) we analyse the antecedent conditions that motivate the adoption of a comprehensive information security strategy, (2) the conceptual elements of strategy and (3) the benefits that are enjoyed postadoption. Our contributions include a definition of information security strategy that moves from an internally-focussed protection of information towards a strategic view that considers the organisation, its resources and capabilities, and its external environment. Our findings are then used to suggest future research directions. 1

What do we know about information security governance?

“…We checked whether other search terms, such as “cyber-”, “business-” and “digital security governance”, generated new papers, but this was not the case. The search was not restricted by the articles’ age or the grade of the journal; instead, we preferred to examine each paper found for nuances that could shed light on our evolving understanding of the concept (Horne et al , 2017). This led to an initial set of 126 papers up until 2018. Exclusion criteria : By reading abstracts, papers were excluded from this review for multiple reasons.…”

“…Such a collaborative approach results in an IS strategy that is more aligned with business goals and that improves security assimilation, e.g. compliance, better policy alignment, the selection of more effective IS security controls and fewer security incidents (Kayworth and Whitten, 2012;Ahmad et al, 2014;Barton et al, 2016;Soomro et al, 2016Horne et al,2017. 4.1.3 Non-functional security or security embedded by design.…”

Consumers Trust, Privacy and Security Issues on Mobile Commerce Websites

“…On the other hand, information security, in the context of e-commerce, is in simple terms described as a mechanism that allows authorized people to transact business securely and efficiently over the internet while keeping unauthorized people away from the valuable information (Horne, Ahmad & Maynard, 2015). As such, security concerns aspects that ensure that the valuable information in e-commerce platforms is not accessed, destroyed or compromised by unauthorized users.…”

Multicriteria analysis of the compliance for the improvement of information security

“…Organizations also need to formulate or reformulate strategies to the security of their information and to reduce gaps which consider different knowledge levels in this important subject. They also need to carry out condition analysis to motivate the adoption by taking into account the protection from a more internal protection approach to a more systemic approach regarding resources, capabilities and external environment (Horne, Maynard, & Ahmad, 2017).…”