Paradoxical tensions in the implementation of digital security governance: Toward an ambidextrous approach to governing digital security

Digital Security Governance

“…For example, ISG focuses on defining the roles, responsibilities and organizational structures for security, with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise's resources are used responsibly (Tan et al 2017 As cybersecurity continues to emerge as a crucial strategic concern and significant risk for organizations, there is a growing demand for research in the field of ISG (Schinagl & Shahim 2020). From this perspective, researchers are expanding their studies to focus on various strategic topics related to ISG, including the changing role of the Board of Directors (Rothrock et al 2018;Von Solms & Von Solms, 2018;Gale et al, 2022), metrics, scoring systems, and assessment studies to better understand how to measure performance, control, and improve ISG (Maleh et al 2017;Anu 2022;Herath et al, 2022), cutting ties and alleviating tensions to understand what hinders ISG implementations (Slayton 2021;Schinagl et al 2022), and, in particular, developing a wide variety of ISG models and frameworks (Maynard et al 2018;Nicho 2018;Alghamdi et al 2020).…”

“…Moreover, even less is known about how the implementation of ISG is influenced by digital environments. This is an important research gap because in complex connected digital environments, "conflicting demands", i.e., tensions, intensify and possibly impact ISG implementations (Smith & Lewis 2011;Schad et al 2016;Schinagl et al 2022). For example, organizations are confronted with the demands of the digital landscape, which drives the need for innovation and gaining a competitive edge.…”

“…Chapter 4 addresses a recurring research gap concerning the lack of theoretical and empirical guidance for governing and maintaining control over security in contemporary digital environments (Bongiovanni et al, 2022). Despite significant research efforts, current DSG approaches continue to receive criticism for their lack of effectiveness in the face of ongoing high-impact cyberattacks (Lidster & Rahman, 2018;Jalali et al, 2019;AlGhamdi et al, 2020;Schinagl et al, 2022). More specifically, this chapter highlights the problem of the "one size fits all" mentality prevalent in current DSG approaches that often overlook the crucial role of the organizational context in achieving effective DSG (Siponen & Willison, 2009;Williams et al, 2013;Mishra, 2015;Al-Ghamdi et al, 2020).…”

“…In today's digital world, concerns regarding cyberattacks, as well as related business interruptions, financial losses, and long-term intangible damage, are ever increasing (Jalali et al, 2019;Liu et al, 2020;Schinagl et al, 2023). The WannaCry and NotPetya ransomware attacks shook the world and showed how attacks on digital systems can seriously disrupt entire businesses beyond their IT operations (Dhillon et al, 2021).…”

“…Currently, cybersecurity failures are daily news, and global cybercrime costs are expected to grow by 15 percent annually in the coming years, reaching $10.5 trillion USD annually by 2025, compared to $3 trillion USD in 2015, making it more profitable than the global trade of all major illegal drugs 8 . Against this backdrop, governance of digital security is increasingly viewed as crucial in anticipating the ever-increasing impact of cyberattacks (Nicho, 2018;Liu et al, 2020;Schinagl et al, 2022).…”