Strategic Approach to Information Security in Organizations

Abstract

This paper is about the strategy for organizational information security. Strategy has been argued important however got little highlight comparing to other fields in information security, even from academia. We formed concept of information security strategy in organizations, developed classification framework for them, and identified important factors influencing their effective implementation in organizations. We believe that this is a new attempt to understand information security strategy and form a theoretical background in academia.

Multicriteria analysis of the compliance for the improvement of information security

“…It is, therefore, needed to deepen on multicriteria decision models which use variables of the ISO/IEC 27002:2013 standard from a strategic approach that defines the priorities for the organization's security, especially regarding compliance, since this type of analysis is complex and has a multidisciplinary nature. Thus, by also considering the little attention to this matter by security literature in comparison with other more technical approaches (Botha & Gaadingwe, 2006;Park & Ruighaver, 2008), this work is integrated with the decision matter to choose the best way for the managers to provide with effective alternatives for information security control.…”

“…Information security is a dynamic process that facilitates the information protection as the main organizations' asset and reaches a strategic significance (May, 2003;Doherthy & Fulford, 2005;Park & Ruighaver, 2008). This happens in the field of banking, since such type of organizations, which have operational risk, also have its own business risk (Shamala et al, 2015).…”

Innovation System in Air Transport Management

“…In this sense, this work focuses on security strategy and policy (Ward & Peppard, 2002;Doherty & Fulford, 2006;Von Solms & Von Solms, 2005;Park & Ruighaver, 2008) from a compliance approach for information security to be no longer considered as an exclusively technical matter isolated from the rest of the organization (May, 2003;Luftman, Kempaiah, & Nash, 2006;May & Dhillon, 2010).…”

“…According to Park and Ruighaver (2008), information security strategy is the art of deciding how to better use technology and appropriate information security measures and applying them in a coordinated way to defend the organization's information infrastructures against internal and external threats by offering confidentiality, integrity and availability as cost-effectively as possible. Hone and Ellof (2002) analyze security policy according to the international standards, pointing out that the standards and companies have to work together to define what security policy should be.…”

Organisational Information Security Strategy: Review, Discussion and Future Research

“…These definitions give an insight into the difficulties with achieving unanimity on defining ISSiO. Using conceptualisation of ISSiO as an example, Beebe and Rao (2010) explain it is a plan, Sveen et al (2009) assert it is a process and conceptualisations from Park and Ruighaver (2008), Ahmad et al (2014b) and Hong et al (2003) do not fit within either of these. There are many other researchers who have used the term 'information security strategy' in their literature however they have not provided an explicit definition.…”